feat(repos): add repos init command for manifest bootstrapping

[ggallen]

Summary

• Implements fullsend repos init per ADR-0057 (PR 4), which discovers existing fullsend installations across an org and generates a repos.yaml manifest
• Supports greenfield onboarding (new repos) and migration from existing per-repo/per-org installations
• Parallel bounded-concurrency discovery via forge.Client, with mode-based defaults computation and TODO tracking for fields needing manual attention

Details

Discovery

• Checks per-repo guard variable (FULLSEND_PER_REPO_INSTALL) and per-org config.yaml enrollment
• Extracts workflow ref from scaffold shim files (.github/workflows/fullsend.{yml,yaml})
• Bounded concurrency with configurable --concurrency flag (default 8)

Selection modes

• --all: include all discovered repos
• --repos org/repo1,org/repo2: explicit comma-separated list
• Interactive callback (default for org targets): CLI layer provides selection UI

Manifest generation

• Computes mint and defaults blocks using mode (most common value) across discovered repos
• Per-repo entries include overrides only for fields that differ from defaults
• Generates actionable TODOs for fields requiring manual attention (mint URL, GCP projects)

CLI

• fullsend repos init <org> — org-wide discovery and manifest generation
• fullsend repos init <owner/repo> — single-repo manifest
• Flags: --output/-o, --repos, --all, --mint-project, --mint-region, --inference-project, --concurrency

Test plan

• Unit tests for all core functions (92.5% package coverage)
• extractWorkflowRef — 5 cases (valid, no match, multiple uses, empty, garbage)
• Greenfield org — all flag, explicit repos, not-found error
• Migration — mixed sources, per-repo only, per-org only
• Single repo — per-repo, per-org, not installed
• Defaults computation — mode for refs, region overrides
• Interactive selection — callback receives correct candidates, nil callback error
• TODO generation — no mint project, no mint URL, multiple mint URLs
• Error handling — ListOrgRepos and ListRepoVariables failures, GetFileContent non-NotFound errors
• Manifest round-trip — marshal → parse → compare
• Edge cases — empty target, malformed target, whitespace trimming, config repo exclusion
• Lint and vet pass

🤖 Generated with Claude Code

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 11:59 PM UTC · Ended 12:09 AM UTC
Commit: 0a95cac · View workflow run →

[qodo-code-review]

PR Summary by Qodo

Add fullsend repos init to bootstrap repos.yaml from discovered installs

✨ Enhancement 🧪 Tests 🕐 40+ Minutes

AI Description

• Add fullsend repos init CLI to generate a repos.yaml manifest for an org or repo.
• Discover per-repo installs and per-org enrollments, then infer defaults via mode.
• Add comprehensive unit tests covering discovery, selection modes, TODOs, and errors.

Diagram

graph TD
  A["CLI: fullsend repos init"] --> B["repos.Init"] --> C["forge.Client"] --> D{{"GitHub API"}}
  C --> E["config.yaml (org)"]
  B --> F["repos.yaml manifest"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use errgroup-based worker pool with cancellation

• ➕ Cleaner bounded concurrency with structured cancellation/propagation on fatal errors
• ➕ Avoids spawning one goroutine per repo (better for very large orgs)
• ➕ Simplifies result collection (no manual mutex+sort)
• ➖ More plumbing to preserve stable output ordering
• ➖ Might be overkill if org sizes are typically small/medium

2. Fail-fast on discovery errors (instead of treating as 'new')

• ➕ Avoids accidentally generating manifests that imply repos are uninstalled
• ➕ Surfaces permission/API regressions immediately
• ➖ Reduces utility when a small subset of repos are temporarily inaccessible
• ➖ Requires additional UX for partial results / retry guidance

3. Cache/shared reads for org-scoped data

• ➕ Potentially fewer repeated calls if future features read more org-level files
• ➕ Clear separation between org-scoped and repo-scoped discovery
• ➖ Limited benefit in current implementation (org config already read once)

Recommendation: Current approach is reasonable for a bootstrap command: it prioritizes producing a manifest even when some repos error during discovery, and the mode-based defaults/TODOs make the output actionable. If this is expected to run on very large orgs, consider migrating discoverReposParallel to an errgroup/worker-pool pattern to reduce goroutine fan-out and improve cancellation semantics.

Files changed (4) +1635 / -0

Enhancement (3) +640 / -0

repos.goAdd 'repos' command group and 'repos init' CLI entrypoint +143/-0

Add 'repos' command group and 'repos init' CLI entrypoint

• Introduces a new top-level 'repos' Cobra command and an 'init' subcommand. Parses flags (output path, selection mode, mint/inference settings, concurrency), wires a selection callback for org targets, streams progress messages, and writes the generated manifest to file or stdout with TODO reporting.

internal/cli/repos.go

root.goRegister 'repos' commands on the root CLI +1/-0

Register 'repos' commands on the root CLI

• Adds 'newReposCmd()' to the root command so 'fullsend repos ...' becomes available.

internal/cli/root.go

init.goImplement discovery + manifest generation for 'repos init' +496/-0

Implement discovery + manifest generation for 'repos init'

• Implements org and single-repo init flows: detects per-repo installs via guard variable and per-org enrollments via 'config.yaml', extracts workflow refs from scaffold shim workflows, and runs discovery with bounded concurrency. Builds a repos.yaml manifest by computing mode-based defaults, emitting per-repo overrides only when they differ, and generating TODOs for missing/ambiguous fields; also adds YAML marshaling with a header comment.

internal/repos/init.go

Tests (1) +995 / -0

init_test.goAdd comprehensive unit tests for init/discovery/defaults/TODOs +995/-0

Add comprehensive unit tests for init/discovery/defaults/TODOs

• Adds extensive tests for workflow ref extraction, greenfield vs migration scenarios, single-repo behavior, defaults/override computation, interactive selection behavior, TODO generation, error handling, and manifest round-trip marshaling/parsing using the forge fake client.

internal/repos/init_test.go

[github-actions]

Site preview

Preview: https://f6cc1778-site.fullsend-ai.workers.dev

Commit: dc8712560f9f45482965b4db254d321d931ab1b5

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 54 rules

✅ Skills: writing-user-docs, writing-adrs

1. Config repo included ✓ Resolved 🐞 Bug ≡ Correctness

Description

initOrg feeds ListOrgRepos results directly into discovery/manifest building without excluding
the org config repo (.fullsend), so repos init <org> can generate a manifest entry for the
config repo itself and attempt discovery against it. This pollutes the manifest and risks later bulk
operations accidentally targeting .fullsend.

Code

internal/repos/init.go[R145-174]

+	progress(org, "discover", "listing org repos")
+	orgRepos, err := client.ListOrgRepos(ctx, org)
+	if err != nil {
+		return nil, fmt.Errorf("listing repos for org %s: %w", org, err)
+	}
+
+	// Read per-org config if it exists.
+	var orgCfg *config.OrgConfig
+	progress(org, "discover", "checking for per-org config")
+	configData, err := client.GetFileContent(ctx, org, forge.ConfigRepoName, "config.yaml")
+	if err == nil {
+		orgCfg, err = config.ParseOrgConfig(configData)
+		if err != nil {
+			return nil, fmt.Errorf("parsing per-org config for %s: %w", org, err)
+		}
+	}
+
+	// Discover repos in parallel.
+	discovered := discoverReposParallel(ctx, client, org, orgRepos, orgCfg, cfg.MaxConcurrency, progress)
+
+	// Build candidates for selection.
+	candidates := make([]RepoCandidate, 0, len(discovered))
+	for _, d := range discovered {
+		candidates = append(candidates, RepoCandidate{
+			Owner:  d.Owner,
+			Repo:   d.Repo,
+			Status: d.Source,
+			Ref:    d.FullsendRef,
+		})
+	}

Relevance

⭐⭐⭐ High

Repo-enrollment flows explicitly exclude .fullsend config repo; reviewers accepted this safety
pattern previously.

PR-#698
PR-#697

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

initOrg uses the raw ListOrgRepos output and passes it into parallel discovery/candidate
building with no filter. forge.ConfigRepoName is .fullsend, and GitHub ListOrgRepos explicitly
notes the default .fullsend config repo is public, meaning it will be included unless manually
excluded; other org-wide flows already skip it.

internal/repos/init.go[141-174]
internal/forge/forge.go[11-17]
internal/forge/github/github.go[345-392]
internal/cli/admin.go[451-460]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`repos init` should not treat the org-level config repo (`forge.ConfigRepoName`, `.fullsend`) as an eligible target repo. Currently the org-wide path lists org repos and processes them all, which can result in `.fullsend` being discovered and written into the generated `repos.yaml`.

### Issue Context
Other org-wide CLI flows explicitly skip `forge.ConfigRepoName` when iterating org repos, and `ListOrgRepos` does not exclude it.

### Fix Focus Areas
- internal/repos/init.go[141-174]
- internal/repos/init_test.go[95-165]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Discovery errors fail open ✓ Resolved 🐞 Bug ☼ Reliability

Description

discoverReposParallel converts any discoverRepo error into Source: "new" and continues,
silently misclassifying repos as greenfield when variables cannot be read (e.g.,
permissions/outages). This produces an incorrect manifest without forcing the operator to notice or
resolve the underlying access problem.

Code

internal/repos/init.go[R257-265]

+			d, err := discoverRepo(ctx, client, org, repo.Name, orgCfg, progress)
+			if err != nil {
+				progress(org+"/"+repo.Name, "discover", fmt.Sprintf("error: %v", err))
+				d = DiscoveredRepo{
+					Owner:  org,
+					Repo:   repo.Name,
+					Source: "new",
+				}
+			}

Relevance

⭐⭐⭐ High

Team previously accepted fixing fail-open on guard/variable read errors by skipping/failing-closed
instead.

PR-#967

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The code explicitly overwrites errored discoveries with Source: "new". In contrast, existing
org-wide enrollment code skips repos when guard/variable reads fail and can fail loudly when *all*
repos are skipped due to such errors; a past accepted bug also called out this same fail-open
pattern.

internal/repos/init.go[235-265]
internal/cli/admin.go[461-490]
PR-#967

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Org-wide repo discovery currently treats discovery failures as successful “new repo” discoveries. This is fail-open behavior that can silently generate wrong manifests.

### Issue Context
`discoverRepo` errors commonly mean the token can’t read repo variables (scope/permissions) or the API is failing. In these cases, the safe behavior is to **not** assume the repo is “new”.

### Fix Focus Areas
- internal/repos/init.go[235-283]
- internal/repos/init_test.go[754-780]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Repos flag whitespace bug ✓ Resolved 🐞 Bug ≡ Correctness

Description

--repos is split on commas but not trimmed, so common inputs like acme/api, acme/web produce
names with leading spaces that will not match candidate owner/repo strings and will error as “not
found”. This makes the explicit selection mode unexpectedly fragile.

Code

internal/cli/repos.go[R72-74]

+			if cfg.repoNames != "" {
+				initCfg.Repos = strings.Split(cfg.repoNames, ",")
+			}

Relevance

⭐⭐ Medium

No prior reviews found about trimming comma-split repo lists; likely acceptable but lacks historical
evidence.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The CLI uses strings.Split with no trimming. The explicit-selection path then checks each provided
name for exact presence in the candidate set, so any leading/trailing whitespace causes a false “not
found in org”.

internal/cli/repos.go[72-75]
internal/repos/init.go[203-217]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`--repos` parsing should normalize common operator input. Today it does a raw `strings.Split` which preserves whitespace, causing downstream exact-match validation failures.

### Issue Context
`selectInitRepos` validates explicit repo names via exact string match against `owner/repo` candidates.

### Fix Focus Areas
- internal/cli/repos.go[72-75]
- internal/repos/init.go[203-217]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Interactive path auto-selects all ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

When repos init <org> is run without --all or --repos, the CLI provides a “selection” callback
that returns every candidate repo, so the behavior is effectively equivalent to --all with no
possibility of excluding repos. This contradicts the command’s help text that implies a selection
step for greenfield onboarding.

Code

internal/cli/repos.go[R76-93]

+			var selectFn repos.RepoSelectFunc
+			if !cfg.all && initCfg.Repos == nil && !strings.Contains(target, "/") {
+				selectFn = func(candidates []repos.RepoCandidate) ([]string, error) {
+					printer.StepStart(fmt.Sprintf("Found %d repos:", len(candidates)))
+					for _, c := range candidates {
+						status := c.Status
+						if c.Ref != "" {
+							status += " @ " + c.Ref
+						}
+						printer.StepInfo(fmt.Sprintf("%s/%s (%s)", c.Owner, c.Repo, status))
+					}
+					names := make([]string, 0, len(candidates))
+					for _, c := range candidates {
+						names = append(names, c.Owner+"/"+c.Repo)
+					}
+					return names, nil
+				}
+			}

Relevance

⭐⭐ Medium

Team has strong CLI UX opinions, but no historical finding about interactive selection returning all
candidates.

PR-#698

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The CLI builds a selectFn in the ‘interactive’ branch but it only prints candidates and returns
all names. selectInitRepos relies entirely on the RepoSelectFunc output in interactive mode, so
there is no actual selection capability in this path.

internal/cli/repos.go[76-93]
internal/repos/init.go[228-233]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The org-target default mode is labeled/positioned as interactive selection, but the current callback implementation simply selects all repos.

### Issue Context
Until a real interactive selector exists, safer behavior is to (a) require `--all` or `--repos` for org targets, or (b) implement a minimal prompt that allows excluding repos.

### Fix Focus Areas
- internal/cli/repos.go[76-93]
- internal/repos/init.go[228-233]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[codecov]

Codecov Report

❌ Patch coverage is 80.42895% with 73 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/cli/repos.go	39.53%	49 Missing and 3 partials ⚠️
internal/repos/init.go	92.65%	13 Missing and 8 partials ⚠️

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:09 AM UTC · Completed 12:23 AM UTC
Commit: 4cab3e6 · View workflow run →

[fullsend-ai-review]

Review

The prior medium finding ([missing-command-reference] in docs/guides/getting-started/operations.md) has been resolved — the Fleet Admin table now includes fullsend repos init.

Findings

Low

• [edge-case] internal/repos/init.go:411 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [error-message-format] internal/repos/init.go:482 — parseInitTarget returns bare validation errors (e.g., target cannot be empty) without a wrapping context prefix. Verified this is consistent with the package's own conventions — manifest.go's Validate() uses the same bare-message pattern for input validation (e.g., mint.url is required), while context wrapping is reserved for I/O and API errors.

Previous run

Findings

Medium

• [missing-command-reference] docs/guides/getting-started/operations.md:74 — The Fleet Admin section only documents fullsend repos status but not the new fullsend repos init command. The init command generates the repos.yaml manifest that the status command consumes.
  Remediation: Add a row for fullsend repos init in the Fleet Admin section of the table at line 74, before or after the repos status entry.

Low

• [edge-case] internal/repos/init.go:411 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. The implementation plan docs/plans/repos-init.md also exists. Consider linking an issue for traceability.

Previous run

Review

Findings

Medium

• [missing-command-reference] docs/guides/getting-started/operations.md:74 — The Fleet Admin section only documents fullsend repos status but not the new fullsend repos init command. The init command generates the repos.yaml manifest that the status command consumes.
  Remediation: Add a row for fullsend repos init in the Fleet Admin section of the table at line 74, before or after the repos status entry.

Low

• [edge-case] internal/repos/init.go:411 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. The implementation plan docs/plans/repos-init.md also exists. Consider linking an issue for traceability.

Previous run (2)

All prior medium and higher findings have been resolved across previous iterations. The error message prefix inconsistency (repos init: prefix) flagged in the prior review has been fixed in this revision — all error messages now use bare descriptive text consistent with codebase conventions. No new medium or higher findings.

The code is well-structured: correct use of the forge.Client abstraction throughout, comprehensive test coverage (~1200 lines for ~550 lines of production code), proper error handling with forge.IsNotFound guards on all GetFileContent calls, correct concurrent discovery patterns with sync.Mutex protection and context cancellation error recording, and deterministic ordering via index-based sorting. Documentation is complete: CLI reference page, README table, sidebar entry, and command tree all present.

Review

Findings

Low

• [edge-case] internal/repos/init.go — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. The implementation plan docs/plans/repos-init.md also exists. Consider linking an issue for traceability.

Previous run (3)

All prior medium and higher findings have been resolved across previous iterations. No new medium or higher findings. The code is well-structured with correct use of the forge.Client abstraction, comprehensive test coverage (~1200 lines for ~550 lines of production code), proper error handling with forge.IsNotFound guards on all GetFileContent calls, correct concurrent discovery patterns with sync.Mutex protection, and deterministic ordering via index-based sorting. Documentation is complete: CLI reference page, README table, sidebar entry, and command tree all present.

Review

Findings

Low

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [error-message-format] internal/repos/init.go:365 — Error messages at lines 365, 368, 500, and 525 use a repos init: prefix (e.g., repos init: --all flag cannot be used with a single repo target), while other error paths in the same file use bare descriptive messages. The codebase convention in other CLI packages omits command-name prefixes, relying on cobra's command path for context.

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. The implementation plan docs/plans/repos-init.md also exists. Consider linking an issue for traceability.

Previous run (4)

All prior medium and higher findings have been resolved across previous iterations. No new medium or higher findings. The code is well-structured with correct use of the forge.Client abstraction, comprehensive test coverage (~1200 lines for ~550 lines of production code), proper error handling with forge.IsNotFound guards on all GetFileContent calls, correct concurrent discovery patterns with sync.Mutex protection, and deterministic ordering via index-based sorting. Documentation is complete: CLI reference page, README table, sidebar entry, and command tree all present.

Review

Findings

Low

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [error-message-format] internal/repos/init.go:365 — Error messages at lines 365, 368, 500, and 525 use a repos init: prefix (e.g., repos init: --all flag cannot be used with a single repo target), while other error paths in the same file use bare descriptive messages. The codebase convention in other CLI packages omits command-name prefixes, relying on cobra's command path for context.

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. The implementation plan docs/plans/repos-init.md also exists. Consider linking an issue for traceability.

Previous run (5)

Prior low finding about silent --all/--repos flag behavior has been fixed — the code now returns explicit errors for incompatible flag combinations with test coverage. No new medium or higher findings. The code is well-structured with proper error handling via forge.IsNotFound guards, comprehensive test coverage, and correct concurrent discovery patterns.

Review

Findings

Low

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [error-message-format] internal/repos/init.go:365 — Error messages at lines 365, 368, 500, and 525 use a repos init: prefix (e.g., repos init: --all flag cannot be used with a single repo target), while other error paths in the same file use bare descriptive messages. The codebase convention in other CLI packages omits command-name prefixes, relying on cobra's command path for context.

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. The implementation plan docs/plans/repos-init.md also exists. Consider linking an issue for traceability.

Previous run (6)

Prior low finding about silent --all/--repos flag behavior has been fixed — the code now returns explicit errors for incompatible flag combinations with test coverage. No new medium or higher findings. The code is well-structured with proper error handling via forge.IsNotFound guards, comprehensive test coverage, and correct concurrent discovery patterns.

Review

Findings

Low

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [error-message-format] internal/repos/init.go:365 — Error messages at lines 365, 368, 500, and 525 use a repos init: prefix (e.g., repos init: --all flag cannot be used with a single repo target), while other error paths in the same file use bare descriptive messages. The codebase convention in other CLI packages omits command-name prefixes, relying on cobra's command path for context.

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. The implementation plan docs/plans/repos-init.md also exists. Consider linking an issue for traceability.

Previous run (7)

All prior medium findings have been resolved across previous iterations. No new medium or higher findings. The code is well-structured, uses the forge.Client abstraction correctly, has comprehensive test coverage (92.5% per the PR description), and proper error handling including forge.IsNotFound guards on all GetFileContent calls. The config.ts reformatting is cosmetic (single → double quotes) with the functional addition of the repos sidebar entry.

Review

Findings

Low

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [silent-flag-ignore] internal/repos/init.go:86 — When the target is a single repo (owner/repo), the --repos and --all flags are silently ignored. A user running fullsend repos init acme/widget --all might expect org-wide discovery but only the single repo is processed. Consider returning an error when isRepo is true but cfg.All or cfg.Repos is also set.

• [error-message-format] internal/repos/init.go:229 — Error messages at lines 229 and 254 use a repos init: prefix (e.g., repos init: --repos list is empty), while other error paths in the same function omit it. Minor style inconsistency.

• [missing-doc] docs/guides/README.md — The guides index does not mention the new fullsend repos command group. Acceptable to defer until the full command group (install, status, sync) lands.

Previous run (8)

All prior medium findings have been resolved across previous iterations. No new medium or higher findings. The code is well-structured, uses the forge.Client abstraction correctly, has comprehensive test coverage (92.5% per the PR description), and proper error handling including forge.IsNotFound guards on all GetFileContent calls. The config.ts reformatting is cosmetic (single → double quotes) with the functional addition of the repos sidebar entry.

Review

Findings

Low

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. Verified that config.OrgConfig has no inference region field — this reflects the current data model, not a bug. Creates an asymmetry in defaults computation when both installation types coexist.

• [silent-flag-ignore] internal/repos/init.go:86 — When the target is a single repo (owner/repo), the --repos and --all flags are silently ignored. A user running fullsend repos init acme/widget --all might expect org-wide discovery but only the single repo is processed. Consider returning an error when isRepo is true but cfg.All or cfg.Repos is also set.

• [error-message-format] internal/repos/init.go:229 — Error messages at lines 229 and 254 use a repos init: prefix (e.g., repos init: --repos list is empty), while other error paths in the same function omit it. Minor style inconsistency.

• [missing-doc] docs/guides/README.md — The guides index does not mention the new fullsend repos command group. Acceptable to defer until the full command group (install, status, sync) lands.

Previous run (9)

The prior review's medium finding (silent data loss on context cancellation in discoverReposParallel) has been addressed — cancelled goroutines now record errors. The prior low finding about error message path duplication in repos.go has also been fixed. All remaining findings are low severity.

Review

Findings

Low

• [error-message-format] internal/repos/init.go:229 — Error messages at lines 229 and 254 use a repos init: prefix (e.g., repos init: --repos list is empty), which differs from the descriptive lowercase pattern used elsewhere in init.go and the codebase (e.g., listing variables for %s: %w, parsing per-org config for %s: %w). Minor style inconsistency.

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. This reflects the current OrgConfig data model which has no region field, but creates an asymmetry in defaults computation when both installation types coexist.

• [missing-doc] docs/guides/README.md — The guides index does not mention the new fullsend repos command group. Acceptable to defer until the full command group (install, status, sync) lands.

Previous run (10)

The prior review's medium finding (silent data loss on context cancellation in discoverReposParallel) has been addressed — cancelled goroutines now record errors. The prior low finding about error message path duplication in repos.go has also been fixed. All remaining findings are low severity.

Review

Findings

Low

• [error-message-format] internal/repos/init.go:229 — Error messages at lines 229 and 254 use a repos init: prefix (e.g., repos init: --repos list is empty), which differs from the descriptive lowercase pattern used elsewhere in init.go and the codebase (e.g., listing variables for %s: %w, parsing per-org config for %s: %w). Minor style inconsistency.

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. This reflects the current OrgConfig data model which has no region field, but creates an asymmetry in defaults computation when both installation types coexist.

• [missing-doc] docs/guides/README.md — The guides index does not mention the new fullsend repos command group. Acceptable to defer until the full command group (install, status, sync) lands.

Previous run (11)

Review

The prior review's critical finding (duplicate ProgressFunc type declaration) was a false positive — init.go does not redefine ProgressFunc; it uses the type defined in install.go. All prior medium findings have been addressed across previous iterations. One new medium-severity finding emerged.

Findings

Medium

• [silent data loss on context cancellation] internal/repos/init.go:285 — In discoverReposParallel, when ctx.Done() fires in the semaphore select, the goroutine returns without adding anything to either the discovered or errors slices. The repo is silently dropped from all outputs. A partial context cancellation (e.g., operator Ctrl-C during discovery of a large org) can produce a manifest that silently omits repos without any indication to the user. The caller (initOrg) surfaces discovery.errors to the user, so this gap is fixable.
  Remediation: When the ctx.Done() branch is taken, record the repo in the errors slice: mu.Lock(); errors = append(errors, fmt.Sprintf("%s/%s: %v", org, repo.Name, ctx.Err())); mu.Unlock().

Low

• [edge-case] internal/repos/init.go:355 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. This reflects the current OrgConfig data model which has no region field, but creates an asymmetry in defaults computation when both installation types coexist.

• [edge-case] internal/repos/init.go:406 — buildManifest generates TODO placeholder strings (e.g., # TODO: set mint URL) as field values rather than YAML comments. The manifest is syntactically valid but will fail Manifest.Validate() until manually edited. This is by design (the header comment says "Review and adjust before running fullsend repos install").

• [error-message-pattern] internal/cli/repos.go:108 — Error message includes the path in the format string (writing manifest to %s), but os.WriteFile returns a *PathError that also contains the path, resulting in duplication (e.g., writing manifest to repos.yaml: open repos.yaml: permission denied).

• [missing-doc] docs/guides/README.md — The guides index does not mention the new fullsend repos command group. The PR adds docs/cli/repos.md for CLI-level documentation, but the guides README (organized by audience/workflow) has no entry. Acceptable to defer until the full command group lands.

Previous run (12)

Findings

Critical

• [logic-error] internal/repos/init.go:54 — ProgressFunc is defined as type ProgressFunc func(repo, phase, message string) in both internal/repos/init.go (line 54) and internal/repos/install.go (line 143). Both files are in package repos. Go does not allow duplicate type declarations within the same package, even across files. This PR will fail to compile.
  Remediation: Remove the ProgressFunc type declaration from init.go. The type in install.go has the same signature and is already available within the package.

Low

• [missing-doc] docs/guides/README.md — The guides README does not mention the new fullsend repos command group. The PR adds docs/cli/repos.md for CLI-level documentation, but the guides README (organized by audience/workflow) has no entry. Acceptable to defer until the full command group (install, status, sync) lands.

• [missing-doc] docs/guides/getting-started/operations.md — The standalone commands table does not mention fullsend repos. The table lists leaf-level subcommands grouped by IAM role; adding repos init alone would be structurally inconsistent until more subcommands exist.

• [missing-doc] docs/guides/getting-started/org-mode.md — The per-org mode guide mentions deprecation (ADR-0044) but does not point to fullsend repos init as a migration path. Acceptable to defer since repos install is not yet implemented.

• [edge-case] internal/repos/init.go:349 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. This reflects the current OrgConfig data model which has no region field, but creates an asymmetry in defaults computation.

• [edge-case] internal/repos/init.go:404 — buildManifest generates TODO placeholder strings (e.g., # TODO: set mint URL) as field values rather than YAML comments. The manifest is syntactically valid but will fail Manifest.Validate() until manually edited. This is by design (the header comment says "Review and adjust before running fullsend repos install").

• [progress-message-capitalization] internal/repos/init.go — Progress messages use lowercase (e.g., "checking installation status", "reading variables") while install.go in the same package uses title case (e.g., "Checking installation status"). Creates inconsistency within the repos package.

Previous run (13)

Review

Findings

Critical

• [logic-error] internal/repos/init.go:54 — ProgressFunc is defined as type ProgressFunc func(repo, phase, message string) in both internal/repos/init.go (line 54) and internal/repos/install.go (line 143). Both files are in package repos. Go does not allow duplicate type declarations within the same package, even across files. This PR will fail to compile.
  Remediation: Remove the ProgressFunc type declaration from init.go. The type in install.go has the same signature and is already available within the package.

Low

• [missing-doc] docs/guides/README.md — The guides README does not mention the new fullsend repos command group. The PR adds docs/cli/repos.md for CLI-level documentation, but the guides README (organized by audience/workflow) has no entry. Acceptable to defer until the full command group (install, status, sync) lands.

• [missing-doc] docs/guides/getting-started/operations.md — The standalone commands table does not mention fullsend repos. The table lists leaf-level subcommands grouped by IAM role; adding repos init alone would be structurally inconsistent until more subcommands exist.

• [missing-doc] docs/guides/getting-started/org-mode.md — The per-org mode guide mentions deprecation (ADR-0044) but does not point to fullsend repos init as a migration path. Acceptable to defer since repos install is not yet implemented.

• [edge-case] internal/repos/init.go:349 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. This reflects the current OrgConfig data model which has no region field, but creates an asymmetry in defaults computation.

• [edge-case] internal/repos/init.go:404 — buildManifest generates TODO placeholder strings (e.g., # TODO: set mint URL) as field values rather than YAML comments. The manifest is syntactically valid but will fail Manifest.Validate() until manually edited. This is by design (the header comment says "Review and adjust before running fullsend repos install").

• [progress-message-capitalization] internal/repos/init.go — Progress messages use lowercase (e.g., "checking installation status", "reading variables") while install.go in the same package uses title case (e.g., "Checking installation status"). Creates inconsistency within the repos package.

Previous run (14)

All three medium-severity findings from the prior review have been addressed: readWorkflowRef now properly propagates non-404 errors via forge.IsNotFound, CLI documentation has been added (README table, repos.md reference, cli-internals tree, sidebar entry), and the Long description accurately reflects the current state.

No medium or higher findings remain. The following low-severity items are noted for future consideration.

Findings

Low

• [edge-case] internal/repos/init.go:230 — selectInitRepos treats a non-nil but empty cfg.Repos slice as explicit mode, returning an empty slice without falling through to --all or interactive selection. An operator programmatically passing an empty slice would get an empty manifest with no error.

• [edge-case] internal/repos/init.go:349 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. This reflects the current OrgConfig data model which has no region field, but creates an asymmetry in defaults computation.

• [edge-case] internal/repos/init.go:404 — buildManifest generates TODO placeholder strings (e.g., # TODO: set mint URL) as field values rather than YAML comments. The manifest is syntactically valid but will fail Manifest.Validate() until manually edited. This is by design (the header comment says "Review and adjust before running fullsend repos install").

• [naming-inconsistency] internal/cli/repos.go:89 — The progress callback variable is named progress while the ui.Printer instance is named printer on line 60. While the types are distinct (closure vs ui.Printer), other CLI commands use printer methods directly for progress reporting rather than callbacks. Minor style difference.

• [error-message-pattern] internal/repos/init.go:254 — Error message includes a repos init: prefix, but the codebase convention in other CLI packages omits command prefixes. The prefix originates from the non-CLI repos package where command context is not implicit, so the prefix provides useful context.

• [output-formatting-pattern] internal/cli/repos.go:118 — Uses printer.StepInfo for error summary and TODO section headers. Codebase convention uses StepWarn for error conditions and Header for section headers.

Previous run

Review

All three medium-severity findings from the prior review have been addressed: org config error handling now properly distinguishes not-found from other errors via forge.IsNotFound, CLI documentation has been added (README table, repos.md reference, cli-internals tree), and the Long description now accurately reflects the current state of the command group.

Two new medium-severity findings emerged from this review. Neither is blocking — both are improvements worth making before or shortly after merge.

Findings

Medium

• [error-handling-gap] internal/repos/init.go (line 369) — readWorkflowRef silently swallows all GetFileContent errors, including non-404 errors (network timeouts, HTTP 500, permission errors). When a transient error occurs, the function returns an empty string, causing the repo's fullsend_ref to be silently lost. In buildManifest, a missing ref causes the repo to appear to match the default ref, so no per-repo override is generated — the manifest misrepresents the repo's actual state. The PR correctly fixed this same pattern in initSingleRepo and initOrg using forge.IsNotFound(err), but readWorkflowRef retains the old error-swallowing behavior.
  Remediation: Return (string, error) from readWorkflowRef and propagate non-404 errors. Use the same forge.IsNotFound(err) guard applied elsewhere in this PR.

• [stale-doc] website/.vitepress/config.ts — The CLI sidebar config uses manual { text, link } entries (not getMarkdownFiles() auto-discovery). The PR adds docs/cli/repos.md but does not add a corresponding sidebar entry. The new page will not appear in the website navigation. Per AGENTS.md: "All other sections need a manual { text, link } entry."
  Remediation: Add { text: 'fullsend repos', link: '/cli/repos' } to the /cli/ sidebar items array in website/.vitepress/config.ts.

Low

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. Consider linking an issue for traceability.

• [edge-case] internal/repos/init.go (line 264) — discoverReposParallel does not check ctx.Done() before acquiring the semaphore. If context is cancelled (e.g., operator Ctrl-C), queued goroutines proceed through the semaphore one by one making doomed API calls before failing. Not a correctness bug (no goroutine leak), but degrades cancellation responsiveness with large org counts.

• [test-coverage-gap] internal/repos/init_test.go — No test exercises readWorkflowRef when GetFileContent returns a non-404 error (e.g., network error). The existing TestReadWorkflowRef_NoWorkflowFile only covers the not-found case. A test with a generic error would validate (or catch changes to) the current silent-swallow behavior.

Previous run

Review

Findings

Medium

• [error-handling-gap] internal/repos/init.go:281 — GetFileContent error for org config is silently swallowed in both initSingleRepo (line 281) and initOrg (line 323). If GetFileContent returns an error other than "not found" (e.g., network timeout, 500), the code proceeds with orgCfg = nil, causing a per-org enrolled repo to be misclassified as "new". forge.IsNotFound exists (forge.go:22-24) and the GitHub implementation wraps 404s as forge.ErrNotFound (github.go:91-92).
  Remediation: After GetFileContent, distinguish not-found from other errors: if err == nil { /* parse */ } else if !forge.IsNotFound(err) { return nil, fmt.Errorf("fetching org config: %w", err) }.

• [missing-cli-documentation] docs/cli/README.md — The CLI overview command groups table lists fullsend github, fullsend inference, and fullsend mint but omits the new fullsend repos group.
  Remediation: Add a row for fullsend repos to the command groups table.

• [missing-cli-reference] docs/cli/repos.md — No CLI reference documentation exists for the new fullsend repos command group. Other command groups (github.md, inference.md, mint.md) have reference docs.
  Remediation: Create docs/cli/repos.md following the pattern of docs/cli/github.md.

• [missing-authorization-context] internal/cli/repos.go:24 — The Long description for the repos command group promises "bulk install, status, sync, upgrade, and remove operations" but only init is implemented. Users running fullsend repos --help will see promises of commands that don't exist yet.
  Remediation: Update the Long description to reflect the current state, e.g., "Currently supports manifest generation via repos init; additional commands are planned per ADR-0057."

Low

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17) and the repos-init.md plan, but the PR lacks an explicit issue link. Consider linking an issue or noting "Authorized by ADR-0057 (strategic)" in the PR description.

• [input-validation] internal/cli/repos.go:58 — The target argument is passed to forge.Client API calls without calling validateOrgName(). Every other CLI command in the codebase validates org names before use.
  Remediation: Call validateOrgName(owner) after parseInitTarget.

• [edge-case] internal/repos/init.go:263 — parseInitTarget with trailing slash (e.g., "acme/") produces owner="acme", repo="", isRepo=true, causing confusing downstream API errors rather than a clear validation message.
  Remediation: Add validation to reject empty owner or repo when isRepo is true.

• [output-formatting] internal/cli/repos.go:115 — Uses printer.StepStart for informational headers (error summary and TODOs), but the codebase convention uses StepStart for in-progress operations and StepInfo for informational text.

• [error-message-content] internal/repos/init.go:401 — Error message "org target requires --all or --repos flag" doesn't include the command name, unlike established patterns in other CLI commands.

• [missing-cli-tree-update] docs/guides/dev/cli-internals.md — The CLI command tree does not include the new fullsend repos subcommand group.

• [scope-expansion-beyond-plan] internal/repos/init.go:228 — extractWorkflowRef is defined in init.go per the plan's guidance. Consider adding a TODO comment about consolidating into a shared file when repos status lands.

• [naming-inconsistency] internal/repos/init.go:163 — Function name Init is consistent with the CLI command repos init but doesn't clearly signal read-only semantics vs future write-path operations. Minor style preference.

---

Labels: New Go CLI feature for installation bootstrapping and manifest generation.

Previous run (15)

All three medium-severity findings from the prior review have been addressed: readWorkflowRef now properly propagates non-404 errors via forge.IsNotFound, CLI documentation has been added (README table, repos.md reference, cli-internals tree, sidebar entry), and the Long description accurately reflects the current state.

No medium or higher findings remain. The following low-severity items are noted for future consideration.

Findings

Low

• [edge-case] internal/repos/init.go:230 — selectInitRepos treats a non-nil but empty cfg.Repos slice as explicit mode, returning an empty slice without falling through to --all or interactive selection. An operator programmatically passing an empty slice would get an empty manifest with no error.

• [edge-case] internal/repos/init.go:349 — Per-org discovered repos do not populate InferenceRegion (unlike per-repo installations which read FULLSEND_GCP_REGION), so per-org repos never contribute to the mode computation for defaultRegion in buildManifest. This reflects the current OrgConfig data model which has no region field, but creates an asymmetry in defaults computation.

• [edge-case] internal/repos/init.go:404 — buildManifest generates TODO placeholder strings (e.g., # TODO: set mint URL) as field values rather than YAML comments. The manifest is syntactically valid but will fail Manifest.Validate() until manually edited. This is by design (the header comment says "Review and adjust before running fullsend repos install").

• [naming-inconsistency] internal/cli/repos.go:89 — The progress callback variable is named progress while the ui.Printer instance is named printer on line 60. While the types are distinct (closure vs ui.Printer), other CLI commands use printer methods directly for progress reporting rather than callbacks. Minor style difference.

• [error-message-pattern] internal/repos/init.go:254 — Error message includes a repos init: prefix, but the codebase convention in other CLI packages omits command prefixes. The prefix originates from the non-CLI repos package where command context is not implicit, so the prefix provides useful context.

• [output-formatting-pattern] internal/cli/repos.go:118 — Uses printer.StepInfo for error summary and TODO section headers. Codebase convention uses StepWarn for error conditions and Header for section headers.

Previous run (16)

Review

All three medium-severity findings from the prior review have been addressed: org config error handling now properly distinguishes not-found from other errors via forge.IsNotFound, CLI documentation has been added (README table, repos.md reference, cli-internals tree), and the Long description now accurately reflects the current state of the command group.

Two new medium-severity findings emerged from this review. Neither is blocking — both are improvements worth making before or shortly after merge.

Findings

Medium

• [error-handling-gap] internal/repos/init.go (line 369) — readWorkflowRef silently swallows all GetFileContent errors, including non-404 errors (network timeouts, HTTP 500, permission errors). When a transient error occurs, the function returns an empty string, causing the repo's fullsend_ref to be silently lost. In buildManifest, a missing ref causes the repo to appear to match the default ref, so no per-repo override is generated — the manifest misrepresents the repo's actual state. The PR correctly fixed this same pattern in initSingleRepo and initOrg using forge.IsNotFound(err), but readWorkflowRef retains the old error-swallowing behavior.
  Remediation: Return (string, error) from readWorkflowRef and propagate non-404 errors. Use the same forge.IsNotFound(err) guard applied elsewhere in this PR.

• [stale-doc] website/.vitepress/config.ts — The CLI sidebar config uses manual { text, link } entries (not getMarkdownFiles() auto-discovery). The PR adds docs/cli/repos.md but does not add a corresponding sidebar entry. The new page will not appear in the website navigation. Per AGENTS.md: "All other sections need a manual { text, link } entry."
  Remediation: Add { text: 'fullsend repos', link: '/cli/repos' } to the /cli/ sidebar items array in website/.vitepress/config.ts.

Low

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. Consider linking an issue for traceability.

• [edge-case] internal/repos/init.go (line 264) — discoverReposParallel does not check ctx.Done() before acquiring the semaphore. If context is cancelled (e.g., operator Ctrl-C), queued goroutines proceed through the semaphore one by one making doomed API calls before failing. Not a correctness bug (no goroutine leak), but degrades cancellation responsiveness with large org counts.

• [test-coverage-gap] internal/repos/init_test.go — No test exercises readWorkflowRef when GetFileContent returns a non-404 error (e.g., network error). The existing TestReadWorkflowRef_NoWorkflowFile only covers the not-found case. A test with a generic error would validate (or catch changes to) the current silent-swallow behavior.

Previous run

Review

Findings

Medium

• [error-handling-gap] internal/repos/init.go:281 — GetFileContent error for org config is silently swallowed in both initSingleRepo (line 281) and initOrg (line 323). If GetFileContent returns an error other than "not found" (e.g., network timeout, 500), the code proceeds with orgCfg = nil, causing a per-org enrolled repo to be misclassified as "new". forge.IsNotFound exists (forge.go:22-24) and the GitHub implementation wraps 404s as forge.ErrNotFound (github.go:91-92).
  Remediation: After GetFileContent, distinguish not-found from other errors: if err == nil { /* parse */ } else if !forge.IsNotFound(err) { return nil, fmt.Errorf("fetching org config: %w", err) }.

• [missing-cli-documentation] docs/cli/README.md — The CLI overview command groups table lists fullsend github, fullsend inference, and fullsend mint but omits the new fullsend repos group.
  Remediation: Add a row for fullsend repos to the command groups table.

• [missing-cli-reference] docs/cli/repos.md — No CLI reference documentation exists for the new fullsend repos command group. Other command groups (github.md, inference.md, mint.md) have reference docs.
  Remediation: Create docs/cli/repos.md following the pattern of docs/cli/github.md.

• [missing-authorization-context] internal/cli/repos.go:24 — The Long description for the repos command group promises "bulk install, status, sync, upgrade, and remove operations" but only init is implemented. Users running fullsend repos --help will see promises of commands that don't exist yet.
  Remediation: Update the Long description to reflect the current state, e.g., "Currently supports manifest generation via repos init; additional commands are planned per ADR-0057."

Low

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17) and the repos-init.md plan, but the PR lacks an explicit issue link. Consider linking an issue or noting "Authorized by ADR-0057 (strategic)" in the PR description.

• [input-validation] internal/cli/repos.go:58 — The target argument is passed to forge.Client API calls without calling validateOrgName(). Every other CLI command in the codebase validates org names before use.
  Remediation: Call validateOrgName(owner) after parseInitTarget.

• [edge-case] internal/repos/init.go:263 — parseInitTarget with trailing slash (e.g., "acme/") produces owner="acme", repo="", isRepo=true, causing confusing downstream API errors rather than a clear validation message.
  Remediation: Add validation to reject empty owner or repo when isRepo is true.

• [output-formatting] internal/cli/repos.go:115 — Uses printer.StepStart for informational headers (error summary and TODOs), but the codebase convention uses StepStart for in-progress operations and StepInfo for informational text.

• [error-message-content] internal/repos/init.go:401 — Error message "org target requires --all or --repos flag" doesn't include the command name, unlike established patterns in other CLI commands.

• [missing-cli-tree-update] docs/guides/dev/cli-internals.md — The CLI command tree does not include the new fullsend repos subcommand group.

• [scope-expansion-beyond-plan] internal/repos/init.go:228 — extractWorkflowRef is defined in init.go per the plan's guidance. Consider adding a TODO comment about consolidating into a shared file when repos status lands.

• [naming-inconsistency] internal/repos/init.go:163 — Function name Init is consistent with the CLI command repos init but doesn't clearly signal read-only semantics vs future write-path operations. Minor style preference.

---

Labels: New Go CLI feature for installation bootstrapping and manifest generation.

Previous run (17)

Review

All three medium-severity findings from the prior review have been addressed: org config error handling now properly distinguishes not-found from other errors via forge.IsNotFound, CLI documentation has been added (README table, repos.md reference, cli-internals tree), and the Long description now accurately reflects the current state of the command group.

Two new medium-severity findings emerged from this review. Neither is blocking — both are improvements worth making before or shortly after merge.

Findings

Medium

• [error-handling-gap] internal/repos/init.go (line 369) — readWorkflowRef silently swallows all GetFileContent errors, including non-404 errors (network timeouts, HTTP 500, permission errors). When a transient error occurs, the function returns an empty string, causing the repo's fullsend_ref to be silently lost. In buildManifest, a missing ref causes the repo to appear to match the default ref, so no per-repo override is generated — the manifest misrepresents the repo's actual state. The PR correctly fixed this same pattern in initSingleRepo and initOrg using forge.IsNotFound(err), but readWorkflowRef retains the old error-swallowing behavior.
  Remediation: Return (string, error) from readWorkflowRef and propagate non-404 errors. Use the same forge.IsNotFound(err) guard applied elsewhere in this PR.

• [stale-doc] website/.vitepress/config.ts — The CLI sidebar config uses manual { text, link } entries (not getMarkdownFiles() auto-discovery). The PR adds docs/cli/repos.md but does not add a corresponding sidebar entry. The new page will not appear in the website navigation. Per AGENTS.md: "All other sections need a manual { text, link } entry."
  Remediation: Add { text: 'fullsend repos', link: '/cli/repos' } to the /cli/ sidebar items array in website/.vitepress/config.ts.

Low

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17), which defines the fullsend repos subcommand group and lists repos init as the first command. Consider linking an issue for traceability.

• [edge-case] internal/repos/init.go (line 264) — discoverReposParallel does not check ctx.Done() before acquiring the semaphore. If context is cancelled (e.g., operator Ctrl-C), queued goroutines proceed through the semaphore one by one making doomed API calls before failing. Not a correctness bug (no goroutine leak), but degrades cancellation responsiveness with large org counts.

• [test-coverage-gap] internal/repos/init_test.go — No test exercises readWorkflowRef when GetFileContent returns a non-404 error (e.g., network error). The existing TestReadWorkflowRef_NoWorkflowFile only covers the not-found case. A test with a generic error would validate (or catch changes to) the current silent-swallow behavior.

Previous run (18)

Review

Findings

Medium

• [error-handling-gap] internal/repos/init.go:281 — GetFileContent error for org config is silently swallowed in both initSingleRepo (line 281) and initOrg (line 323). If GetFileContent returns an error other than "not found" (e.g., network timeout, 500), the code proceeds with orgCfg = nil, causing a per-org enrolled repo to be misclassified as "new". forge.IsNotFound exists (forge.go:22-24) and the GitHub implementation wraps 404s as forge.ErrNotFound (github.go:91-92).
  Remediation: After GetFileContent, distinguish not-found from other errors: if err == nil { /* parse */ } else if !forge.IsNotFound(err) { return nil, fmt.Errorf("fetching org config: %w", err) }.

• [missing-cli-documentation] docs/cli/README.md — The CLI overview command groups table lists fullsend github, fullsend inference, and fullsend mint but omits the new fullsend repos group.
  Remediation: Add a row for fullsend repos to the command groups table.

• [missing-cli-reference] docs/cli/repos.md — No CLI reference documentation exists for the new fullsend repos command group. Other command groups (github.md, inference.md, mint.md) have reference docs.
  Remediation: Create docs/cli/repos.md following the pattern of docs/cli/github.md.

• [missing-authorization-context] internal/cli/repos.go:24 — The Long description for the repos command group promises "bulk install, status, sync, upgrade, and remove operations" but only init is implemented. Users running fullsend repos --help will see promises of commands that don't exist yet.
  Remediation: Update the Long description to reflect the current state, e.g., "Currently supports manifest generation via repos init; additional commands are planned per ADR-0057."

Low

• [missing-authorization] PR metadata — No linked issue. The work is authorized by ADR-0057 (Accepted, 2026-06-17) and the repos-init.md plan, but the PR lacks an explicit issue link. Consider linking an issue or noting "Authorized by ADR-0057 (strategic)" in the PR description.

• [input-validation] internal/cli/repos.go:58 — The target argument is passed to forge.Client API calls without calling validateOrgName(). Every other CLI command in the codebase validates org names before use.
  Remediation: Call validateOrgName(owner) after parseInitTarget.

• [edge-case] internal/repos/init.go:263 — parseInitTarget with trailing slash (e.g., "acme/") produces owner="acme", repo="", isRepo=true, causing confusing downstream API errors rather than a clear validation message.
  Remediation: Add validation to reject empty owner or repo when isRepo is true.

• [output-formatting] internal/cli/repos.go:115 — Uses printer.StepStart for informational headers (error summary and TODOs), but the codebase convention uses StepStart for in-progress operations and StepInfo for informational text.

• [error-message-content] internal/repos/init.go:401 — Error message "org target requires --all or --repos flag" doesn't include the command name, unlike established patterns in other CLI commands.

• [missing-cli-tree-update] docs/guides/dev/cli-internals.md — The CLI command tree does not include the new fullsend repos subcommand group.

• [scope-expansion-beyond-plan] internal/repos/init.go:228 — extractWorkflowRef is defined in init.go per the plan's guidance. Consider adding a TODO comment about consolidating into a shared file when repos status lands.

• [naming-inconsistency] internal/repos/init.go:163 — Function name Init is consistent with the CLI command repos init but doesn't clearly signal read-only semantics vs future write-path operations. Minor style preference.

---

Labels: New Go CLI feature for installation bootstrapping and manifest generation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:30 AM UTC · Completed 12:43 AM UTC
Commit: c25aace · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:48 AM UTC · Completed 1:11 AM UTC
Commit: cc722d2 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:57 PM UTC · Completed 6:09 PM UTC
Commit: 8bab41a · View workflow run →

[waynesun09]

Review Squad Report — Round 2

Agents: 4 (claude-coder, claude-researcher, gemini-code-review, cursor-code-review)
Models: Claude, Gemini, Codex
Verified findings: 6 inline (1 HIGH, 5 MEDIUM)
False positives removed: 7 (gemini reviewed files outside PR diff)

All Round 1 issues have been addressed. These are new findings from Round 2.

Assisted-by: Claude (review), Gemini (review), Codex (review)

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 6:13 PM UTC · Ended 6:21 PM UTC
Commit: e8381e3 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:22 PM UTC · Completed 6:33 PM UTC
Commit: dc87125 · View workflow run →

[waynesun09]

All review findings resolved across 2 rounds (46 threads, 0 unresolved). CI green. LGTM.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:24 AM UTC · Completed 12:34 AM UTC
Commit: dc87125 · View workflow run →

[fullsend-ai-retro]

PR #3032 (feat: repos init) was a well-tested 1983-line Go feature PR by ggallen, merged after 5 days with reviews from qodo-code-review[bot], fullsend-ai-review[bot], human reviewer ralphbean, and a multi-model Review Squad coordinated by waynesun09. The review agent ran 15 times (12 completed), producing 29 top-level inline findings (1 critical, 4 medium, 24 low). The critical finding — a duplicate ProgressFunc type declaration causing a build break — was genuinely high-value and found only by the review agent. However, three significant patterns emerged: (1) massive duplication — the InferenceRegion edge-case was raised 6 times as inline comments and appeared 17 times in the sticky comment, the error-message-format finding was raised 7 times; (2) all 16 author 'Acknowledged' responses were to low-severity style findings that were subsequently re-raised in later runs, and the agent contradicted its own suggestion (recommending StepInfo, then flagging StepInfo as wrong); (3) the review agent missed 10 actionable medium/high findings that humans and the multi-model Review Squad caught, including stdout/stderr separation for --output -, missing --force flag, concurrency upper bounds, and malformed target validation — practical CLI/UX issues rather than code-style patterns. Three proposals: two providing evidence for existing tracked issues (#1013 deduplication and #1672 author dismissals), one new proposal for CLI UX pattern awareness in the review agent.

Proposals filed

• Evidence for #1013: 6x repeated InferenceRegion finding and 7x repeated error-message-format across 12 review iterations on PR #3032 (in fullsend-ai/fullsend)
• Evidence for #1672: review agent re-raised findings 16 times after author acknowledged design choices on PR #3032 (in fullsend-ai/fullsend)
• Review agent should evaluate CLI commands for standard Unix UX patterns (stdout/stderr separation, overwrite protection, input validation) (in fullsend-ai/fullsend)