Refactor TUI to two-tier menu with ownership guard#1
Merged
hyperpolymath merged 1 commit intomainfrom Apr 16, 2026
Merged
Conversation
Adds an ownership safety guard so scripts NEVER touch repositories outside
a configured allowlist of owners (defaults to ["hyperpolymath"]; edit
config/owners.config or set GIT_SCRIPTS_ALLOWED_OWNERS to add personal /
family / additional org accounts). The guard is enforced in two parallel
implementations that share the same config:
- scripts/lib/ownership_guard.sh — sourced by every shell script that
targets a single org or pushes to remotes; provides
owner_allowed/repo_allowed/assert_owner_allowed and a host-agnostic
owner extractor (works for GitHub, GitLab, Bitbucket, Gitea,
self-hosted, SSH-style, etc.).
- lib/script_manager/ownership_guard.ex — the Elixir equivalent;
exposes allowed_owners/0, owner_allowed?/1, repo_allowed?/1,
filter_allowed/1, filter_allowed_verbose/1 and assert_owner_allowed!/1.
Wired into all the scripts/modules that can mutate or affect repos:
shell: branch-protection-apply, wiki-audit, project-tabs-audit,
audit_script (per-repo filter + uses derived owner for the
Dependabot URL), update_repos (per-repo filter before push),
standardize_readmes & md_to_adoc_converter (per-repo filter).
elixir: PRProcessor.process_all/add_standard_comment (asserts org),
GitSyncer.run (filters discovered repos before push),
EstateDeployer.deploy_by_paths (filters before writing files),
DependencyFixer.fix_lithoglyph/fix_rgtv (refuses to patch when
enclosing repo is foreign-owned),
RepoCleanup (warns the external cleanup scripts are NOT bound
by the allowlist).
Also rewrites the TUI menu as two tiers with clearer item names:
[A] Audits & Reports — wiki, project metadata, contractiles,
secrets/Dependabot, health dashboard,
local-vs-remote sync verification
[B] Repository Maintenance — update repos, global git sync,
standardise READMEs, MD→AsciiDoc,
clean unicode, cleanup ops, dep fixes
[C] GitHub Operations — branch protection rulesets, mass PR
processor, gh CLI helper
[D] Estate-Wide Deployment — deploy estate standards, link
toolchains, find media repos
[E] External Tools — launch NQC, launch Invariant Path
[F] Coming Soon — dependency updater, release manager
The startup banner shows the active owner allowlist and the help and
system-status screens both surface it so it's obvious at a glance.
Note: rebuild the escript with `mix escript.build` to pick up the
Elixir-side changes; the bash-side guard is active immediately.
https://claude.ai/code/session_014ME3ph3UecQQAPQDKY2HPf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restructure the Script Manager TUI from a flat 23-item menu into a two-tier hierarchical menu organized by category (A–F), and introduce an ownership allowlist guard to prevent operations on repositories outside a configured set of allowed owners.
Key Changes
TUI Restructuring
categories/0function defines all menu items, their actions, and help text in one placeOwnership Guard (New Module)
ScriptManager.OwnershipGuardmodule: Mirrors bashscripts/lib/ownership_guard.shfor consistent behavior across Elixir and shell scriptsGIT_SCRIPTS_ALLOWED_OWNERSenvironment variable (space/comma-separated)config/owners.configfile (bash array syntax)["hyperpolymath"]allowed_owners/0— return configured allowlist (lowercase)owner_allowed?/1— check if owner is in allowlistrepo_owner/1— extract GitHub owner from local repo's origin remoterepo_allowed?/1— check if a local repo's owner is allowedfilter_allowed/1andfilter_allowed_verbose/1— filter repo listsassert_owner_allowed!/1— hard guard that exits with code 78 if owner not allowedgit@host:path) and URL-style (proto://host/path) remotes; works with GitHub, GitLab, Bitbucket, Gitea, and self-hosted serversIntegration with Existing Modules
ScriptManager.PRProcessor: Addedassert_owner_allowed!check before mass PR operationsScriptManager.GitSyncer: Filter repos through ownership guard before concurrent syncScriptManager.EstateDeployer: Guard estate-wide deploymentsScriptManager.DependencyFixer: Check enclosing repo owner before applying patchesScriptManager.RepoCleanup: Added warning about external script executionBash Script Updates
scripts/lib/ownership_guard.sh(new): Portable bash implementation with same API as Elixir modulescripts/audit_script.sh: Source ownership guard; filter repos and add owner column to outputscripts/update_repos.sh: Source ownership guard; skip repos with foreign owners before pushingscripts/md_to_adoc_converter.sh: Source ownership guard; only convert files in allowed reposscripts/standardize_readmes.sh: Source ownership guard; filter repos before standardizationscripts/branch-protection-apply.sh: Source ownership guard; refuse to apply rules to foreign reposscripts/project-tabs-audit.sh: Source ownership guard; audit only allowed reposscripts/wiki-audit.sh: Source ownership guard; audit only allowed reposConfiguration
config/owners.config: Template file with documented array syntax and environment variable override mechanismUX Improvements
Implementation Details
:fun,:fun_confirm,https://claude.ai/code/session_014ME3ph3UecQQAPQDKY2HPf