add-dep
CommandVet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs.
Daily repo hygiene — review the day's repo state, then perform selected cleanups. Fast-forward only, never destructive without a yes.
> /plugin marketplace add arbiterForge/codeArbiter
description: Daily repo hygiene — review the day's repo state, then perform selected cleanups. Fast-forward only, never destructive without a yes. argument-hint: (none)
The checklist you run when you sit down to code. The SessionStart briefing *reports* hygiene state read-only; this command performs the cleanups you select. Arbiter gathers and proposes; you decide each action's scope.
The orchestrator reads the current repo state (reusing the briefing's read-only computation — branch, ahead/behind, dirty tree, stashes, prune-candidate branches, stale worktrees) and presents it, then offers each applicable action in turn. Skip an action that has no candidates. Branch deletions stay per-item; worktree removal and work archival may use one explicitly named selection. Never infer that a yes to one action authorizes another.
1. **Fetch + fast-forward pull** — kick `git fetch`, then offer a **`--ff-only`** pull of the current branch. Eligibility is the briefing summary's `ff_pull_eligible` flag (SH-6: clean working tree AND behind upstream) — the same pure helper the SessionStart briefing computes, not a condition re-derived here. On a dirty tree the pull is withheld and the dirty state is reported instead. A diverged branch (would need a merge) is refused with a diverged-branch message — never a merge commit. 2. **Prune merged local branches** — list local branches already merged on remote (the `: gone]` upstream set), excluding the current branch and the default (`main`). Delete a listed branch only after an explicit per-branch confirmation; declining leaves it in place.
A `: gone]` branch that was squash-merged will typically **refuse** plain `git branch -d` — its upstream is already pruned, so `-d` has nothing to test reachability against. Before reporting that as a stop, check for a merged PR record: `gh pr list --head <branch> --state merged --json headRefOid`. When a `MERGED` PR's `headRefOid` equals that branch's local tip, containment is proven and `git branch -D` is permitted — with the proof stated and the branch named in the confirmation — mirroring the `post-merge-cleanup` Phase 5 contract. Without that proof, a refusal stays a report-and-stop; never guess. 3. **Remove stale worktrees** — list stale/merged worktrees (branch gone-or-merged, or path missing on disk), never the main worktree. Present the full stale list together with each item's evidence, then offer removal as an explicitly **enumerated group** — one confirmation that names every member — as well as per-item confirmation for anyone who wants to keep some. Declining the group falls back to per-item confirmation, and declining any item leaves it intact. 4. **Surface stashes / dirty / un-pushed** — list stashes, uncommitted changes, and un-pushed commits, each with a suggested next step (`{{CMD:commit}}`, `git push`, `git stash show`). Report-and-route only: never discard a stash, reset, or push. 5. **Selected-owner drift sweep** — load the installed {{IF:claude}}`../includes/helper-invocation.md`{{END}}{{IF:codex}}`../../includes/helper-invocation.md`{{END}}{{IF:pi}}`../../includes/helper-invocation.md`{{END}} card relative to this loaded standup resource. Resolve its literal `hooks/work.py` leaf and a compatible Python once; use the card's PowerShell or POSIX invocation for the current shell and never retry a failed helper under another interpreter (#577). Call `work.py list --limit 1` to select the owner: `owner: legacy` means the board, and a `project_id` field means native work. Stop if the command fails or returns neither shape. For the **legacy owner**, run `git log` over the recent merge window (since the last `ca`-scoped tag, or a rolling 30-day window when no tag exists) and pipe it to the installed `boardsync.py reconcile` helper resolved from the same loaded standup resource. Display DRIFTED tasks and informational UNKNOWN ids as advisory only. Resolve a drifted task through `{{CMD:task}} done <id>`; do not auto-flip the board. For the **native owner**, do not run `boardsync.py`: its dotted board IDs cannot establish native work state. Report that commit-to-work drift is not assessed by this sweep. A failed owner read is a stop for work hygiene, not permission to fall back to a second writer.
6. **Archival sweep — one named subset** (B-24, WS-03). For the **native owner**, page the resolved `work.py list --limit 64 --budget 65536`, passing the returned `--membership-sha256` on every later page. Inspect at most 256 entries in this sweep; state the omitted count if more remain. Select only `complete` entries with `completed_at` strictly more than 14 calendar days old. `content_snapshot: false` means the preview is advisory; verify each selected item again on the archive branch before writing.
For the **legacy owner**, retain the existing board classifier's dated done list and its exact dotted IDs or titles for ID-less rows. The work list can omit originless old rows; report its `unkeyed_count` and inspect those rows through the legacy board owner. A title may target an ID-less row only after proving it uniquely identifies the selected current done row; refuse an ambiguous title. An undated item has unknown age and is excluded unless the user explicitly asks to include its exact ID with `--allow-undated`.
Present the eligible IDs or unique legacy titles and dates, then ask once for a **named subset** to archive. The user may select all, some, or none. Do not infer inclusion from silence; preserve declined items. One selection authorizes only these IDs.
**If at least one ID was selected:** an archive is calendar-driven hygiene, not a consequence of any in-flight work, so it never rides another commit. Keep the current working tree and index, including its local `.code
Open-source governance and hard gates for AI coding agents across Claude Code, Codex CLI, and Pi.
Vet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs.
Inspect ADR health read-only; optionally select one ADR with --adr N.
Assemble the governance record for a range — commits, overrides, ADRs, sprint auto-decisions, open questions, checkpoint findings…
Periodic multi-reviewer sweep of the whole codebase — surfaces a triaged checkpoint report.
Sanctioned lane for non-behavioral work — docs-only edits, dependency bumps, reverts. Type-scaled gates; no TDD demanded of prose.
Implement tasks incrementally — build, test, verify, commit. Add "auto" to run the whole plan in one approved pass.