
Security News
Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.
@wipcomputer/wip-repos
Advanced tools
Repo manifest reconciler. Single source of truth for repo organization. Like prettier for folder structure.
Repo manifest reconciler. Single source of truth for repo organization.
You have 50 repos. Someone moves a folder. The README drifts. The manifest drifts. Your AI agent references a path that doesn't exist anymore. Everyone wastes time.
repos-manifest.json is the single source of truth. The filesystem adapts to it. Like prettier for folder structure.
Move folders around all day. On sync, everything snaps back to where the manifest says it belongs. Want to change the structure? PR to the manifest. Org owner approves or rejects. Rejected? Your folders snap back on next sync.
# Check for drift between filesystem and manifest
wip-repos check
wip-repos check --all
wip-repos check --class worktree
# Report release-pipeline enrollment status
wip-repos release-enrollment
wip-repos release-enrollment --strict
# See what sync would do
wip-repos sync
# Actually move folders to match manifest
wip-repos sync --apply
# Add a new repo
wip-repos add ldm-os/utilities/my-tool --remote wipcomputer/my-tool
# Move a repo to a different category
wip-repos move ldm-os/utilities/my-tool --to ldm-os/devops/my-tool
# Generate directory tree from manifest
wip-repos tree
--manifest Path to repos-manifest.json (default: ./repos-manifest.json)
--root Path to repos root directory (default: directory containing manifest)
--dry-run Show what would happen without making changes
--strict Treat missing release enrollment decisions as failures
--json Output as JSON
check walks the filesystem, classifies repos, and compares active repos against the manifest. Worktrees, trash, sort, sunsetted, and archived paths are ignored by default and summarized separately. Use --all or --class <class> to inspect them.
sync matches active repos by their git remote URL. If a repo's remote matches a manifest entry but it's at the wrong path, sync prints the move plan by default. It only moves with --apply, and refuses dirty repos, linked worktrees, and target collisions.
add/move update the manifest file. The actual folder moves happen on the next sync.
release-enrollment reports which active manifest repos are enrolled in the release pipeline, explicitly excluded, still need a release-profile decision, missing on disk, or active on disk but unmanifested. By default, missing repos and unmanifested active repos are blockers. With --strict, missing release decisions are blockers too.
Release enrollment metadata lives in each manifest entry:
{
"ldm-os/devops/my-tool-private": {
"remote": "wipcomputer/my-tool-private",
"release": {
"enabled": true,
"profile": "node-package",
"smokeProfile": "ldm-tool",
"publicMirror": "wipcomputer/my-tool",
"requiredSecrets": ["NPM_TOKEN"]
}
},
"ldm-os/docs/archive": {
"remote": "wipcomputer/docs-archive",
"release": {
"enabled": false,
"reason": "archived repo"
}
}
}
deploy-public and wip-release can call wip-repos check before running. Stale manifest blocks deploys.wip-repos check as a PR check. Drift = blocked merge.wip-repos release-enrollment --strict --json to make release-owned repo enrollment machine-readable.wip-repos tree outputs a directory tree from the manifest.Pure JavaScript. Zero dependencies. core.mjs (logic), cli.mjs (CLI). No build step.
CLI, MCP server, module MIT (use anywhere, no restrictions)
Hosted or cloud service use AGPL (network service distribution)
AGPL for personal use is free.
Built by Parker Todd Brooks, Lēsa (OpenClaw, Claude Opus 4.6), Claude Code (Claude Opus 4.6).
FAQs
Repo manifest reconciler. Single source of truth for repo organization. Like prettier for folder structure.
We found that @wipcomputer/wip-repos demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.