docs: TODO for delete-repo, list-repos, and create -y flag

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 76 insertions, 0 deletions

diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..6b98eb9
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,76 @@
+# gitctl TODO
+
+Planned features. Each note captures the non-obvious bits so the work does not
+re-discover them. Keep the hard rules from CLAUDE.md (stdlib only, single-file
+scripts, single-writer repo.desc, idempotent, no em dashes, work on master).
+
+## 1. delete repo
+
+`gitctl repo delete <name>` - remove a repo from all three places it lives.
+
+Touches three writers, so it is the inverse of `repo create`:
+- gitolite.conf stanza -> client edits the admin clone, pushes (needs the SSH
+  key / card, like create).
+- cgit block in /etc/cgitrc -> new helper verb, the inverse of
+  `insert_repo_block`: find the repo's `repo.url=` line and delete its block up
+  to the next `repo.url=`, `section=`, banner, or EOF. Back up first
+  (write_cgitrc_lines already does). Run sync after.
+- the bare repo on disk -> gitolite does NOT delete it when the stanza goes
+  away. The helper must `rm -rf REPO_BASE/<name>.git` (validate_url first;
+  guard against empty/`..` - validate_url already does, but double check the
+  final path is under REPO_BASE before rm).
+
+Design notes:
+- DESTRUCTIVE. Always confirm, show what will be removed. The `-y` flag from
+  item 3 must NOT bypass the delete confirmation (or gate it behind a separate,
+  louder opt-in). Deleting data is not the same as auto-confirming an additive
+  conf diff.
+- Idempotent-ish: if the repo is already gone from a given place, skip that
+  step and report, do not error.
+- No undo. The cgitrc backup covers the cgit block; the bare repo is gone for
+  good once rm runs. Consider moving to a trash dir instead of rm -rf, or at
+  least refusing if the repo has refs unless `--force`.
+- Order: remove cgit block + bare repo via helper first (reversible-ish), then
+  the gitolite stanza push? Or stanza first? Decide and document - partial
+  failure (push fails after rm) should leave a clear, resumable state like
+  create does.
+
+## 2. list repos
+
+`gitctl repo list` - show repos known to the server, ideally with their section.
+
+- New helper verb `list-repos`: parse /etc/cgitrc for `repo.url=` lines and the
+  preceding `section=` (reuse `find_repo_section` / the section-tracking loop).
+  Print `<section>\t<url>` or similar.
+- Cheap, read-only, no confirmation. Good first item - unblocks better bash
+  completion (complete repo names for `desc` / `delete` / `add-remote`) and
+  gives `delete` something to validate against.
+- Alternative source: gitolite (`ssh git_push info` lists repos) but cgitrc is
+  the helper's own domain and already parsed; prefer it.
+
+## 3. `-y` / `--yes` flag on `repo create`
+
+Let an agent drive `repo create` without the interactive y/N, so the only human
+step left is supplying the SSH-key password / smartcard PIN for the push.
+
+- Add `--yes` (`-y`) to `repo create`; when set, skip the `_confirm` prompt and
+  proceed to commit + push.
+- IMPORTANT: `-y` does NOT remove the need for a human at the SSH key. The
+  phase-1 `git push` to gitolite-admin still requires the key's password or the
+  card touch/PIN, which an agent cannot supply. `-y` removes only the y/N
+  diff-confirmation; the push auth is still interactive. Document this clearly
+  so nobody expects fully unattended creation.
+- Still print the diff before pushing even with `-y` (visibility), just do not
+  block on it.
+- Consider whether `-y` should also auto-create a missing section (it already
+  does that without asking) - keep behavior consistent.
+
+## Cross-cutting
+
+- Bash completion: once `repo list` exists, complete repo names for `desc`,
+  `delete`, `add-remote` (like `--section` is completed today). One ssh call,
+  only when completing a repo-name argument.
+- Skill: update both SKILL.md files (repo skills/gitctl + ~/.claude) to mention
+  delete (and its destructive, confirm-always nature) and `-y`'s real limit.
+- Tests: each new helper verb gets self-test coverage (cgit block removal is the
+  risky one - mirror the insert tests: first/middle/last/missing).