[DocksDocks]

Yolo run: #103 report-skill-issue: check repository visibility before a report names a repository

Pull request: #104. Checks: 5 of 5 passed. Reviewed head: 6eb23283.

What changed

• Stage 4 of the docks report-skill-issue skill now decides which repositories are public by lookup, not by memory: it reads the user's project from its git remotes and runs gh repo view github.com/<owner>/<repo> --json visibility for each remote and for every other repository that the draft names. The host is written out, so GH_REPO and GH_HOST cannot change the target. Anything that is not PUBLIC counts as private (plugins/docks/skills/productivity/report-skill-issue/SKILL.md).
• For a private project, the draft leaves out every remote's owner and name, its issue and pull request titles, and its branch names, and writes its numbers without # in prose, because #123 would link to a DocksDocks/docks issue. Quoted output can keep a number's #, but private names there become placeholders.
• "Check before filing" adds a scan for the remote names and a list of GitHub repository references to look up; a new paragraph says how to remove private text from a filed issue, including its edit history.
• Stage 6 and the prefilled-link scripts read the approved title from a file, as the body already is, so gh files the title that the user approved.

Decisions and corrections

• Plan review hardened the lookup twice: the argument-free gh repo view follows gh's default repository, and a bare <owner>/<repo> follows GH_HOST; the skill now names each remote with its host.
• A project whose remotes are not all public counts as private, so a public project with a private fork remote is redacted too. This is the safe side.

Reviews

Plan review passed in round 3 (rounds 2 and 3 were delta rounds of 79 s and 34 s). Code review passed in round 2: round 1 was a three-lens panel with the self-review running at the same time, and round 2 was a delta round of 52 s.
Open findings: none.

Verification

• bun scripts/ci.mjs --plugin docks: passed at the reviewed head.
• Skill score: productivity/report-skill-issue 15, as before; 294 lines.
• Fake-gh experiment: a title with a word in backticks, $HOME, and quotes arrived unchanged through the new stage 6 command and both link scripts.
• Baseline check: three private-project scenarios, before and after. Neither version leaked a private name in these scenarios; the new version applied the lookup rule, wrote numbers without #, and filed with the title read from a file.

Limits and failures

• The baseline scenarios did not separate the old and the new text on leaks, because the model already left private names out when the scenario said they were private. The new text adds a check that does not depend on that.
• The Claude Code load check did not run: the local Claude Code CLI is not logged in.

Kept resources

• After Merge now: none. The repository now deletes a merged branch automatically, and the plan's worktree is removed in teardown.
• After Leave pull request open: the linked branch, its worktree, the open issue, and the pull request.

After merge

• Release docks (patch), with its own question.

Closes #103