heallisted

# Heal One word, a whole operation. A bug found in one app is a bug suspected in every app, so this runs the shared registry across all of them at once rather than one repo at a time. **The default filter is REACHABLE FROM OUTSIDE.** That is deliberate and it is the thing that makes the output worth reading. A sweep with no filter returns two hundred items, most of them style, and gets ignored. A sweep that only reports what an unauthenticated stranger on the internet can trigger returns a handful, and every one of them is worth a commit. Widen the filter only if the user asks. ## Run it ``` Workflow({ scriptPath: "${CLAUDE_PLUGIN_ROOT}/scripts/heal-sweep.workflow.js", args: [ /* one entry per repo — see below */ ] }) ``` Three stages per repo, pipelined so one repo can be fixing while another is still looking: **find → adversarially verify → fix in an isolated worktree.** Roughly three agents per repo, so keep it to three or four repos unless the user raises the cap. ## Building `args` — this is the whole job ```js { name: 'myapp', path: '/absolute/path/to/repo', gate: 'npm run preflight', // the repo's own verification command surface: '...' // REQUIRED — see below } ``` **`surface` is the quality lever and the script refuses to run without it.** It tells the agent what "reachable from outside" *means* for this particular repo. Get it wrong and you get a confident report about an attack surface that does not exist — a published CLI