Monolithic functions in repo.sh/gh.sh/setup_common.sh make security-relevant changes hard to review

[codeforester]

Summary

Several of the largest Bash command files mixed argument parsing, validation, external orchestration, and file writing into single, very long functions.

Details

• cli/bash/commands/basectl/subcommands/repo.sh — repo init orchestration.
• cli/bash/commands/basectl/subcommands/gh.sh — GitHub issue readiness dispatch and reporting.
• cli/bash/commands/basectl/subcommands/setup_common.sh — project artifact setup/check/doctor dispatch.

Background

These paths combine security-relevant GitHub and filesystem side effects with parsing and reporting, which makes isolated review and regression diagnosis harder. The repository already uses smaller command-owned helpers elsewhere, providing the extraction pattern for this issue.

Goal

Decompose these security-relevant orchestration paths into small, named, command-owned phases while preserving the public commands, exit statuses, dry-run behavior, GitHub operation ordering, and text/JSON output contracts.

Scope

• Extract issue readiness into a guarded lazy-loaded helper with parse, repository resolution, remote fetch, finding collection, classification, and rendering phases.
• Extract project artifact orchestration into a guarded helper with context resolution, command construction, bootstrap, virtualenv handling, and execution phases.
• Extract repo init into a guarded lazy-loaded helper with argument parsing, validation, PR planning, baseline writing, PR completion, and GitHub configuration phases.
• Keep shared path, Git, dry-run, logging, PR worktree, baseline-writer, and GitHub settings primitives in their existing owners.

Acceptance Criteria

• Existing public commands and exit statuses remain unchanged.
• Existing text and JSON output contracts remain unchanged.
• New helpers are guarded, sourced in dependency order, and lazy-loaded where command-specific.
• Each coordinator is phase-oriented and materially smaller than the original monolith.
• Focused BATS coverage and the repository-wide validation gate pass.

Validation

• Focused GH/inspection, repo, setup/check/doctor, and ownership-document tests.
• env -u BASE_HOME ./bin/base-test with the external reusable Bash/Python source checkouts configured.

Non-Goals

• No Bash-to-Python rewrite of these command coordinators.
• No public command redesign or change to GitHub Project schema behavior.
• No broad extraction of shared path, Git, or PR primitives.

Project Fields

Track Status, Priority, Size, Area, and Initiative on the Base Project item for this issue.

Agent Assignment

Implementation owner: @codeforester.