feat(audit): implement get_packages non-locked branch

Port AuditCommand::getPackages's non-locked path: build an
InstalledRepository from the local repository and return its packages,
filtered by RootPackage requires when --no-dev is set. The prior
TODO(phase-c) assumption (InstalledRepository::new vs get_local_repository
type mismatch) no longer holds since both sides use RepositoryInterfaceHandle.

Enables the two previously ignored audit command tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2 files changed, 24 insertions, 8 deletions

diff --git a/crates/shirabe/src/command/audit_command.rs b/crates/shirabe/src/command/audit_command.rs
index d8666bb..236ecdc 100644
--- a/crates/shirabe/src/command/audit_command.rs
+++ b/crates/shirabe/src/command/audit_command.rs
@@ -9,6 +9,8 @@ use crate::composer::PartialComposerHandle;
 use crate::console::input::InputOption;
 use crate::io::IOInterfaceImmutable;
 use crate::repository::CanonicalPackagesTrait;
+use crate::repository::InstalledRepository;
+use crate::repository::RepositoryInterface;
 use crate::repository::RepositorySet;
 use crate::repository::RepositoryUtils;
 use shirabe_external_packages::symfony::console::command::command::Command;
@@ -268,11 +270,27 @@ impl AuditCommand {
             return locked_repo.borrow_mut().get_canonical_packages();
         }
 
-        let _root_pkg = composer.get_package();
-        // TODO(phase-c): InstalledRepository::new expects Vec<Box<dyn RepositoryInterface>>, but
-        // get_local_repository returns &dyn InstalledRepositoryInterface. Conversion requires
-        // either cloning into a Box or restructuring InstalledRepository constructor.
-        let _ = RepositoryUtils::filter_required_packages;
-        todo!("audit get_packages non-locked branch needs installed-repo conversion")
+        let root_pkg = composer.get_package();
+        let local_repo = composer
+            .get_repository_manager()
+            .borrow()
+            .get_local_repository();
+        let mut installed_repo = InstalledRepository::new(vec![local_repo]);
+
+        if input
+            .borrow()
+            .get_option("no-dev")?
+            .as_bool()
+            .unwrap_or(false)
+        {
+            return Ok(RepositoryUtils::filter_required_packages(
+                &installed_repo.get_packages()?,
+                root_pkg.clone().into(),
+                false,
+                vec![],
+            ));
+        }
+
+        installed_repo.get_packages()
     }
 }
diff --git a/crates/shirabe/tests/command/audit_command_test.rs b/crates/shirabe/tests/command/audit_command_test.rs
index a1658ba..617479f 100644
--- a/crates/shirabe/tests/command/audit_command_test.rs
+++ b/crates/shirabe/tests/command/audit_command_test.rs
@@ -10,7 +10,6 @@ use shirabe_php_shim::PhpMixed;
 
 #[test]
 #[serial]
-#[ignore = "todo!() at crates/shirabe/src/command/audit_command.rs:285 (AuditCommand::get_packages non-locked branch: installed-repo conversion unported)"]
 fn test_successful_response_code_when_no_packages_are_required() {
     let tear_down = init_temp_composer(None, None, None, true);
 
@@ -91,7 +90,6 @@ fn test_audit_package_with_no_security_vulnerabilities() {
 
 #[test]
 #[serial]
-#[ignore = "todo!() at crates/shirabe/src/command/audit_command.rs:285 (AuditCommand::get_packages non-locked branch: installed-repo conversion unported)"]
 fn test_audit_package_with_no_dev_option_passed() {
     let tear_down = init_temp_composer(None, None, None, true);
     let dev_package: Vec<PackageInterfaceHandle> = vec![get_package("dummy/pkg", "1.0.0")];