@ericrisco/rsc 3.0.7 → 3.0.8

package/scripts/lib/onboarding-apply.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { appendFileSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative, resolve, sep } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
 import { applyInstall, pruneSharedBases, removeTargetInstall } from '../install-apply.js';
 import { targetPaths } from '../../targets/index.js';
 import { targetHasAgents } from '../../targets/agents.js';
@@ -10,6 +10,7 @@ import { readManifest, writeManifest } from './manifest-file.js';
 import { encodeGoal, identifyPlan } from './onboarding.js';
 import { createBackup, restoreBackup } from './backups.js';
 import { RETIRED_SKILLS, replaceRetired } from './retired-skills.js';
+import { LAYER_IGNORE, TEMPLATE_SOURCE, targetName, templateAssets } from './tools-skeleton.js';
 
 const sameSet = (a = [], b = []) => JSON.stringify([...a].sort()) === JSON.stringify([...b].sort());
 
@@ -157,12 +158,35 @@ export function mergeProfile(existing, plan, previousRecord) {
   return `---\n${front.join('\n')}\n---\n${body.startsWith('\n') ? '' : '\n'}${body}`;
 }
 
+/**
+ * The profile is one person's dials (knowledge-sync never sends it), so it never belongs in a commit
+ * either — yet it sat untracked for good, and every session's agent reported it as «cambios sin
+ * commitear» (E2E 2026-10-07). Excluded in THIS clone only (`info/exclude`, not `.gitignore`), and
+ * never when the team already tracks it: that is their decision.
+ */
+export function excludePersonalProfile(cwd) {
+  const git = (args) => { try { return execFileSync('git', args, { cwd, encoding: 'utf8', windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { return null; } };
+  if (git(['rev-parse', '--is-inside-work-tree']) !== 'true') return false;
+  const rel = '02-DOCS/wiki/harness/user-profile.md';
+  if (git(['ls-files', '--', rel])) return false;
+  const value = git(['rev-parse', '--git-path', 'info/exclude']);
+  if (!value) return false;
+  const file = resolve(cwd, value);
+  const pattern = `/${rel}`;
+  mkdirSync(dirname(file), { recursive: true });
+  const body = existsSync(file) ? readFileSync(file, 'utf8') : '';
+  if (body.split('\n').includes(pattern)) return true;
+  appendFileSync(file, `${body && !body.endsWith('\n') ? '\n' : ''}${pattern}\n`);
+  return true;
+}
+
 export function writeOnboardingDocuments(cwd, plan, planId, previousRecord = null) {
   const dir = join(cwd, '02-DOCS', 'wiki', 'harness');
   mkdirSync(dir, { recursive: true });
   const docs = renderOnboardingDocuments(plan, planId);
   const profilePath = join(dir, 'user-profile.md');
   writeFileSync(profilePath, mergeProfile(existsSync(profilePath) ? readFileSync(profilePath, 'utf8') : '', plan, previousRecord));
+  excludePersonalProfile(cwd);
   writeFileSync(join(dir, 'installation-plan.md'), docs.installation);
   const decisionsPath = join(dir, 'decisions.md');
   if (!existsSync(decisionsPath)) writeFileSync(decisionsPath, docs.decisions);
@@ -343,34 +367,13 @@ export async function applyAcceptedOnboarding({ cwd = process.cwd(), plan, planI
 // Y la retro-compatibilidad no es una lista de exentos (P3): el suelo viaja DENTRO del plan, así
 // que un recibo aceptado por una versión anterior no lo trae y queda exento por construcción.
 
-const LIB_DIR = dirname(fileURLToPath(import.meta.url));
-const TEMPLATE_SOURCE = join(LIB_DIR, '..', '..', 'skills', 'harness', 'assets', '_TEMPLATE');
 const TEMPLATE_FLOOR = '01-TOOLS/_TEMPLATE/';
 
 export const HARNESS_FLOOR_MINIMUM = [TEMPLATE_FLOOR, '02-DOCS/wiki/harness/'];
 export const HARNESS_FLOOR_CONSTITUTION = '02-DOCS/wiki/sdd/constitution.md';
 
-// Los ficheros que la plantilla trae hoy. Se lee del asset en vez de codificar una lista, para que
-// añadir un fichero a la plantilla no deje el suelo comprobando de menos en silencio.
-//
-// Un error aquí NO se convierte en lista vacía. Comérselo dejaba el suelo permanentemente
-// insatisfacible, con un mensaje que ofrecía una acción que leía ese mismo asset ausente y que por
-// tanto no podía arreglarlo nunca — y sin nombrar jamás la causa real, que es un paquete roto.
-function templateAssets() {
-  return readdirSync(TEMPLATE_SOURCE).sort();
-}
-
-// npm NUNCA empaqueta un fichero llamado `.gitignore`, así que el asset viaja sin punto y se copia
-// con él. Sin esto, desde el paquete publicado se copiaban 4 de 5 ficheros y el que faltaba era el
-// único que evita comitear el `.env` que el README —copiado por el propio instalador— manda crear.
-const DOTTED = { gitignore: '.gitignore' };
-const targetName = (asset) => DOTTED[asset] ?? asset;
-
-// La capa entera, no cada proveedor: el flujo documentado es copiar `_TEMPLATE/` a
-// `01-TOOLS/<PROVEEDOR>/`, y depender de que cada copia se lleve su propia protección es depender
-// de que nadie se salte un paso con credenciales de por medio.
-const LAYER_IGNORE = ['# Escrito por rsc: la capa de herramientas guarda credenciales.',
-  '*/.env', '*/.env.*', '!*/.env.example', '*/keys/', '*/out/', ''].join('\n');
+// La plantilla, sus nombres con punto y el `.gitignore` de la capa viven en `tools-skeleton.js`:
+// lo que se copia aquí es exactamente lo que `purge` puede recuperar, y sólo si sigue intacto.
 
 /**
  * Crea la parte determinista del esqueleto. Copiar ficheros estáticos es un algoritmo, así que por

package/scripts/lib/onboarding.js

@@ -248,7 +248,14 @@ export function buildOnboardingPlan(record, evidence) {
   // in an invoicing workspace, and `init` promises it by technical level: non-technical and mixed get
   // it, whatever the project is. The guard also decides at runtime from the profile, so the plan only
   // chooses whether it is present, never whether it bites.
-  const dangerGuard = normalized.technicalLevel !== 'technical';
+  //
+  // And since 3.0.8 it is present for EVERYONE. A technical user used to get nothing, so a small
+  // project with `main` open had no guard at all (E2E 2026-10-07). The runtime still decides the
+  // bite: deny for non-technical, `ask` — only on lost work or rewritten history — for technical.
+  const dangerGuard = true;
+  // The FTD/SDD lane decision belongs to every software project, small ones included: without it
+  // the agent never sees the lanes (E2E 2026-10-07: five sessions, zero feature documents).
+  const laneGate = isSoftware;
   // `sdd` is installed everywhere now, but its DECISION is about practice, not presence — so where
   // the chain is not practised the explicit `deferred` entry below must be the only one, or the
   // generic "installed → selected" mapping would shadow it and `reassess` would see nothing to watch.
@@ -269,9 +276,16 @@ export function buildOnboardingPlan(record, evidence) {
   // so the chain is always one request away; this decision is what `reassess` watches, and what the
   // floor reads. Collapsing the two would have deleted reassess's reason to exist as a side effect
   // of an installer change, which is not a decision an installer change gets to make.
-  if (!practisesSdd) decisions.push(deferred('sdd', 'workflow', isSoftware
-    ? 'The software scope is small, so specification overhead is not justified yet.'
-    : 'SDD applies to substantial software work, which is not the declared project purpose.', sddTriggers, softwareTriggers));
+  // The reason says both halves, because the plan lists `.claude/skills/sdd` under managed paths
+  // and a bare "deferred" next to it read as a contradiction (E2E 2026-10-07). Only the wording
+  // changes: the decision stays the one deferred `workflow/sdd` entry that reassess watches.
+  const whyDeferred = isSoftware
+    ? 'the software scope is small, so specification overhead is not justified yet.'
+    : 'SDD applies to substantial software work, which is not the declared project purpose.';
+  const sddReason = skills.includes('sdd')
+    ? `The sdd skill is installed, so the chain is one request away; the practice is deferred: ${whyDeferred}`
+    : whyDeferred.charAt(0).toUpperCase() + whyDeferred.slice(1);
+  if (!practisesSdd) decisions.push(deferred('sdd', 'workflow', sddReason, sddTriggers, softwareTriggers));
   if (baseAgents) {
     for (const id of agents) decisions.push(selected(id, 'agent', 'The accepted substantial software workflow requires this implementation or review role.'));
   } else {
@@ -296,6 +310,7 @@ export function buildOnboardingPlan(record, evidence) {
     codeHooks: practisesSdd,
     gitmojiGuard,
     dangerGuard,
+    laneGate,
     memory: true,
     context7: false,
   };

package/scripts/lib/tools-skeleton.js

@@ -0,0 +1,76 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, lstatSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// The `01-TOOLS/` scaffolding rsc writes on onboarding, in ONE place: what `ensureHarnessSkeleton`
+// copies is exactly what `purge` may take back, and it may take back only a file still identical to
+// what was copied. `01-TOOLS/` is the layer the user edits when adding tools, so anything that
+// differs from the template is theirs and stays.
+
+const LIB_DIR = dirname(fileURLToPath(import.meta.url));
+export const TEMPLATE_SOURCE = join(LIB_DIR, '..', '..', 'skills', 'harness', 'assets', '_TEMPLATE');
+
+// Los ficheros que la plantilla trae hoy. Se lee del asset en vez de codificar una lista, para que
+// añadir un fichero a la plantilla no deje el suelo comprobando de menos en silencio.
+//
+// Un error aquí NO se convierte en lista vacía. Comérselo dejaba el suelo permanentemente
+// insatisfacible, con un mensaje que ofrecía una acción que leía ese mismo asset ausente y que por
+// tanto no podía arreglarlo nunca — y sin nombrar jamás la causa real, que es un paquete roto.
+export function templateAssets() {
+  return readdirSync(TEMPLATE_SOURCE).sort();
+}
+
+// npm NUNCA empaqueta un fichero llamado `.gitignore`, así que el asset viaja sin punto y se copia
+// con él. Sin esto, desde el paquete publicado se copiaban 4 de 5 ficheros y el que faltaba era el
+// único que evita comitear el `.env` que el README —copiado por el propio instalador— manda crear.
+const DOTTED = { gitignore: '.gitignore' };
+export const targetName = (asset) => DOTTED[asset] ?? asset;
+
+// La capa entera, no cada proveedor: el flujo documentado es copiar `_TEMPLATE/` a
+// `01-TOOLS/<PROVEEDOR>/`, y depender de que cada copia se lleve su propia protección es depender
+// de que nadie se salte un paso con credenciales de por medio.
+export const LAYER_IGNORE = ['# Escrito por rsc: la capa de herramientas guarda credenciales.',
+  '*/.env', '*/.env.*', '!*/.env.example', '*/keys/', '*/out/', ''].join('\n');
+
+const sameBytes = (a, b) => {
+  try { return readFileSync(a).equals(Buffer.isBuffer(b) ? b : readFileSync(b)); } catch { return false; }
+};
+const isPlainFile = (p) => { try { return lstatSync(p).isFile(); } catch { return false; } };
+
+/**
+ * Take back the scaffolding rsc wrote, file by file, only where it is still byte-identical to what
+ * rsc wrote. Returns `{ removed, kept }` as paths relative to `cwd`, `kept` with a reason. Empty
+ * directories left behind are removed by the caller's directory sweep.
+ */
+// Committed means the team has it: deleting it leaves the tree dirty and takes it from everybody on
+// the next push (field test 3.0.8: purge deleted a 01-TOOLS/.gitignore that was already in history).
+function tracked(cwd, rel) {
+  try { return Boolean(execFileSync('git', ['ls-files', '--', rel], { cwd, encoding: 'utf8', windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'] }).trim()); } catch { return false; }
+}
+
+export function removeUnmodifiedSkeleton(cwd, { dryRun = false } = {}) {
+  const removed = [];
+  const kept = [];
+  const committed = (rel) => tracked(cwd, rel) && (kept.push({ path: rel, reason: 'committed to git — the team has it; delete it in a commit if you mean to' }), true);
+  const templateDir = join(cwd, '01-TOOLS', '_TEMPLATE');
+  if (existsSync(templateDir) && !lstatSync(templateDir).isSymbolicLink()) {
+    for (const asset of templateAssets()) {
+      const rel = `01-TOOLS/_TEMPLATE/${targetName(asset)}`;
+      const file = join(cwd, rel);
+      if (!existsSync(file) || committed(rel)) continue;
+      if (isPlainFile(file) && sameBytes(file, join(TEMPLATE_SOURCE, asset))) {
+        if (!dryRun) rmSync(file, { force: true });
+        removed.push(rel);
+      } else kept.push({ path: rel, reason: 'changed since rsc wrote it — yours now' });
+    }
+  }
+  const layer = join(cwd, '01-TOOLS', '.gitignore');
+  if (existsSync(layer) && !committed('01-TOOLS/.gitignore')) {
+    if (isPlainFile(layer) && sameBytes(layer, Buffer.from(LAYER_IGNORE))) {
+      if (!dryRun) rmSync(layer, { force: true });
+      removed.push('01-TOOLS/.gitignore');
+    } else kept.push({ path: '01-TOOLS/.gitignore', reason: 'changed since rsc wrote it — yours now' });
+  }
+  return { removed, kept };
+}

package/scripts/rsc.js

@@ -4,12 +4,13 @@ import { detectTarget, installedTargets, resolveTargets, TARGETS } from '../targ
 import { detectRepo } from './detect-repo.js';
 import { rank } from './consult.js';
 import { expandRecommends, toOutcomes, hasOutcome } from './lib/recommend.js';
-import { applyInstall, listInstalled, listInstalledAgents, listInstalledCommands, uninstall, syncInstalled, purge, collisions, ownSkillPaths } from './install-apply.js';
+import { applyInstall, listInstalled, listInstalledAgents, listInstalledCommands, uninstall, syncInstalled, purgeReport, collisions, ownSkillPaths } from './install-apply.js';
+import { isAbsolute, relative, sep } from 'node:path';
 import { stackAgentNames } from '../targets/agents.js';
 import { doctor } from './doctor.js';
 import { ask, say, select, pickFrom, banner, confirm, isInteractive } from './lib/ui.js';
 import { refreshRegistry, registryStatus } from './lib/registry.js';
-import { audit, writeAuditReport } from './audit.js';
+import { audit, writeAuditReport, recordAuditBaseline } from './audit.js';
 import { DOMAINS } from './lib/domains.js';
 import { listBackups, restoreBackup, whereKept } from './lib/backups.js';
 import { runUpgrade } from './lib/upgrade.js';
@@ -18,6 +19,7 @@ import { DEFAULT_SKILL_FLOOR, withDefaultSkillFloor } from './lib/default-skill-
 import { RETIRED_SKILLS, replaceRetired } from './lib/retired-skills.js';
 import { readManifest, writeManifest } from './lib/manifest-file.js';
 import { versionReport } from './lib/versions.js';
+import { templateAssets, targetName } from './lib/tools-skeleton.js';
 import {
   normalizeOnboarding, missingOnboardingFields, scanProject,
   buildOnboardingPlan, decodeGoal, encodeGoal, identifyPlan, recommendDeferredComponents,
@@ -39,6 +41,33 @@ if (['--version', '-v', 'version'].includes(rawArgv[0])) {
   process.stdout.write(`${lines.join('\n')}\n`);
   process.exit(0);
 }
+const GENERAL_HELP = [
+  'Use: npx @ericrisco/rsc onboard | reassess | add <id...> | install --profile <p> | consult "<text>" | list | capabilities [--full|gap-log] | audit | registry refresh | doctor | sync | memory <on|off|status|save|resume|learn|metrics> | sello <on|off|status|…> | worktrees [reap [path] [--confirm]] | backups | restore <id|latest> | upgrade | repair | uninstall <id...> | purge | help',
+  'Any command takes --target <claude|codex|cursor|copilot|gemini|…> (comma-separate for several)',
+  '   → without it, rsc uses the assistant already installed here; if two are, it asks instead of guessing.',
+].join('\n');
+const UNINSTALL_HELP = [
+  'Use: npx @ericrisco/rsc uninstall <id...> [--dry-run] [--target <assistant>]',
+  '  Removes the named skills or agents from this project.',
+  '  To remove everything rsc installed here, run: npx @ericrisco/rsc purge  (keeps 02-DOCS/ unless --with-docs)',
+].join('\n');
+const PURGE_HELP = [
+  'Use: npx @ericrisco/rsc purge [--dry-run] [--with-docs]',
+  '  Removes everything rsc installed in this project and reports what was removed, cleaned and kept.',
+  '  --dry-run shows the report without touching anything. 02-DOCS/ is kept unless --with-docs.',
+].join('\n');
+
+// Asking for help must never RUN the command. `uninstall --help` used to be read as an empty id list
+// and report "Removed: (nothing)"; `purge --help` would have purged. Answered before anything else.
+{
+  const helpAsked = rawArgv.some((a) => a === '--help' || a === '-h');
+  if (rawArgv[0] === 'help' || helpAsked) {
+    const about = rawArgv[0] === 'help' ? rawArgv[1] : rawArgv.find((a) => !a.startsWith('-'));
+    const text = about === 'uninstall' ? UNINSTALL_HELP : about === 'purge' ? PURGE_HELP : GENERAL_HELP;
+    process.stdout.write(`${text}\n`);
+    process.exit(0);
+  }
+}
 // `--accompaniment` stays listed although the dial is retired: old scripts and agents still pass it,
 // and its value must keep being skipped rather than read as a command or a skill id.
 const GLOBAL_VALUE_FLAGS = new Set([
@@ -159,6 +188,12 @@ function renderPlan(plan, planId) {
   for (const decision of plan.decisions.filter((d) => d.state === 'excluded')) say(`  × ${decision.kind}/${decision.id} — ${decision.reason}`);
   say('Managed paths:');
   for (const path of plan.governedPaths) say(`  ${path}`);
+  // The scaffolding is written once and then belongs to the person, so it is not a managed (digested)
+  // path — but it IS written by this plan, and a plan that does not show it is not the whole plan.
+  if ((plan.floorPaths || []).includes('01-TOOLS/_TEMPLATE/')) {
+    say('Scaffolded once (yours to edit; never overwritten; purge removes only untouched files):');
+    for (const path of ['01-TOOLS/.gitignore', ...templateAssets().map((a) => `01-TOOLS/_TEMPLATE/${targetName(a)}`)].sort()) say(`  ${path}`);
+  }
   if (plan.replacesUserSkills?.length) {
     say('Your own skills this plan replaces:');
     for (const path of plan.replacesUserSkills) say(`  ! ${path} — already here and not put by rsc; the catalog skill of the same name takes its place, and yours is kept in .rsc/backups/`);
@@ -166,8 +201,11 @@ function renderPlan(plan, planId) {
     say('  AGENT: name each of these to the user before accepting, and ask whether to replace or rename.');
   }
   if (plan.evidence.parentHarness) say(`Parent harness detected at ${plan.evidence.parentHarness}; it is not inherited by this plan.`);
+  // Pinned to the version that computed this plan. The id is a hash of the plan, and the plan
+  // depends on the catalog of the running version: `@latest` would accept it with whatever version
+  // npm resolves next, which answers RSC_PLAN_CHANGED the day a release lands in between.
   const pieces = [
-    'npx @ericrisco/rsc@latest onboard',
+    `npx @ericrisco/rsc@${versionReport(process.cwd()).cli} onboard`,
     `--technical-level ${plan.record.technicalLevel}`,
     `--project-kind ${plan.record.projectKind}`,
     `--goal-base64 ${encodeGoal(plan.record.goal)}`,
@@ -260,6 +298,9 @@ async function runOnboarding(targets) {
   } catch (error) {
     say(`RSC_SKELETON_FAILED ${error.message}`);
   }
+  // The audit cadence starts at install. Without a baseline the very first session after onboarding
+  // announced "a skill audit is due" about a set chosen minutes earlier. Never overwrites a real run.
+  try { recordAuditBaseline(process.cwd()); } catch { /* a missing baseline only means an early nudge */ }
   for (const path of plan.replacesUserSkills || []) {
     const kept = whereKept({ cwd: process.cwd(), relPath: path });
     if (kept) say(`Your previous ${path} is kept in ${kept}`);
@@ -370,10 +411,34 @@ function flag(name) {
 // Remove everything rsc installed in this project (skills, hooks, .rsc/), across
 // every assistant. Keeps 02-DOCS/ unless --with-docs. `purge` / `uninstall --all`.
 async function runPurge(dryRun, withDocs) {
-  const removed = await purge({ cwd: process.cwd(), withDocs, dryRun });
-  say(`${dryRun ? 'Would remove' : 'Removed'} ${removed.length} path(s):`);
-  for (const r of removed) say(`  - ${r}`);
-  if (!withDocs) say('\nKept 02-DOCS/ (your knowledge base). Add --with-docs to remove it too.');
+  const cwd = process.cwd();
+  const report = await purgeReport({ cwd, withDocs, dryRun });
+  // Relative to the project: the report is read by a person, and every path is inside it.
+  const shown = (p) => {
+    const rel = relative(cwd, p);
+    return !rel || rel.startsWith('..') || isAbsolute(rel) ? p : rel.split(sep).join('/');
+  };
+  say(`${dryRun ? 'Would remove' : 'Removed'} ${report.removed.length} path(s):`);
+  for (const r of report.removed.map(shown).sort()) say(`  - ${r}`);
+  if (report.cleaned.length) {
+    say(`\n${dryRun ? 'Would clean' : 'Cleaned'} ${report.cleaned.length} file(s) — rsc's entries ${dryRun ? 'would be' : 'were'} taken out; ${dryRun ? 'each is deleted if nothing of yours remains' : 'the rest of the file is yours and stays'}:`);
+    for (const c of report.cleaned.map(shown).sort()) say(`  - ${c}`);
+  }
+  if (report.kept.length) {
+    say(`\nKept ${report.kept.length}:`);
+    for (const k of report.kept) say(`  - ${k.path} — ${k.reason}`);
+  }
+  // On a clone most of what purge deletes is committed. Deleting it here is local; committing the
+  // deletions uninstalls rsc for the whole team (team simulation D15). Said before anyone commits.
+  if (report.tracked?.length) {
+    const quote = (p) => (/^[\w./@+-]+$/.test(p) ? p : `'${p.replace(/'/g, `'\\''`)}'`);
+    say(`\nWARNING: ${report.tracked.length} of these file(s) are committed in git and ${dryRun ? 'would show' : 'now show'} as deleted or changed:`);
+    for (const f of report.tracked.slice(0, 12)) say(`  - ${f}`);
+    if (report.tracked.length > 12) say(`  … and ${report.tracked.length - 12} more`);
+    say('Committing these changes uninstalls rsc for the whole team, on their next pull. To remove rsc only on this machine, do not commit them.');
+    if (!dryRun) say(`To undo locally: git restore -- ${report.tracked.map(quote).join(' ')}`);
+    else say('To undo after a real purge: git restore -- <those files> (purge prints the exact command).');
+  }
 }
 
 async function recommendIds(query, { labeledOnly = false } = {}) {
@@ -515,7 +580,7 @@ function printContextBudget(b) {
   if (b.notApplicable.length) {
     say(`  ${b.note}`);
   } else {
-    say(`  Per session start : ${kb(b.sessionStartBytes)}   (always-on body, per wired scope)`);
+    say(`  Per session start : ${kb(b.sessionStartBytes)}   (always-on body, per wired scope; one-time and conditional banners not counted)`);
     say(`  Per user turn     : ${kb(b.perTurnBytes)}`);
   }
   say(`  Skill descriptions: ${kb(b.descriptionsBytes)}   (${b.installedSkills} installed, always in context)`);
@@ -1006,7 +1071,15 @@ async function main() {
         // defeated by an argument the sweep itself told the agent to type.
         const confirmed = argv.includes('--confirm');
         const targets = one ? [one] : candidates.filter((c) => c.verdict === 'safe').map((c) => c.path);
-        if (!targets.length) { say('nothing to clean up.'); return; }
+        // The bulk reap also deletes plain local branches that have landed (`branch -d`, never -D):
+        // the worktree is not the only thing a merge leaves behind (E2E defect 14).
+        const reapBranches = () => {
+          if (one) return 0;
+          const { deleted } = W.reapMergedBranches(root);
+          for (const b of deleted) say(`✅ deleted merged branch ${b}`);
+          return deleted.length;
+        };
+        if (!targets.length) { if (!reapBranches()) say('nothing to clean up.'); return; }
         for (const t of targets) {
           const out = W.reapWorktree(root, t, { confirmed });
           if (out.removed) {
@@ -1018,6 +1091,7 @@ async function main() {
             process.exitCode = 1;
           }
         }
+        reapBranches();
         return;
       }
 
@@ -1272,7 +1346,14 @@ async function main() {
       const dry = argv.includes('--dry-run');
       // `uninstall --all` is an alias for a full purge.
       if (argv.includes('--all')) return void (await runPurge(dry, argv.includes('--with-docs')));
-      const selected = classifyRequested(requestedIds());
+      const ids = requestedIds();
+      // No id is not "nothing to remove": it is a command that was not given what it needs.
+      if (!ids.length) {
+        console.error(`rsc: uninstall needs at least one skill or agent id.\n${UNINSTALL_HELP}`);
+        process.exitCode = 1;
+        return;
+      }
+      const selected = classifyRequested(ids);
       // A retired skill an old install still holds is not unknown: the state file proves it is ours.
       const held = new Set(listInstalled({ target }));
       selected.skills.push(...selected.unknown.filter((id) => Object.hasOwn(RETIRED_SKILLS, id) && held.has(id)));
@@ -1306,9 +1387,7 @@ async function main() {
       return void (await runPurge(argv.includes('--dry-run'), argv.includes('--with-docs')));
     default:
       say(`rsc: unknown command '${cmd}'.`);
-      say('Use: npx @ericrisco/rsc onboard | reassess | add <id...> | install --profile <p> | consult "<text>" | list | capabilities [--full|gap-log] | audit | registry refresh | doctor | sync | memory <on|off|status|save|resume|learn|metrics> | sello <on|off|status|…> | worktrees [reap [path] [--confirm]] | backups | restore <id|latest> | upgrade | repair | uninstall <id> | purge');
-      say('Any command takes --target <claude|codex|cursor|copilot|gemini|…> (comma-separate for several)');
-      say('   → without it, rsc uses the assistant already installed here; if two are, it asks instead of guessing.');
+      say(GENERAL_HELP);
       process.exitCode = 1;
   }
 }

package/skills/suggest/SKILL.md

@@ -106,12 +106,13 @@ Offer once per session. Never mention any of it when the harness is healthy.
 
 Before handling the first request of a session, check the workspace:
 
-- No `02-DOCS/wiki/harness/user-profile.md` **and** no `.rsc/.no-harness` → the harness has never
-  been set up here. Invoke `init` first; it opens with one question: technical terms or analogies.
-  Do not start the user's task before first contact is done.
+- No `02-DOCS/wiki/harness/user-profile.md` **and** no `.rsc/.no-harness` → invoke `init` first
+  (one question: technical terms or analogies) before the task.
+- A clone (`.rsc.json` committed) is not first contact: ask that once, in one line, then continue
+  with their task; with `.rsc/.profile-offered`, never again.
 - The user declines a harness here ("sin harness", "solo código") → create an empty
   `.rsc/.no-harness`, confirm in one line, and never auto-start `init` in this repo again.
-- Once the profile exists, this gate is inert. Never re-onboard.
+- With a profile, this gate is inert. Never re-onboard.
 
 ## Explain without assuming
 

package/targets/branch-guard.mjs

@@ -33,6 +33,29 @@ export const COMMITS_HERE = new RegExp(String.raw`\bgit\s+${GIT_OPTS}(?:commit|m
 // A branch move: switch, or checkout of something that is not a path (`checkout -- f`, `checkout HEAD -- f`).
 export const MOVES_BRANCH = new RegExp(String.raw`\bgit\s+${GIT_OPTS}(?:switch(?![\w-])|checkout(?![\w-])(?![^;&|\n]*\s--(?:\s|$)))`);
 
+// A move of a branch REF without a commit: `git update-ref <ref> …` or a forced `git branch`
+// (-f/--force, -M, -C). Which ref it moves is read by refMoveTarget().
+export const MOVES_REF = new RegExp(String.raw`\bgit\s+${GIT_OPTS}(?:update-ref(?![\w-])|branch\s+(?:\S+\s+)*?(?:-[A-Za-z]*[fMC][A-Za-z]*|--force)(?=\s|$))`);
+
+// A push whose DESTINATION is named: `git push origin HEAD:main`, `feat/x:refs/heads/main`, `--mirror`.
+export const PUSHES = new RegExp(String.raw`\bgit\s+${GIT_OPTS}push(?![\w-])`);
+
+/** True when this push segment writes to branch `trunk` on the remote by an explicit refspec. */
+export function pushesTo(seg, trunk) {
+  const t = tokens(seg.replace(/^.*?\bgit\s+/, '').replace(/^(?:(?:-C|-c)\s+\S+\s+|--\S+\s+)*/, ''));
+  if (t.shift() !== 'push') return false;
+  const args = [];
+  for (let i = 0; i < t.length; i++) {
+    if (t[i] === '--mirror') return true; // rewrites every ref on the remote, the default branch included
+    if (/^(-o|--push-option|--repo|--receive-pack|--exec)$/.test(t[i])) { i++; continue; }
+    if (!t[i].startsWith('-')) args.push(t[i]);
+  }
+  return args.slice(1).some((spec) => {
+    const dst = spec.replace(/^\+/, '').split(':')[1];
+    return dst !== undefined && dst.replace(/^refs\/heads\//, '') === trunk;
+  });
+}
+
 export const unquoted = (command) => command.replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, '""');
 
 /** Where the git command actually runs: `git -C <dir>`, or a leading `cd <dir> &&`, else the cwd. */
@@ -54,27 +77,10 @@ const ago = (iso) => {
   return min <= 1 ? 'just now' : `${min} min ago`;
 };
 
-/** Heredoc bodies are text being written, not commands: `cat > notes.md <<EOF … git commit … EOF`. */
-export const withoutHeredocs = (command) => command.replace(/<<-?\s*(['"]?)([A-Za-z_]\w*)\1[^\n]*\n[\s\S]*?\n\s*\2\s*(?=\n|$)/g, '');
-
-/** The command split where the shell would run one thing after another, never inside quotes. */
-export function segments(command) {
-  const out = [];
-  let cur = '';
-  let q = null;
-  for (let i = 0; i < command.length; i++) {
-    const c = command[i];
-    if (q) { cur += c; if (c === '\\' && q === '"') cur += command[++i] ?? ''; else if (c === q) q = null; continue; }
-    if (c === '"' || c === "'") { q = c; cur += c; continue; }
-    if (c === ';' || c === '\n' || c === '|' || c === '&') {
-      if ((c === '&' || c === '|') && command[i + 1] === c) i++;
-      out.push(cur); cur = ''; continue;
-    }
-    cur += c;
-  }
-  out.push(cur);
-  return out.filter((s) => s.trim());
-}
+// The quote-aware split, the heredoc strip and the shell unwrapping (`bash -c "…"`, `eval`, `env`…)
+// live in shell-unwrap.mjs, shared with the other guards (E2E defect 15). It is a sibling import
+// like trunk-policy.mjs; without it the guard cannot read a command and fails open.
+const SH = await import(new URL('./shell-unwrap.mjs', import.meta.url)).catch(() => null);
 const tokens = (s) => s.trim().split(/\s+/).filter(Boolean);
 
 /** What a branch-moving segment moves to, or null if it is a path checkout after all (`checkout .`). */
@@ -89,6 +95,31 @@ function moveTarget(seg, dir) {
   return { name, created: false };
 }
 
+/** The branch a ref-moving segment points somewhere else (`update-ref refs/heads/x`, `branch -f x`), or null. */
+export function refMoveTarget(seg) {
+  const t = tokens(seg.replace(/^.*?\bgit\s+/, '').replace(/^(?:(?:-C|-c)\s+\S+\s+|--\S+\s+)*/, ''));
+  const verb = t.shift();
+  if (verb === 'update-ref') {
+    const args = [];
+    for (let i = 0; i < t.length; i++) {
+      if (t[i] === '-m') { i++; continue; }
+      if (t[i] === '--stdin') return null; // refs come from stdin: unreadable here
+      if (!t[i].startsWith('-')) args.push(t[i]);
+    }
+    const m = (args[0] || '').match(/^refs\/heads\/(.+)$/);
+    return m ? m[1] : null;
+  }
+  if (verb !== 'branch') return null;
+  const flags = t.filter((x) => x.startsWith('-'));
+  const names = t.filter((x) => !x.startsWith('-'));
+  const short = flags.filter((f) => /^-[A-Za-z]+$/.test(f)).join('');
+  const renames = /[mMcC]/.test(short) || flags.some((f) => /^--(move|copy)$/.test(f));
+  const forced = /[fMC]/.test(short) || flags.includes('--force');
+  if (!forced || /[dD]/.test(short)) return null;
+  // `branch -M [old] new` / `-C [old] new`: the last name is the one overwritten; `-f name [start]`: the first.
+  return (renames ? names[names.length - 1] : names[0]) || null;
+}
+
 /**
  * Rule A and rule B, judged segment by segment: a chain is followed the way the shell runs it, so
  * `git switch -c feat/x && git commit` is a commit on feat/x (allowed) and `git switch main && git
@@ -96,12 +127,14 @@ function moveTarget(seg, dir) {
  */
 export async function evaluate({ root, command, cwd, sessionId }) {
   if (typeof command !== 'string' || !command) return null;
+  if (!SH) return null;
   // Words inside quotes or heredocs are text, not commands: `grep -rn "git commit" docs/` is a search.
-  const bare = unquoted(withoutHeredocs(command));
-  if (!COMMITS_HERE.test(bare) && !MOVES_BRANCH.test(bare)) return null;
-  const self = (rel) => new URL(rel, import.meta.url);
-  const raw = segments(withoutHeredocs(command));
+  // Except where a wrapper hands the string to a shell: `bash -c "git commit"` runs the commit, so
+  // the segments judged are the ones the shell would really run (shell-unwrap.mjs).
+  const raw = SH.expand(command);
   const segs = raw.map(unquoted);
+  if (!segs.some((s) => COMMITS_HERE.test(s) || MOVES_BRANCH.test(s) || MOVES_REF.test(s) || PUSHES.test(s))) return null;
+  const self = (rel) => new URL(rel, import.meta.url);
   let dir = cwd || root;
   const branchAt = new Map(); // toplevel → branch the chain has moved it to
 
@@ -111,7 +144,9 @@ export async function evaluate({ root, command, cwd, sessionId }) {
     if (cd) { const d = cd[1].replace(/^["']|["']$/g, ''); dir = isAbsolute(d) ? d : resolve(dir, d); continue; }
     const commits = COMMITS_HERE.test(seg);
     const moves = MOVES_BRANCH.test(seg);
-    if (!commits && !moves) continue;
+    const movesRef = MOVES_REF.test(seg);
+    const pushes = PUSHES.test(seg);
+    if (!commits && !moves && !movesRef && !pushes) continue;
     const at = effectiveDir(raw[i] || seg, dir);
     const git = gitAt(at);
     const top = git('rev-parse', '--show-toplevel');
@@ -129,6 +164,32 @@ export async function evaluate({ root, command, cwd, sessionId }) {
       }
     }
 
+    // Rule A, the other way onto the default branch: pointing it somewhere else without a commit.
+    if (movesRef && !existsSync(join(root, '.rsc', '.no-trunk-guard'))) {
+      try {
+        const { trunkPolicy, defaultBranchName } = await import(self('./trunk-policy.mjs'));
+        const trunk = defaultBranchName(here);
+        if (trunk && refMoveTarget(seg) === trunk) {
+          const policy = trunkPolicy(here);
+          if (policy.closed) return refDenial({ trunk, policy });
+        }
+      } catch { /* policy module missing → nothing to enforce */ }
+    }
+
+    // And by pushing straight into it: `git push origin HEAD:main` from a feature branch. Branch
+    // protection on the server would refuse it, but a repo without one would take it (second team
+    // simulation) — so the closed trunk is enforced here, where the agent runs it.
+    if (pushes && !existsSync(join(root, '.rsc', '.no-trunk-guard'))) {
+      try {
+        const { trunkPolicy, defaultBranchName } = await import(self('./trunk-policy.mjs'));
+        const trunk = defaultBranchName(here);
+        if (trunk && pushesTo(seg, trunk)) {
+          const policy = trunkPolicy(here);
+          if (policy.closed) return refDenial({ trunk, policy, how: '`git push <remote> <branch>:' + trunk + '`' });
+        }
+      } catch { /* policy module missing → nothing to enforce */ }
+    }
+
     if (commits && !existsSync(join(root, '.rsc', '.no-trunk-guard'))) {
       try {
         const { trunkPolicy, defaultBranchName } = await import(self('./trunk-policy.mjs'));
@@ -164,6 +225,13 @@ async function trunkDenial({ root, here, sessionId, self, trunk, policy }) {
     'Unlock → only on their explicit answer, `npx @ericrisco/rsc main unlock` (a project decision, saved in .rsc.json), then commit again.';
 }
 
+function refDenial({ trunk, policy, how = '`git update-ref` and a forced `git branch`' }) {
+  return `This project keeps its default branch "${trunk}" closed for the agent (it looks complex or in production: ${policy.signals.join(', ')}), so "${trunk}" was not moved — ` +
+    `${how} land${how.includes(' and ') ? '' : 's'} work on it with no review. ` +
+    `Work reaches "${trunk}" through a pull request: push the branch and open one (the \`ship\` skill). ` +
+    `Do not choose for the person: if they want "${trunk}" moved by hand, ask them in one line; only on their explicit answer, \`npx @ericrisco/rsc main unlock\` (a project decision, saved in .rsc.json).`;
+}
+
 async function isolationDenial({ root, here, sessionId, self }) {
   const others = await othersHere({ root, here, sessionId, self });
   if (!others.length) return null;