chore(evolve): AI improvement pass — 2026-09-14

[bamr87]

Done. Here's the PR body:

---

What changed

• project-init.sh:2-41 — replaced the Python-style """…""" header block with a #-prefixed banner comment matching STASHME/stashme.sh's convention. Content is unchanged, only re-commented and re-wrapped.
• git_init.sh:390-391 — added a --dry-run branch to the gh-unavailable path so git remote add origin is printed, not executed.
• git_init.sh:398-404 — guarded the previously unconditional git branch -M "$DEFAULT_BRANCH" behind the dry-run check.
• git_init.sh:49,54,56,113,119 — documented --dry-run in usage(), added the dry-run example, and made usage take an exit code so --help exits 0 while error paths still exit 1.
• git_init.sh:59-64,69-120 — added a missing_value() helper and an explicit [ $# -ge 2 ] arity check to every value-taking option; collapsed -*|--*= to -*.
• SECURITY.md (new) — disclosure policy scoped to what these tools actually are.
• .github/ISSUE_TEMPLATE/bug_report.yml, feature_request.yml (new) — GitHub issue forms.

Why

• project-init.sh's """ block was the repo's only shellcheck error. Bash does not have triple-quoted strings: the quote opened at line 2 col 3 closes on the " in line 35's "$HOME/github/my-react-app", reopens, and runs to line 41 — so lines 2–41 tokenize as a single command word containing newlines, which bash tries to execute. It only fails soft because set -euo pipefail is on line 43, after it. Every invocation printed a multi-line command not found to stderr before doing anything. CLAUDE.md states the hub's tools/run-all-tests.sh shellchecks the top-level *.sh here, so this error was failing the hub's aggregate checks too.
• git branch -M leaked past --dry-run. In dry-run the script deliberately skips the cd "$REPO_PATH", so every later git command runs in the caller's current directory. git branch -M main was outside every dry-run guard — meaning the smoke test CLAUDE.md documents (./git_init.sh --headless -n previewme --dry-run) silently renames the current branch of whatever repo you happen to be standing in. Same class of leak on the git remote add in the no-gh path.
• --dry-run was implemented but absent from --help. README.md and CLAUDE.md both document it; usage() did not. --help also exited 1, which breaks git_init.sh --help | less in a set -e wrapper.
• X="$2" && shift 2 || usage crashed instead of explaining. Under set -u (line 4), git_init.sh --name with no value aborts on $2: unbound variable before the || usage fallback can run. This also cleared 8 SC2015 findings, and the --*= arm of -*|--*= was dead (SC2221/SC2222) since -* already matched it.
• SECURITY.md / issue templates close conformance rows UPS-REPO-14 and UPS-REPO-18 (both MUST) from the brief. PR chore: retire tooling superseded by the hub's fan-out kits #9 independently flags issue templates as a real gap that .github.sh's removal leaves open and that the hub's standardize kit does not seed.

Verification

• shellcheck --severity=error *.sh FORKME/forkme.sh STASHME/stashme.sh linting/*.sh → clean (no output).
• git show HEAD:project-init.sh | shellcheck --severity=error -s bash - → reproduces SC2289 on line 2, confirming the error is pre-existing and now fixed.
• shellcheck git_init.sh project-init.sh → SC2289, SC2221, SC2222 and all 8 SC2015 findings gone. Remaining findings in both files are pre-existing and untouched (SC2155, SC2162, SC2223, SC2294, SC2001).
• python3 tools/unwrap-prose.py --check → "All markdown prose already unwrapped." Also run explicitly on the untracked SECURITY.md → same.
• python3 -c "import yaml; ..." on both issue templates → parses.
• git status --short → only the 2 modified scripts and the 2 new paths; no scratch files.

Not verified: this sandbox blocks executing the scripts, so I could not run bash -n git_init.sh or a live --dry-run. Shellcheck parses both files end-to-end without a parse error, which covers syntax, but the dry-run output lines are unexercised. Worth one manual ./git_init.sh --headless -n previewme --dry-run from a throwaway branch before merge.

Not done

• README.md is untouched on purpose. Open PR chore: retire tooling superseded by the hub's fan-out kits #9 rewrites it (+106/−412), so any edit here becomes a guaranteed conflict for work already in flight. Two consequences a human should pick up:
  1. README-Last is unsatisfied for the two new .github/ files — after chore: retire tooling superseded by the hub's fan-out kits #9 lands, the tool index needs a pointer to SECURITY.md.
  2. The current README documents StashMe as ./stashme.sh throughout (lines 20-21, 79-98, 105-110), but there is no root symlink for it — only forkme.sh -> FORKME/forkme.sh exists. The real path is ./STASHME/stashme.sh. chore: retire tooling superseded by the hub's fan-out kits #9 claims to have verified the tool index against git ls-files; worth confirming that specific path survived the rewrite, since either the docs or a missing symlink is wrong.
• UPS-AGENT-03 and UPS-AGENT-22 left open. Both need the hub's copies to lift from (the <!-- kit: agent-context vX.Y.Z --> stamp version, and the canonical tools/unwrap-prose.py), and gh api repos/bamr87/bamr87/contents/... is not reachable from this runner. Guessing a kit version string would be worse than leaving the row red. CLAUDE.md is also modified by PR chore: retire tooling superseded by the hub's fan-out kits #9.
• UPS-QA-32, UPS-REPO-13 (release-please config, CHANGELOG) skipped — release plumbing is explicitly out of bounds for this pass.
• UPS-QA-41 (.github/dependabot.yml) skipped, and I think the row is genuinely contested rather than merely unaddressed: PR chore: retire tooling superseded by the hub's fan-out kits #9 argues at length that the fleet's ALWAYS-LATEST policy removes the pins Dependabot exists to bump. Someone should reconcile the spec row against docs/DEPENDENCIES.md rather than have each repo decide.
• UPS-QA-10 (no test files) is the largest real gap and needs more than a surgical pass. The natural shape: a tests/ runner driving each script's --dry-run/--help path against a scratch GIT_DIR, which would have caught the git branch -M leak above. git_init.sh, stashme.sh, and forkme.sh all have dry-run modes to build on; project-init.sh and rename-directory.sh do not, and adding one to each is a prerequisite.
• git_init.sh:150 run_or_echo uses eval "$@" (SC2294). Every call site passes a single pre-quoted string so it works today, but it is one careless call away from injecting a repo name into a shell. Converting to an array-based runner touches ~10 call sites — too broad for this pass.
• 4 SC2155 warnings in FORKME/forkme.sh (lines 440, 444, 488, 1604) and 2 in STASHME/stashme.sh (57, 58). forkme.sh is symlinked into the top level, so these are in the set CLAUDE.md asks to keep clean. Mechanical to fix but it is a lint sweep, not a targeted change.

🤖 Generated with Claude Code

---

Draft opened by the bamr87/bamr87 repo-evolution loop — run; the brief the agent worked from is attached to that run as evolution-workorders. Machine-authored: review it as you would any contribution. Nothing here merges automatically, and no new pass is opened for this repository while this one is open.