@matt82198/aesop 0.1.0-beta.3 → 0.1.0-beta.4

package/bin/cli.js

@@ -2,52 +2,124 @@
 
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 
 const args = process.argv.slice(2);
 const helpFlag = args.includes('--help') || args.includes('-h');
+const forceFlag = args.includes('--force');
+
+// Parse named flags
+function getFlag(flagName) {
+  const idx = args.findIndex(arg => arg === flagName);
+  if (idx !== -1 && idx + 1 < args.length) {
+    return args[idx + 1];
+  }
+  return null;
+}
 
 if (helpFlag) {
   console.log(`
 aesop — Multi-agent orchestration template scaffolder
 
 Usage:
-  npx @matt82198/aesop [target-dir]
+  npx @matt82198/aesop [target-dir] [options]
 
 Arguments:
   target-dir    Directory to scaffold the template into (default: "aesop-fleet")
 
+Options:
+  --help, -h              Show this help message
+  --force                 Replace any existing .git/hooks/pre-push during scaffold
+  --name <name>           Project name (for headless scaffolding; generates CLAUDE.md + aesop.config.json)
+  --domains <list>        Comma-separated domain list (e.g., "api,worker,monitoring")
+  --repos <paths>         Comma-separated repo paths (e.g., "/path/to/repo1,/path/to/repo2")
+
 Examples:
-  npx @matt82198/aesop                    # Creates ./aesop-fleet/
-  npx @matt82198/aesop my-fleet           # Creates ./my-fleet/
-  npx @matt82198/aesop /tmp/my-orchestrator  # Creates /tmp/my-orchestrator/
+  npx @matt82198/aesop                                      # Creates ./aesop-fleet/ with template
+  npx @matt82198/aesop my-fleet                             # Creates ./my-fleet/ with template
+  npx @matt82198/aesop my-fleet --force                     # Re-scaffold and replace hooks
+  npx @matt82198/aesop orchestrator --name "my-service"     # Headless: generates CLAUDE.md + config
 
-Options:
-  --help, -h    Show this help message
+  Full headless with domains and repos (POSIX):
+    npx @matt82198/aesop orchestrator --name "api" --domains "server,worker" --repos "/path/to/api"
+
+  Full headless with domains and repos (PowerShell):
+    npx @matt82198/aesop orchestrator --name "api" --domains "server,worker" --repos "C:\path\to\api"
 
-After scaffolding, cd into the directory and:
-  1. Copy aesop.config.example.json → aesop.config.json
-  2. Edit aesop.config.json with your paths and repos
+After scaffolding with --name, cd into the directory and:
+  1. Review CLAUDE.md (pre-filled with your project info)
+  2. Review aesop.config.json (pre-configured for your repos)
   3. Run: bash daemons/run-watchdog.sh --once
   4. Launch dashboard: python ui/serve.py
 `);
   process.exit(0);
 }
 
-const targetDir = args[0] || 'aesop-fleet';
-
-if (args.length > 1) {
-  console.error('Error: Too many arguments. Use --help for usage.');
-  process.exit(1);
+// Extract targetDir (first non-flag argument, excluding flag values)
+// Build set of indices consumed as flag values (tokens after --name/--domains/--repos)
+const consumedIndices = new Set();
+const flagsWithValues = ['--name', '--domains', '--repos'];
+for (let i = 0; i < args.length; i++) {
+  if (flagsWithValues.includes(args[i]) && i + 1 < args.length) {
+    consumedIndices.add(i + 1);
+  }
 }
+// targetDir = first non-flag, non-consumed argument, else default to 'aesop-fleet'
+const targetDir = args.find((arg, idx) =>
+  !arg.startsWith('--') &&
+  !arg.startsWith('-') &&
+  !consumedIndices.has(idx)
+) || 'aesop-fleet';
 
-// Validate target directory doesn't exist or is empty
+// Parse onboarding flags
+const projectName = getFlag('--name');
+const domainsStr = getFlag('--domains');
+const reposStr = getFlag('--repos');
+
+// Validate target directory doesn't exist or is empty (except for .git and aesop files)
 if (fs.existsSync(targetDir)) {
   const contents = fs.readdirSync(targetDir);
-  if (contents.length > 0) {
-    console.error(`Error: Directory "${targetDir}" exists and is not empty.`);
+  // Allow .git and aesop scaffolded files to already exist (for idempotency)
+  const aesopDirs = ['daemons', 'dash', 'monitor', 'tools', 'ui', 'docs', '.git', 'state'];
+  const aesopFiles = [
+    'aesop.config.example.json',
+    'aesop.config.json',
+    'README.md',
+    'LICENSE',
+    'CHANGELOG.md',
+    'CLAUDE-TEMPLATE.md',
+    'CLAUDE.md',
+    'MEMORY-SEED.md'
+  ];
+  const allowedItems = new Set([...aesopDirs, ...aesopFiles]);
+
+  const unexpectedContents = contents.filter(item => !allowedItems.has(item));
+  if (unexpectedContents.length > 0) {
+    console.error(`Error: Directory "${targetDir}" exists and contains unexpected files.`);
     console.error('Please choose a different target directory or remove the existing one.');
     process.exit(1);
   }
+
+  // SECURITY: A pre-existing allowlisted entry (e.g. ".git", "state") must be a real
+  // directory/file, never a symlink or junction. Following a symlinked entry here would
+  // let scaffolding escape targetDir entirely (e.g. a symlinked .git whose "hooks"
+  // subdirectory resolves outside targetDir). lstat (not stat) so the link itself is
+  // inspected rather than whatever it points to.
+  for (const item of contents) {
+    const itemPath = path.join(targetDir, item);
+    let itemLstat;
+    try {
+      itemLstat = fs.lstatSync(itemPath);
+    } catch (e) {
+      // lstat failed (race/permissions); nothing to check, move on
+      continue;
+    }
+    if (itemLstat.isSymbolicLink()) {
+      console.error(`Error: "${item}" in "${targetDir}" is a symlink (security risk).`);
+      console.error('Refusing to scaffold through a symlinked entry. Remove it and re-run.');
+      process.exit(1);
+    }
+  }
 } else {
   fs.mkdirSync(targetDir, { recursive: true });
 }
@@ -64,7 +136,8 @@ const filesToCopy = [
   'aesop.config.example.json',
   'README.md',
   'LICENSE',
-  'CHANGELOG.md'
+  'CHANGELOG.md',
+  'CLAUDE-TEMPLATE.md'
 ];
 
 let copiedCount = 0;
@@ -87,6 +160,220 @@ function copyRecursive(src, dest) {
   }
 }
 
+function generateDomainText(domainsStr) {
+  if (!domainsStr) {
+    return '- **[Your domains here]** — [Customize per team]';
+  }
+  const domains = domainsStr.split(',').map(d => d.trim()).filter(d => d);
+  if (domains.length === 0) {
+    return '- **[Your domains here]** — [Customize per team]';
+  }
+  return domains
+    .map(domain => `- **${domain}/** — [Add description for ${domain}]`)
+    .join('\n');
+}
+
+function generateRepoText(reposStr) {
+  if (!reposStr) {
+    return '- **[Your repos here]** — [Customize per team]';
+  }
+  const repos = reposStr.split(',').map(r => r.trim()).filter(r => r);
+  if (repos.length === 0) {
+    return '- **[Your repos here]** — [Customize per team]';
+  }
+  return repos
+    .map(repo => {
+      const repoName = path.basename(repo);
+      return `- **${repo}** — [${repoName} domains and setup]`;
+    })
+    .join('\n');
+}
+
+function substituteTemplate(templateContent, projectName, domainsStr, reposStr) {
+  let result = templateContent;
+  result = result.replace(/{{PROJECT_NAME}}/g, projectName || 'my-fleet');
+  const domainList = domainsStr ? domainsStr.split(',').map(d => d.trim()).join(', ') : 'multi-domain';
+  result = result.replace(/{{DOMAIN_LIST}}/g, domainList);
+  result = result.replace(/{{DOMAINS}}/g, generateDomainText(domainsStr));
+  result = result.replace(/{{REPO_LIST}}/g, generateRepoText(reposStr));
+  return result;
+}
+
+function generateConfigJson(targetDir, templateRoot, projectName, reposStr) {
+  // Read example config
+  const exampleConfigPath = path.join(templateRoot, 'aesop.config.example.json');
+  let exampleConfig;
+  try {
+    const content = fs.readFileSync(exampleConfigPath, 'utf8');
+    exampleConfig = JSON.parse(content);
+  } catch (e) {
+    // Fallback config if example doesn't parse
+    exampleConfig = {
+      description: 'Aesop configuration',
+      aesop_root: path.dirname(targetDir),
+      brain_root: path.join(os.homedir(), '.claude'),
+      scripts_root: path.join(os.homedir(), 'scripts'),
+      temp_root: path.join(os.tmpdir()),
+      repos: [],
+      watchdog: {
+        cycle_seconds: 150,
+        heartbeat_threshold_seconds: 200,
+        enable_secret_scan: true,
+        secret_scan_script: 'tools/secret_scan.py'
+      },
+      monitor: {
+        enable: true,
+        cycle_seconds: 3600,
+        heartbeat_threshold_seconds: 3600,
+        memory_staleness_days: 30,
+        log_max_lines: 500,
+        log_max_kb: 40
+      },
+      dashboard: {
+        refresh_seconds: 1,
+        enable_jq_parsing: true,
+        theme: 'dark'
+      },
+      cardinal_rules: {
+        subagent_model: 'haiku',
+        orchestrator_model: 'opus',
+        tdd_first: true,
+        never_push_main: true,
+        secret_scan_gates_push: true
+      }
+    };
+  }
+
+  // Update with provided values
+  exampleConfig.aesop_root = targetDir;
+  exampleConfig.brain_root = '~/.claude';
+  exampleConfig.scripts_root = '~/scripts';
+  exampleConfig.temp_root = '~/.aesop-temp';
+  exampleConfig._generated_note = 'This config uses portable ~ paths which expand at runtime on all platforms. Config loaders in ui/config.py (Python) and monitor/collect-signals.mjs (Node.js) automatically expand ~ paths to your home directory.';
+
+  // Parse repos if provided
+  if (reposStr) {
+    const repos = reposStr.split(',').map(r => r.trim()).filter(r => r);
+    exampleConfig.repos = repos.map((repoPath, idx) => ({
+      path: repoPath,
+      name: path.basename(repoPath),
+      url: `https://github.com/user/${path.basename(repoPath)}.git`,
+      primary_branch: 'main',
+      backup_branch: 'backup/wip'
+    }));
+  }
+
+  return exampleConfig;
+}
+
+function installPrePushHook(targetDir, templateRoot) {
+  // Try to locate .git directory
+  const gitDir = path.join(targetDir, '.git');
+  if (!fs.existsSync(gitDir)) {
+    // No git repo, skip hook installation silently
+    return;
+  }
+
+  // SECURITY: Check if .git itself is a symlink/junction (refuse to follow it outside
+  // targetDir). This mirrors the gitHooksDir/hookDest checks below — .git is one path
+  // component higher and must be validated before anything derived from it is trusted.
+  try {
+    const gitDirLstat = fs.lstatSync(gitDir);
+    if (gitDirLstat.isSymbolicLink()) {
+      console.warn('⚠ Warning: .git is a symlink (security risk)');
+      console.warn('  Skipping hook installation. Please remove the symlink and re-run scaffold.');
+      return;
+    }
+  } catch (e) {
+    // lstat failed; proceed (may be a permission issue)
+  }
+
+  // Ensure hooks directory exists
+  const gitHooksDir = path.join(gitDir, 'hooks');
+  if (!fs.existsSync(gitHooksDir)) {
+    fs.mkdirSync(gitHooksDir, { recursive: true });
+  }
+
+  // SECURITY: Check if gitHooksDir is a symlink (refuse to install through symlinked dir)
+  try {
+    const hooksLstat = fs.lstatSync(gitHooksDir);
+    if (hooksLstat.isSymbolicLink()) {
+      console.warn('⚠ Warning: .git/hooks directory is a symlink (security risk)');
+      console.warn('  Skipping hook installation. Please remove the symlink and re-run scaffold.');
+      return;
+    }
+  } catch (e) {
+    // lstat failed; proceed (may be a permission issue)
+  }
+
+  const hookSource = path.join(templateRoot, 'hooks', 'pre-push-policy.sh');
+  const hookDest = path.join(gitHooksDir, 'pre-push');
+
+  if (!fs.existsSync(hookSource)) {
+    // Hook source doesn't exist, skip
+    return;
+  }
+
+  const hookSourceContent = fs.readFileSync(hookSource, 'utf8');
+
+  // Check if hook already exists
+  if (fs.existsSync(hookDest)) {
+    // SECURITY: Check if existing hookDest is a symlink (refuse to follow it)
+    try {
+      const destLstat = fs.lstatSync(hookDest);
+      if (destLstat.isSymbolicLink()) {
+        console.warn('⚠ Warning: Existing .git/hooks/pre-push is a symlink (security risk)');
+        console.warn('  Skipping hook installation. Please remove the symlink and re-run scaffold.');
+        return;
+      }
+    } catch (e) {
+      // lstat failed; proceed
+    }
+
+    const existingContent = fs.readFileSync(hookDest, 'utf8');
+
+    // If content matches, it's idempotent, do nothing
+    if (existingContent === hookSourceContent) {
+      console.log('✓ Pre-push hook already installed (no changes)');
+      return;
+    }
+
+    // Different hook exists
+    if (!forceFlag) {
+      console.warn('⚠ Warning: A different pre-push hook already exists at ' + hookDest);
+      console.warn('  Use --force to replace it, or customize manually.');
+      return;
+    }
+
+    // --force: replace the existing hook
+    console.log('✓ Replacing existing pre-push hook with --force');
+  }
+
+  // Install the hook
+  if (process.platform === 'win32') {
+    // Windows: copy the file
+    fs.copyFileSync(hookSource, hookDest);
+    console.log('✓ Copied pre-push policy hook to .git/hooks/pre-push');
+  } else {
+    // Unix: symlink for easy updates
+    // First remove if exists
+    if (fs.existsSync(hookDest)) {
+      fs.unlinkSync(hookDest);
+    }
+    // Create symlink relative to .git/hooks/
+    const relPath = path.relative(gitHooksDir, hookSource);
+    fs.symlinkSync(relPath, hookDest);
+    console.log('✓ Symlinked pre-push policy hook to .git/hooks/pre-push');
+  }
+
+  // Ensure hook is executable
+  try {
+    fs.chmodSync(hookDest, 0o755);
+  } catch (e) {
+    // On Windows, chmod may fail; that's okay
+  }
+}
+
 try {
   filesToCopy.forEach(item => {
     const src = path.join(templateRoot, item);
@@ -97,13 +384,70 @@ try {
     }
   });
 
+  // Create state/ directory
+  const stateDir = path.join(targetDir, 'state');
+  if (!fs.existsSync(stateDir)) {
+    fs.mkdirSync(stateDir, { recursive: true });
+    console.log('✓ Created state/ directory');
+  }
+
+  // If --name provided, generate CLAUDE.md and aesop.config.json
+  if (projectName) {
+    // Generate CLAUDE.md from template
+    const templatePath = path.join(targetDir, 'CLAUDE-TEMPLATE.md');
+    const claudeMdPath = path.join(targetDir, 'CLAUDE.md');
+    if (fs.existsSync(templatePath)) {
+      const templateContent = fs.readFileSync(templatePath, 'utf8');
+      const claudeContent = substituteTemplate(templateContent, projectName, domainsStr, reposStr);
+      fs.writeFileSync(claudeMdPath, claudeContent);
+      console.log('✓ Generated CLAUDE.md (from template with substitutions)');
+    }
+
+    // Generate aesop.config.json
+    const configPath = path.join(targetDir, 'aesop.config.json');
+    const config = generateConfigJson(targetDir, templateRoot, projectName, reposStr);
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+    console.log('✓ Generated aesop.config.json (configured for your repos)');
+  }
+
+  // Copy MEMORY-TEMPLATE.md as MEMORY-SEED.md
+  const memoryTemplatePath = path.join(templateRoot, 'docs', 'MEMORY-TEMPLATE.md');
+  const memorySeedPath = path.join(targetDir, 'MEMORY-SEED.md');
+  if (fs.existsSync(memoryTemplatePath) && !fs.existsSync(memorySeedPath)) {
+    fs.copyFileSync(memoryTemplatePath, memorySeedPath);
+    console.log('✓ Copied MEMORY-SEED.md (template for your facts)');
+  }
+
+  // Install the pre-push hook
+  installPrePushHook(targetDir, templateRoot);
+
   console.log(`\n✅ Scaffolded aesop template into "${targetDir}" (${copiedCount} files)`);
-  console.log('\nNext steps:');
-  console.log(`  1. cd ${targetDir}`);
-  console.log('  2. cp aesop.config.example.json aesop.config.json');
-  console.log('  3. Edit aesop.config.json with your configuration');
-  console.log('  4. bash daemons/run-watchdog.sh --once  (test run)');
-  console.log('  5. python ui/serve.py  (launch dashboard)');
+
+  if (projectName) {
+    console.log('\nHeadless scaffolding complete! Next steps:');
+    console.log(`  1. cd ${targetDir}`);
+    console.log('  2. Review CLAUDE.md (pre-filled with your project info)');
+    console.log('  3. Review aesop.config.json (pre-configured for your repos)');
+    console.log('\nInitialize your brain (Claude Code team memory):');
+    console.log('  4. mkdir -p ~/.claude/memory');
+    console.log(`  5. cp ${targetDir}/CLAUDE.md ~/.claude/CLAUDE.md  (or review existing ~/.claude/CLAUDE.md)`);
+    console.log(`  6. cp ${targetDir}/MEMORY-SEED.md ~/.claude/MEMORY.md  (then add your facts)`);
+    console.log('\nRun the daemon and dashboard:');
+    console.log('  7. bash daemons/run-watchdog.sh --once  (test run)');
+    console.log('  8. python ui/serve.py  (launch dashboard on localhost:8770)');
+  } else {
+    console.log('\nConfiguration steps:');
+    console.log(`  1. cd ${targetDir}`);
+    console.log('  2. cp aesop.config.example.json aesop.config.json');
+    console.log('  3. Edit aesop.config.json with your configuration');
+    console.log('\nInitialize your brain (Claude Code team memory):');
+    console.log('  4. mkdir -p ~/.claude/memory');
+    console.log(`  5. cp ${targetDir}/CLAUDE-TEMPLATE.md ~/.claude/CLAUDE.md  (then edit domains/team info)`);
+    console.log(`  6. cp ${targetDir}/MEMORY-SEED.md ~/.claude/MEMORY.md  (then add your facts)`);
+    console.log('\nRun the daemon and dashboard:');
+    console.log('  7. bash daemons/run-watchdog.sh --once  (test run)');
+    console.log('  8. python ui/serve.py  (launch dashboard on localhost:8770)');
+  }
   console.log('\nFor full documentation, see the README.md in the scaffolded directory.');
   process.exit(0);
 } catch (err) {

package/daemons/CLAUDE.md

@@ -0,0 +1,33 @@
+# daemons/ — Watchdog daemon
+
+**Purpose**: Long-running backup and secret-scan daemon for fleet-wide repo safety.
+
+## Files
+
+- **run-watchdog.sh** (1.5K): Interactive daemon supervisor; spawns backup-fleet.sh every 150s, maintains heartbeat guard (200s dedupe window), logs to FLEET-BACKUP.log. Traps INT/TERM cleanly.
+- **backup-fleet.sh** (5K): Core backup worker; discovers repos (~/.*, ~/*, ~/dev/*), stashes uncommitted work to backup/* branches, pushes unpushed commits, scans tracked files for secrets. Blocks push if secret-scan fails (marks BLOCKED state).
+
+## Contracts
+
+**Env vars consumed**: `AESOP_ROOT` (defaults to `.`) — root of project; prepends to all state/ and tools/ paths.
+
+**State files written** (git-ignored):
+- `$AESOP_ROOT/state/.watchdog-heartbeat` — epoch seconds; dedupe guard (200s window).
+- `$AESOP_ROOT/state/.watchdog-repos.json` — per-cycle snapshot: [{repo, state: CLEAN|PUSHED|SNAPSHOTTED|BLOCKED, age}].
+- `$AESOP_ROOT/state/FLEET-BACKUP.log` — append-only; cycle start/end, repo statuses, secret-scan blocks.
+
+**Exit behaviors**: run-watchdog exits 0 always (trap handles clean shutdown). backup-fleet exits 0 even on secret-scan block (marks repo BLOCKED, continues).
+
+**Cadence**: 150s cycle; heartbeat dedupe within 200s.
+
+## Invariants & Gotchas
+
+1. **Single-instance guard (atomic lock)**: run-watchdog.sh uses atomic mkdir-based lockfile (`.watchdog-lock/`) to prevent concurrent daemons.
+   - Atomic acquire: `mkdir $LOCK_DIR` is guaranteed atomic on POSIX systems (returns 0 only to first caller).
+   - Stale-lock recovery: Crashed holder won't wedge daemon forever; lock older than 300s is reclaimed atomically.
+   - Guards both daemon mode and `--once` mode (no bypass).
+2. **Testing override**: Set `AESOP_WATCHDOG_CYCLE_CMD` env var to replace backup-fleet.sh invocation (allows tests to use mock cycle without running real backup).
+3. **CRLF-safe, no line continuations**: Use POSIX-safe heredocs; never add `\` for line wrap.
+4. **Secret-scan gate**: `scan_tracked_files()` calls `$AESOP_ROOT/tools/secret_scan.py` on staged/modified files; non-0 exit blocks push, marks repo BLOCKED.
+5. **Append-only logs**: FLEET-BACKUP.log only grows; rotate via tools/rotate_logs.py.
+6. **Path dedup via realpath**: Avoids processing symlinked repos or dot-dir aliases twice.

package/daemons/backup-fleet.sh

@@ -3,16 +3,49 @@ set -uo pipefail
 # Backup fleet repos: stash uncommitted work, push unpushed commits to backup branches.
 # Runs every 150s from run-watchdog.sh. Abort on secret-scan failures.
 # Improvements: dot-directory discovery, path dedup, tracked-files-only secret scanning.
+# P2 FIX: JSON escaping for repo names and NUL-delimited internal protocol.
 
 AESOP_ROOT="${AESOP_ROOT:-.}"
 HEARTBEAT="$AESOP_ROOT/state/.watchdog-heartbeat"
 LOG="$AESOP_ROOT/state/FLEET-BACKUP.log"
 REPOS_STATUS="$AESOP_ROOT/state/.watchdog-repos.json"
 
+# P2 FIX: script-global temp file handles (cycle-status JSON build + per-repo
+# NUL-protocol scratch file), cleaned up unconditionally via trap below so an
+# interrupted cycle (INT/TERM) or unexpected error never leaks mktemp files
+# over the daemon's long-running lifecycle. Initialized empty so `rm -f`
+# under `set -u` is always safe even if the trap fires before mktemp runs.
+temp_json=""
+temp_result=""
+cleanup_temp_files() {
+  rm -f "$temp_json" "$temp_result"
+}
+trap cleanup_temp_files EXIT INT TERM
+
 date +%s > "$HEARTBEAT" 2>/dev/null
 ts() { date '+%Y-%m-%d %H:%M:%S'; }
 log() { echo "[$(ts)] $*" | tee -a "$LOG"; }
 
+# P2 FIX: JSON escape function for safe string interpolation in JSON
+# Escapes backslash, quote, and control characters (newline, tab, carriage return, etc.)
+json_escape() {
+  local s="$1"
+  # Escape backslash first (must be first to avoid double-escaping)
+  s="${s//\\/\\\\}"
+  # Escape double quote
+  s="${s//\"/\\\"}"
+  # Escape newline
+  s="${s//$'\n'/\\n}"
+  # Escape carriage return
+  s="${s//$'\r'/\\r}"
+  # Escape tab
+  s="${s//$'\t'/\\t}"
+  # Escape backspace, form feed, and other C0 controls
+  s="${s//$'\b'/\\b}"
+  s="${s//$'\f'/\\f}"
+  printf '%s' "$s"
+}
+
 is_touched() {
   local repo="$1"
   [ ! -d "$repo/.git" ] && return 1
@@ -33,31 +66,60 @@ get_tracked_modifications() {
   ) | sort -u
 }
 
+get_untracked_files() {
+  local repo="$1"
+  (
+    cd "$repo" || return 1
+    git ls-files --others --exclude-standard 2>/dev/null
+  ) | sort -u
+}
+
 scan_tracked_files() {
   local repo="$1"
   local tracked_files
-  local file_paths=""
+  local untracked_files
+  local -a file_paths=()
+  local repo_win
+
+  # Convert repo path to Windows format for Python compatibility (Git Bash on Windows)
+  repo_win=$(cd "$repo" 2>/dev/null && pwd -W 2>/dev/null || echo "$repo")
+
   tracked_files=$(get_tracked_modifications "$repo")
+  untracked_files=$(get_untracked_files "$repo")
 
-  if [ -z "$tracked_files" ]; then
-    return 0
+  # Collect tracked modifications
+  if [ -n "$tracked_files" ]; then
+    while IFS= read -r file; do
+      if [ -n "$file" ] && [ -f "$repo/$file" ]; then
+        file_paths+=("$repo_win/$file")
+      fi
+    done <<EOF
+$tracked_files
+EOF
   fi
 
-  while IFS= read -r file; do
-    if [ -n "$file" ] && [ -f "$repo/$file" ]; then
-      file_paths="$file_paths $repo/$file"
-    fi
-  done <<EOF
-$tracked_files
+  # Collect untracked files (ITEM 1 fix)
+  if [ -n "$untracked_files" ]; then
+    while IFS= read -r file; do
+      if [ -n "$file" ] && [ -f "$repo/$file" ]; then
+        file_paths+=("$repo_win/$file")
+      fi
+    done <<EOF
+$untracked_files
 EOF
+  fi
 
-  if [ -z "$file_paths" ]; then
+  if [ ${#file_paths[@]} -eq 0 ]; then
     return 0
   fi
 
   if [ -f "$AESOP_ROOT/tools/secret_scan.py" ]; then
-    python "$AESOP_ROOT/tools/secret_scan.py" $file_paths >/dev/null 2>&1
+    # ITEM 2 fix: use "${file_paths[@]}" to properly quote array elements
+    python "$AESOP_ROOT/tools/secret_scan.py" "${file_paths[@]}" >/dev/null 2>&1
+    return $?
   fi
+
+  return 0
 }
 
 get_default_branch() {
@@ -88,11 +150,11 @@ process_repo() {
         WIPREF="backup/wip-$(date +%Y%m%d)"
         if scan_tracked_files "$repo"; then
           if git push -qf origin "$COMMIT:refs/heads/$WIPREF" 2>/dev/null; then
-            printf 'SNAPSHOTTED|%s\n' "$name"
+            printf 'SNAPSHOTTED\0%s\n' "$name"
             exit 0
           fi
         else
-          printf 'BLOCKED|%s\n' "$name"
+          printf 'BLOCKED\0%s\n' "$name"
           exit 0
         fi
       fi
@@ -107,27 +169,27 @@ process_repo() {
         WIPREF="backup/master-wip-$(date +%Y%m%d)"
         if scan_tracked_files "$repo"; then
           if git push -qf origin "HEAD:refs/heads/$WIPREF" 2>/dev/null; then
-            printf 'SNAPSHOTTED|%s\n' "$name"
+            printf 'SNAPSHOTTED\0%s\n' "$name"
             exit 0
           fi
         else
-          printf 'BLOCKED|%s\n' "$name"
+          printf 'BLOCKED\0%s\n' "$name"
           exit 0
         fi
       else
         if scan_tracked_files "$repo"; then
           if git push -q origin "$branch" 2>/dev/null; then
-            printf 'PUSHED|%s\n' "$name"
+            printf 'PUSHED\0%s\n' "$name"
             exit 0
           fi
         else
-          printf 'BLOCKED|%s\n' "$name"
+          printf 'BLOCKED\0%s\n' "$name"
           exit 0
         fi
       fi
     fi
 
-    printf 'CLEAN|%s\n' "$name"
+    printf 'CLEAN\0%s\n' "$name"
   )
 }
 
@@ -154,15 +216,24 @@ for dir in ~/.* ~/* ~/dev/*; do
 $real_dir"
 
   if is_touched "$dir"; then
-    result=$(process_repo "$dir")
-    IFS="|" read -r state name <<< "$result"
+    # P0 FIX: Eliminate $() command substitution to preserve NUL bytes in protocol
+    # Direct redirect maintains NUL delimiters (process_repo emits STATE\0name format)
+    temp_result=$(mktemp)
+    process_repo "$dir" > "$temp_result"
+    # Read first field (state) and second field (name) using NUL delimiter
+    # Portable solution: use awk with RS="\0" instead of GNU sed \x0 (BSD/macOS compatible)
+    state=$(awk 'BEGIN{RS="\0"} NR==1 {print}' "$temp_result")
+    name=$(awk 'BEGIN{RS="\0"} NR==2 {print}' "$temp_result" | tr -d '\n')
+    rm -f "$temp_result"
     [ -z "$state" ] && continue
     if [ "$first" = 1 ]; then
       first=0
     else
       echo "," >> "$temp_json"
     fi
-    printf '{"repo":"%s","state":"%s","age":"%s"}' "$name" "$state" "$(date -Iseconds)" >> "$temp_json"
+    # P2 FIX: JSON-escape all interpolated values before emitting
+    # P2 FIX: Portable date format (not GNU-only date -Iseconds)
+    printf '{"repo":"%s","state":"%s","age":"%s"}' "$(json_escape "$name")" "$(json_escape "$state")" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$temp_json"
     log "$state: $name"
   fi
 done