vibe-forge 0.1.0 → 0.2.1

package/bin/forge-daemon.sh

@@ -11,28 +11,110 @@
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FORGE_ROOT="$(dirname "$SCRIPT_DIR")"
+
+# =============================================================================
+# Load Shared Libraries
+# =============================================================================
+
+# shellcheck source=lib/colors.sh
+source "$SCRIPT_DIR/lib/colors.sh"
+# shellcheck source=lib/constants.sh
+source "$SCRIPT_DIR/lib/constants.sh"
+# shellcheck source=lib/config.sh
+source "$SCRIPT_DIR/lib/config.sh"
+
+# =============================================================================
+# Daemon Configuration
+# =============================================================================
+
 CONFIG_FILE="$FORGE_ROOT/.forge/config.json"
 PID_FILE="$FORGE_ROOT/.forge/daemon.pid"
 LOG_FILE="$FORGE_ROOT/.forge/daemon.log"
 NOTIFY_FILE="$FORGE_ROOT/.forge/notifications.log"
 NOTIFIED_FILE="$FORGE_ROOT/.forge/notified-tasks.txt"
-STATE_FILE="$FORGE_ROOT/context/forge-state.yaml"
+STATE_FILE="$FORGE_ROOT/$CONTEXT_DIR/forge-state.yaml"
+LOCK_FILE="$FORGE_ROOT/.forge/daemon.lock"
 
-POLL_INTERVAL=2  # seconds
+# Log file rotation settings
+MAX_LOG_SIZE=1048576  # 1MB
+MAX_NOTIFY_ENTRIES=1000
 
-# Load terminal type from config
+# Load terminal type from config (safe parsing)
 TERMINAL_TYPE="manual"
 if [[ -f "$CONFIG_FILE" ]]; then
-    TERMINAL_TYPE=$(grep -o '"terminal_type": *"[^"]*"' "$CONFIG_FILE" 2>/dev/null | cut -d'"' -f4)
+    TERMINAL_TYPE=$(json_get_string "$CONFIG_FILE" "terminal_type") || TERMINAL_TYPE="manual"
 fi
 
+# =============================================================================
+# Utility Functions
+# =============================================================================
+
+# Rotate log file if it gets too large
+rotate_log_if_needed() {
+    local log="$1"
+    if [[ -f "$log" ]]; then
+        local size
+        size=$(stat -f%z "$log" 2>/dev/null || stat --format=%s "$log" 2>/dev/null || echo 0)
+        if [[ "$size" -gt "$MAX_LOG_SIZE" ]]; then
+            mv "$log" "${log}.old"
+            touch "$log"
+        fi
+    fi
+}
+
+# Trim notification entries to prevent unbounded growth
+trim_notified_file() {
+    if [[ -f "$NOTIFIED_FILE" ]]; then
+        local count
+        count=$(wc -l < "$NOTIFIED_FILE" 2>/dev/null || echo 0)
+        if [[ "$count" -gt "$MAX_NOTIFY_ENTRIES" ]]; then
+            # Keep last 500 entries
+            tail -500 "$NOTIFIED_FILE" > "${NOTIFIED_FILE}.tmp"
+            mv "${NOTIFIED_FILE}.tmp" "$NOTIFIED_FILE"
+        fi
+    fi
+}
+
+# Safe file move with symlink protection
+safe_move_task() {
+    local src="$1"
+    local dest_dir="$2"
+
+    # SECURITY: Skip symlinks to prevent symlink attacks
+    if [[ -L "$src" ]]; then
+        echo "[$(date -Iseconds)] WARNING: Skipping symlink: $src" >> "$LOG_FILE"
+        return 1
+    fi
+
+    # SECURITY: Verify source is a regular file
+    if [[ ! -f "$src" ]]; then
+        return 1
+    fi
+
+    # SECURITY: Verify destination is within FORGE_ROOT
+    local real_dest
+    real_dest=$(cd "$dest_dir" 2>/dev/null && pwd)
+    local forge_root_real
+    forge_root_real=$(cd "$FORGE_ROOT" 2>/dev/null && pwd)
+
+    if [[ "$real_dest" != "$forge_root_real"/* ]]; then
+        echo "[$(date -Iseconds)] ERROR: Destination outside FORGE_ROOT: $dest_dir" >> "$LOG_FILE"
+        return 1
+    fi
+
+    local filename
+    filename=$(basename "$src")
+    mv "$src" "$dest_dir/$filename"
+}
+
 # =============================================================================
 # Notification Functions
 # =============================================================================
 
 notify() {
     local message="$1"
-    local timestamp=$(date -Iseconds)
+    local timestamp
+    timestamp=$(date -Iseconds)
 
     # Log to notifications file
     echo "[$timestamp] $message" >> "$NOTIFY_FILE"
@@ -43,13 +125,7 @@ notify() {
     # Terminal bell (works in most terminals)
     printf '\a'
 
-    # Terminal-specific notifications
-    case "$TERMINAL_TYPE" in
-        "windows-terminal")
-            # Windows Terminal doesn't have a native notify, but bell works
-            # Could potentially use PowerShell toast notification in future
-            ;;
-    esac
+    # Terminal-specific notifications could be added here
 }
 
 check_new_pending_tasks() {
@@ -57,16 +133,20 @@ check_new_pending_tasks() {
     touch "$NOTIFIED_FILE"
 
     # Check for new pending tasks
-    for task in "$FORGE_ROOT/tasks/pending"/*.md; do
-        if [[ -f "$task" ]]; then
-            local filename=$(basename "$task")
+    for task in "$FORGE_ROOT/$TASKS_PENDING"/*.md; do
+        if [[ -f "$task" && ! -L "$task" ]]; then
+            local filename
+            filename=$(basename "$task")
 
             # Check if we've already notified about this task
-            if ! grep -q "^$filename$" "$NOTIFIED_FILE" 2>/dev/null; then
-                # Extract task info from frontmatter
-                local task_id=$(grep -m1 "^id:" "$task" 2>/dev/null | cut -d':' -f2 | xargs)
-                local task_title=$(grep -m1 "^title:" "$task" 2>/dev/null | cut -d':' -f2- | xargs)
-                local assigned_to=$(grep -m1 "^assigned_to:" "$task" 2>/dev/null | cut -d':' -f2 | xargs)
+            if ! grep -qF "$filename" "$NOTIFIED_FILE" 2>/dev/null; then
+                # Extract task info from frontmatter safely
+                local task_id task_title assigned_to
+
+                # Use head to limit read and tr to sanitize
+                task_id=$(grep -m1 "^id:" "$task" 2>/dev/null | cut -d':' -f2 | tr -d ' "' | head -c 100)
+                task_title=$(grep -m1 "^title:" "$task" 2>/dev/null | cut -d':' -f2- | tr -d '"' | head -c 200)
+                assigned_to=$(grep -m1 "^assigned_to:" "$task" 2>/dev/null | cut -d':' -f2 | tr -d ' "' | head -c 50)
 
                 # Use filename as fallback
                 task_id="${task_id:-$filename}"
@@ -79,21 +159,23 @@ check_new_pending_tasks() {
                     notify "New pending task: $task_title ($task_id)"
                 fi
 
-                # Mark as notified
+                # Mark as notified (atomic append)
                 echo "$filename" >> "$NOTIFIED_FILE"
             fi
         fi
     done
 
     # Also check needs-changes for tasks that need rework
-    for task in "$FORGE_ROOT/tasks/needs-changes"/*.md; do
-        if [[ -f "$task" ]]; then
-            local filename=$(basename "$task")
+    for task in "$FORGE_ROOT/$TASKS_NEEDS_CHANGES"/*.md; do
+        if [[ -f "$task" && ! -L "$task" ]]; then
+            local filename
+            filename=$(basename "$task")
             local notified_key="needs-changes:$filename"
 
-            if ! grep -q "^$notified_key$" "$NOTIFIED_FILE" 2>/dev/null; then
-                local task_id=$(grep -m1 "^id:" "$task" 2>/dev/null | cut -d':' -f2 | xargs)
-                local assigned_to=$(grep -m1 "^assigned_to:" "$task" 2>/dev/null | cut -d':' -f2 | xargs)
+            if ! grep -qF "$notified_key" "$NOTIFIED_FILE" 2>/dev/null; then
+                local task_id assigned_to
+                task_id=$(grep -m1 "^id:" "$task" 2>/dev/null | cut -d':' -f2 | tr -d ' "' | head -c 100)
+                assigned_to=$(grep -m1 "^assigned_to:" "$task" 2>/dev/null | cut -d':' -f2 | tr -d ' "' | head -c 50)
 
                 task_id="${task_id:-$filename}"
 
@@ -114,20 +196,21 @@ check_new_pending_tasks() {
 # =============================================================================
 
 update_state() {
-    # Count tasks in each folder
-    local pending=$(find "$FORGE_ROOT/tasks/pending" -name "*.md" 2>/dev/null | wc -l)
-    local in_progress=$(find "$FORGE_ROOT/tasks/in-progress" -name "*.md" 2>/dev/null | wc -l)
-    local completed=$(find "$FORGE_ROOT/tasks/completed" -name "*.md" 2>/dev/null | wc -l)
-    local review=$(find "$FORGE_ROOT/tasks/review" -name "*.md" 2>/dev/null | wc -l)
-    local approved=$(find "$FORGE_ROOT/tasks/approved" -name "*.md" 2>/dev/null | wc -l)
-    local needs_changes=$(find "$FORGE_ROOT/tasks/needs-changes" -name "*.md" 2>/dev/null | wc -l)
-    local merged=$(find "$FORGE_ROOT/tasks/merged" -name "*.md" 2>/dev/null | wc -l)
-
-    # Calculate blocked (tasks with blocked_by in frontmatter that aren't resolved)
+    # Count tasks in each folder (using find with -maxdepth for safety)
+    local pending in_progress completed review approved needs_changes merged
+    pending=$(find "$FORGE_ROOT/$TASKS_PENDING" -maxdepth 1 -name "*.md" -type f 2>/dev/null | wc -l)
+    in_progress=$(find "$FORGE_ROOT/$TASKS_IN_PROGRESS" -maxdepth 1 -name "*.md" -type f 2>/dev/null | wc -l)
+    completed=$(find "$FORGE_ROOT/$TASKS_COMPLETED" -maxdepth 1 -name "*.md" -type f 2>/dev/null | wc -l)
+    review=$(find "$FORGE_ROOT/$TASKS_REVIEW" -maxdepth 1 -name "*.md" -type f 2>/dev/null | wc -l)
+    approved=$(find "$FORGE_ROOT/$TASKS_APPROVED" -maxdepth 1 -name "*.md" -type f 2>/dev/null | wc -l)
+    needs_changes=$(find "$FORGE_ROOT/$TASKS_NEEDS_CHANGES" -maxdepth 1 -name "*.md" -type f 2>/dev/null | wc -l)
+    merged=$(find "$FORGE_ROOT/$TASKS_MERGED" -maxdepth 1 -name "*.md" -type f 2>/dev/null | wc -l)
+
     local blocked=0
 
-    # Write state file
-    cat > "$STATE_FILE" << EOF
+    # Write state file atomically (write to temp, then move)
+    local temp_state="${STATE_FILE}.tmp.$$"
+    cat > "$temp_state" << EOF
 # Vibe Forge State
 # Auto-updated by forge-daemon
 # Last updated: $(date -Iseconds)
@@ -148,26 +231,29 @@ tasks:
 
 last_updated: $(date -Iseconds)
 EOF
+    mv "$temp_state" "$STATE_FILE"
 }
 
 route_completed_to_review() {
     # Move completed tasks to review queue
-    for task in "$FORGE_ROOT/tasks/completed"/*.md; do
-        if [[ -f "$task" ]]; then
-            local filename=$(basename "$task")
+    for task in "$FORGE_ROOT/$TASKS_COMPLETED"/*.md; do
+        if [[ -f "$task" && ! -L "$task" ]]; then
+            local filename
+            filename=$(basename "$task")
             echo "[$(date -Iseconds)] Routing $filename to review" >> "$LOG_FILE"
-            mv "$task" "$FORGE_ROOT/tasks/review/"
+            safe_move_task "$task" "$FORGE_ROOT/$TASKS_REVIEW"
         fi
     done
 }
 
 route_approved_to_merged() {
     # Move approved tasks to merged archive
-    for task in "$FORGE_ROOT/tasks/approved"/*.md; do
-        if [[ -f "$task" ]]; then
-            local filename=$(basename "$task")
+    for task in "$FORGE_ROOT/$TASKS_APPROVED"/*.md; do
+        if [[ -f "$task" && ! -L "$task" ]]; then
+            local filename
+            filename=$(basename "$task")
             echo "[$(date -Iseconds)] Archiving $filename to merged" >> "$LOG_FILE"
-            mv "$task" "$FORGE_ROOT/tasks/merged/"
+            safe_move_task "$task" "$FORGE_ROOT/$TASKS_MERGED"
         fi
     done
 }
@@ -175,7 +261,17 @@ route_approved_to_merged() {
 daemon_loop() {
     echo "[$(date -Iseconds)] Forge daemon started (PID: $$)" >> "$LOG_FILE"
 
+    # Create lock file
+    echo $$ > "$LOCK_FILE"
+
+    # Cleanup on exit
+    trap 'rm -f "$LOCK_FILE"; echo "[$(date -Iseconds)] Daemon exiting" >> "$LOG_FILE"' EXIT
+
+    local iteration=0
     while true; do
+        # Increment iteration counter
+        ((iteration++)) || true
+
         # Check for new tasks and notify
         check_new_pending_tasks
 
@@ -186,6 +282,13 @@ daemon_loop() {
         # Update state
         update_state
 
+        # Periodic maintenance (every 100 iterations = ~3 minutes)
+        if [[ $((iteration % 100)) -eq 0 ]]; then
+            rotate_log_if_needed "$LOG_FILE"
+            rotate_log_if_needed "$NOTIFY_FILE"
+            trim_notified_file
+        fi
+
         sleep "$POLL_INTERVAL"
     done
 }
@@ -197,7 +300,8 @@ daemon_loop() {
 cmd_start() {
     # Check if already running
     if [[ -f "$PID_FILE" ]]; then
-        local pid=$(cat "$PID_FILE")
+        local pid
+        pid=$(cat "$PID_FILE")
         if kill -0 "$pid" 2>/dev/null; then
             echo "Daemon already running (PID: $pid)"
             return 0
@@ -207,22 +311,36 @@ cmd_start() {
         fi
     fi
 
-    # Create directories if needed
+    # Check for lock file (another instance check)
+    if [[ -f "$LOCK_FILE" ]]; then
+        local lock_pid
+        lock_pid=$(cat "$LOCK_FILE" 2>/dev/null)
+        if kill -0 "$lock_pid" 2>/dev/null; then
+            echo "Another daemon instance is running (PID: $lock_pid)"
+            return 1
+        else
+            rm -f "$LOCK_FILE"
+        fi
+    fi
+
+    # Create directories if needed (with secure permissions)
     mkdir -p "$FORGE_ROOT/.forge"
-    mkdir -p "$FORGE_ROOT/tasks/pending"
-    mkdir -p "$FORGE_ROOT/tasks/in-progress"
-    mkdir -p "$FORGE_ROOT/tasks/completed"
-    mkdir -p "$FORGE_ROOT/tasks/review"
-    mkdir -p "$FORGE_ROOT/tasks/approved"
-    mkdir -p "$FORGE_ROOT/tasks/needs-changes"
-    mkdir -p "$FORGE_ROOT/tasks/merged"
+    chmod 700 "$FORGE_ROOT/.forge"
+
+    mkdir -p "$FORGE_ROOT/$TASKS_PENDING"
+    mkdir -p "$FORGE_ROOT/$TASKS_IN_PROGRESS"
+    mkdir -p "$FORGE_ROOT/$TASKS_COMPLETED"
+    mkdir -p "$FORGE_ROOT/$TASKS_REVIEW"
+    mkdir -p "$FORGE_ROOT/$TASKS_APPROVED"
+    mkdir -p "$FORGE_ROOT/$TASKS_NEEDS_CHANGES"
+    mkdir -p "$FORGE_ROOT/$TASKS_MERGED"
 
     # Start daemon in background
     daemon_loop &
     local pid=$!
     echo "$pid" > "$PID_FILE"
 
-    echo "🔥 Forge daemon started (PID: $pid)"
+    log_success "Forge daemon started (PID: $pid)"
     echo "   Log: $LOG_FILE"
 }
 
@@ -232,35 +350,41 @@ cmd_stop() {
         return 0
     fi
 
-    local pid=$(cat "$PID_FILE")
+    local pid
+    pid=$(cat "$PID_FILE")
 
     if kill -0 "$pid" 2>/dev/null; then
         kill "$pid"
-        rm -f "$PID_FILE"
+        rm -f "$PID_FILE" "$LOCK_FILE"
         echo "[$(date -Iseconds)] Forge daemon stopped" >> "$LOG_FILE"
-        echo "Daemon stopped"
+        log_success "Daemon stopped"
     else
-        rm -f "$PID_FILE"
+        rm -f "$PID_FILE" "$LOCK_FILE"
         echo "Daemon was not running (stale PID file removed)"
     fi
 
     # Update state to show inactive
     if [[ -f "$STATE_FILE" ]]; then
-        sed -i 's/status: active/status: stopped/' "$STATE_FILE" 2>/dev/null || true
+        # Use sed carefully - different syntax on macOS vs Linux
+        if [[ "$(uname)" == "Darwin" ]]; then
+            sed -i '' 's/status: active/status: stopped/' "$STATE_FILE" 2>/dev/null || true
+        else
+            sed -i 's/status: active/status: stopped/' "$STATE_FILE" 2>/dev/null || true
+        fi
     fi
 }
 
 cmd_status() {
     echo ""
-    echo "🔥 Forge Daemon Status"
-    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    log_header "🔥 Forge Daemon Status"
 
     if [[ -f "$PID_FILE" ]]; then
-        local pid=$(cat "$PID_FILE")
+        local pid
+        pid=$(cat "$PID_FILE")
         if kill -0 "$pid" 2>/dev/null; then
-            echo "Status: Running (PID: $pid)"
+            log_success "Running (PID: $pid)"
         else
-            echo "Status: Stopped (stale PID file)"
+            log_warn "Stopped (stale PID file)"
         fi
     else
         echo "Status: Stopped"
@@ -277,7 +401,8 @@ cmd_status() {
 
     # Show recent notifications
     if [[ -f "$NOTIFY_FILE" ]]; then
-        local notify_count=$(wc -l < "$NOTIFY_FILE" 2>/dev/null || echo "0")
+        local notify_count
+        notify_count=$(wc -l < "$NOTIFY_FILE" 2>/dev/null || echo "0")
         if [[ "$notify_count" -gt 0 ]]; then
             echo "Recent Notifications (last 5):"
             tail -5 "$NOTIFY_FILE" | sed 's/^/  /'
@@ -290,8 +415,7 @@ cmd_status() {
 
 cmd_notifications() {
     echo ""
-    echo "🔔 Forge Notifications"
-    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    log_header "🔔 Forge Notifications"
 
     if [[ -f "$NOTIFY_FILE" ]]; then
         local count="${1:-10}"
@@ -308,7 +432,7 @@ cmd_notifications() {
 
 cmd_clear_notifications() {
     rm -f "$NOTIFY_FILE" "$NOTIFIED_FILE"
-    echo "Notifications cleared."
+    log_success "Notifications cleared"
 }
 
 # =============================================================================

package/bin/forge-setup.sh

@@ -11,12 +11,12 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FORGE_ROOT="$(dirname "$SCRIPT_DIR")"
 
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
+# =============================================================================
+# Load Shared Libraries
+# =============================================================================
+
+# shellcheck source=lib/colors.sh
+source "$SCRIPT_DIR/lib/colors.sh"
 
 # Parse arguments
 NON_INTERACTIVE=false

package/bin/forge-spawn.sh

@@ -16,33 +16,23 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 FORGE_ROOT="$(dirname "$SCRIPT_DIR")"
 CONFIG_FILE="$FORGE_ROOT/.forge/config.json"
 
-# Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m'
-
 # =============================================================================
-# Load Configuration
+# Load Shared Libraries
 # =============================================================================
 
-load_config() {
-    if [[ ! -f "$CONFIG_FILE" ]]; then
-        echo -e "${RED}Error: Vibe Forge not initialized.${NC}"
-        echo "Run 'forge init' first."
-        exit 1
-    fi
-
-    PLATFORM=$(grep -o '"platform": *"[^"]*"' "$CONFIG_FILE" | cut -d'"' -f4)
-    TERMINAL_TYPE=$(grep -o '"terminal_type": *"[^"]*"' "$CONFIG_FILE" | cut -d'"' -f4)
-    GIT_BASH_PATH=$(grep -o '"git_bash_path": *"[^"]*"' "$CONFIG_FILE" | cut -d'"' -f4)
+# shellcheck source=lib/colors.sh
+source "$SCRIPT_DIR/lib/colors.sh"
+# shellcheck source=lib/constants.sh
+source "$SCRIPT_DIR/lib/constants.sh"
+# shellcheck source=lib/config.sh
+source "$SCRIPT_DIR/lib/config.sh"
+# shellcheck source=lib/agents.sh
+source "$SCRIPT_DIR/lib/agents.sh"
 
-    # Default to manual if not set
-    if [[ -z "$TERMINAL_TYPE" ]]; then
-        TERMINAL_TYPE="manual"
-    fi
-}
+# Load agent configuration from JSON if available
+if [[ -f "$FORGE_ROOT/$AGENTS_CONFIG" ]]; then
+    load_agents_from_json "$FORGE_ROOT/$AGENTS_CONFIG" 2>/dev/null || true
+fi
 
 # =============================================================================
 # Spawn Functions
@@ -51,20 +41,24 @@ load_config() {
 spawn_windows_terminal() {
     local agent="$1"
 
-    echo -e "${BLUE}Spawning $agent in Windows Terminal...${NC}"
+    log_info "Spawning $agent in Windows Terminal..."
 
     if command -v wt &> /dev/null || command -v wt.exe &> /dev/null; then
+        # Get display name for tab title
+        local display_name
+        display_name=$(get_agent_display_name "$agent")
+
         # Windows Terminal: open new tab with forge command
-        # Use Git Bash if available, otherwise use bash
+        # SECURITY: $agent has already been validated through resolve_agent
         if [[ -n "$GIT_BASH_PATH" ]]; then
             local bash_path="${GIT_BASH_PATH//\//\\}"
-            wt.exe new-tab --title "$agent" "$bash_path" -c "cd '$FORGE_ROOT' && ./bin/forge.sh start $agent"
+            wt.exe new-tab --title "$display_name" "$bash_path" -c "cd '$FORGE_ROOT' && ./bin/forge.sh start '$agent'"
         else
-            wt.exe new-tab --title "$agent" bash -c "cd '$FORGE_ROOT' && ./bin/forge.sh start $agent"
+            wt.exe new-tab --title "$display_name" bash -c "cd '$FORGE_ROOT' && ./bin/forge.sh start '$agent'"
         fi
-        echo -e "${GREEN}✅ $agent spawned in new Windows Terminal tab${NC}"
+        log_success "$display_name spawned in new Windows Terminal tab"
     else
-        echo -e "${RED}Error: wt command not found.${NC}"
+        log_error "wt command not found."
         echo "Make sure Windows Terminal is installed."
         echo ""
         echo "Manual fallback:"
@@ -75,9 +69,11 @@ spawn_windows_terminal() {
 
 print_manual_instructions() {
     local agent="$1"
+    local display_name
+    display_name=$(get_agent_display_name "$agent")
 
     echo ""
-    echo -e "${YELLOW}To start $agent manually:${NC}"
+    log_info "To start $display_name manually:"
     echo ""
     echo "  1. Open a new terminal window/tab"
     echo "  2. Navigate to: $FORGE_ROOT"
@@ -85,7 +81,7 @@ print_manual_instructions() {
     echo ""
     echo "Or copy this command:"
     echo ""
-    echo "  cd '$FORGE_ROOT' && ./bin/forge.sh start $agent"
+    echo "  cd '$FORGE_ROOT' && ./bin/forge.sh start '$agent'"
     echo ""
 }
 
@@ -97,34 +93,38 @@ main() {
     local agent="${1:-}"
 
     if [[ -z "$agent" ]]; then
-        echo -e "${RED}Error: No agent specified.${NC}"
+        log_error "No agent specified."
         echo ""
         echo "Usage: forge-spawn.sh <agent-name>"
         echo ""
-        echo "Available agents:"
-        echo "  anvil     - Frontend Developer"
-        echo "  furnace   - Backend Developer"
-        echo "  crucible  - Tester / QA"
-        echo "  sentinel  - Code Reviewer"
-        echo "  scribe    - Documentation"
-        echo "  herald    - Release Manager"
-        echo "  ember     - DevOps"
-        echo "  aegis     - Security"
+        show_available_agents
         exit 1
     fi
 
-    load_config
+    # Resolve alias to canonical agent name (SECURITY: whitelist validation)
+    local resolved
+    resolved=$(resolve_agent "$agent") || {
+        log_error "Unknown agent: $agent"
+        echo ""
+        show_available_agents
+        exit 1
+    }
+
+    # Load config
+    require_forge_config "$FORGE_ROOT"
 
     echo ""
-    echo -e "${YELLOW}🔥 Forge Spawn: $agent${NC}"
-    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    log_header "🔥 Forge Spawn: $(get_agent_display_name "$resolved")"
+    if [[ "$agent" != "$resolved" ]]; then
+        echo "   (resolved from '$agent')"
+    fi
 
     case "$TERMINAL_TYPE" in
         "windows-terminal")
-            spawn_windows_terminal "$agent"
+            spawn_windows_terminal "$resolved"
             ;;
         *)
-            print_manual_instructions "$agent"
+            print_manual_instructions "$resolved"
             ;;
     esac
 }