modernize-harden

Run a security hardening pass on the legacy system: find vulnerabilities, rank them, and produce a reviewable patch for the critical ones. $system is the first argument; flags go after it (<system> --show-secrets), since a flag in first place would be read as the system name. The code is legacy/$system, often a symlink to where it really lives: say where it points (readlink legacy/$system) in one line before you start. If legacy/$system does not exist, stop and say so: nothing can run without the code, so the fix is /code-modernization:modernize $system --source <path to the code>. Run every subagent in the foreground and wait for its result: never end your turn while one is still running.

This command never edits legacy/$system: it writes findings and a proposed patch to analysis/$system/, and the user reviews and applies (or not).

Step 0 — Secrets quarantine

Findings get shared, committed and pasted into decks, so discovered credential values never land in them. Before scanning:

1. Ensure analysis/.gitignore contains SECRETS.local.md and *.local.patch (create or append).
2. In a git repo, verify with git check-ignore -q analysis/$system/SECRETS.local.md; if that exits non-zero, fix the rule first. write_to_file no findings until it passes.
3. With no git repo (check .svn, .hg, CVS too: a .gitignore protects nothing under another VCS), refuse --show-secrets and write SECRETS.local.md and any .local.patch to ~/.modernize/$system/, telling the user where and why.