chore: finish PowerShell script audit for issue #25

.gitattributes

@@ -1,2 +1,6 @@
 # Force LF for unix shell shims (macOS rejects CRLF shebangs)
 tests/claude text eol=lf
+
+*.ps1   text eol=lf
+*.psm1  text eol=lf
+*.psd1  text eol=lf

AGENTS.md

@@ -0,0 +1,7 @@
+<!-- dotbot:framework-protection -->
+## dotbot framework files (READ-ONLY)
+
+NEVER modify files under `.bot/` except `.bot/workspace/`.
+
+Framework files under `.bot/core/`, `.bot/hooks/`, `.bot/recipes/`, and `.bot/settings/*.default.json` are managed by dotbot. Direct edits are rejected by a pre-commit hook and detected by verification hooks. To update framework files, run `dotbot init --force`.
+<!-- /dotbot:framework-protection -->

GEMINI.md

@@ -0,0 +1,7 @@
+<!-- dotbot:framework-protection -->
+## dotbot framework files (READ-ONLY)
+
+NEVER modify files under `.bot/` except `.bot/workspace/`.
+
+Framework files under `.bot/core/`, `.bot/hooks/`, `.bot/recipes/`, and `.bot/settings/*.default.json` are managed by dotbot. Direct edits are rejected by a pre-commit hook and detected by verification hooks. To update framework files, run `dotbot init --force`.
+<!-- /dotbot:framework-protection -->

core/go.ps1

@@ -24,6 +24,7 @@ param(
     [switch]$Headless
 )
 
+Set-StrictMode -Version 3.0
 $ErrorActionPreference = "Stop"
 
 # Get directories
@@ -69,6 +70,7 @@ $uiPortFile = Join-Path $controlDir "ui-port"
 if (Test-Path $uiPortFile) {
     $existingPort = (Get-Content $uiPortFile -Raw).Trim()
     if ($existingPort -match '^\d+$') {
+        $url = $null
         try {
             $resp = Invoke-WebRequest -Uri "http://localhost:$existingPort/api/info" -TimeoutSec 2 -ErrorAction Stop
             if ($resp.StatusCode -eq 200) {

core/hooks/dev/Start-Dev.ps1

@@ -1,4 +1,8 @@
 #!/usr/bin/env pwsh
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # ═══════════════════════════════════════════════════════════════
 # FRAMEWORK FILE — DO NOT MODIFY IN TARGET PROJECTS
 # Managed by dotbot. Overwritten on 'dotbot init --force'.

core/hooks/dev/Stop-Dev.ps1

@@ -1,4 +1,8 @@
 #!/usr/bin/env pwsh
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # ═══════════════════════════════════════════════════════════════
 # FRAMEWORK FILE — DO NOT MODIFY IN TARGET PROJECTS
 # Managed by dotbot. Overwritten on 'dotbot init --force'.

core/hooks/scripts/commit-bot-state.ps1

@@ -1,4 +1,8 @@
 #!/usr/bin/env pwsh
+
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # ═══════════════════════════════════════════════════════════════
 # FRAMEWORK FILE — DO NOT MODIFY IN TARGET PROJECTS
 # Managed by dotbot. Overwritten on 'dotbot init --force'.

core/hooks/scripts/steering.ps1

@@ -40,6 +40,9 @@ param(
     [string]$Priority = 'normal'
 )
 
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # Import theme for consistent output
 $themePath = Join-Path $PSScriptRoot "../../core/runtime/modules/DotBotTheme.psm1"
 if (Test-Path $themePath) {
@@ -62,6 +65,7 @@ function Get-RunningProcesses {
     if (Test-Path $processesDir) {
         $procFiles = Get-ChildItem -Path $processesDir -Filter "*.json" -File -ErrorAction SilentlyContinue
         foreach ($pf in $procFiles) {
+            $proc = $null
             try {
                 $proc = Get-Content $pf.FullName -Raw | ConvertFrom-Json
                 if ($proc.status -eq 'running') {

core/hooks/verify/00-privacy-scan.ps1

@@ -8,6 +8,9 @@ param(
     [switch]$StagedOnly
 )
 
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # Scan repo for sensitive data before commit
 $issues = @()
 $details = @{

core/hooks/verify/01-git-clean.ps1

@@ -7,6 +7,9 @@ param(
     [string]$Category
 )
 
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # Check for uncommitted changes outside .bot/
 $issues = @()
 $warnings = @()

core/hooks/verify/02-git-pushed.ps1

@@ -7,6 +7,9 @@ param(
     [string]$Category
 )
 
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # Check for unpushed commits
 $issues = @()
 $details = @{}

core/hooks/verify/03-check-md-refs.ps1

@@ -9,6 +9,9 @@ param(
     [string]$RepoRoot
 )
 
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # Validate .bot/recipes/, .bot/workflows/.../recipes/, and .bot/core/ path
 # references in markdown, JSON, and YAML source files against the actual
 # source tree.

core/hooks/verify/04-framework-integrity.ps1

@@ -7,6 +7,9 @@ param(
     [string]$Category
 )
 
+Set-StrictMode -Version 3.0
+$ErrorActionPreference = "Stop"
+
 # Framework integrity verify hook.
 # Detects modifications to .bot/ files that should only change via
 # `dotbot init --force`. Combines a SHA256 manifest check (catches

core/init.ps1

@@ -21,6 +21,7 @@
 [CmdletBinding()]
 param()
 
+Set-StrictMode -Version 3.0
 $ErrorActionPreference = "Stop"
 
 # Get script and project directories
@@ -42,6 +43,7 @@ $providerDirs = @(
 $providerConfigs = @{}
 if (Test-Path $ProvidersDir) {
     Get-ChildItem $ProvidersDir -Filter "*.json" | ForEach-Object {
+        $config = $null
         try {
             $config = Get-Content $_.FullName -Raw | ConvertFrom-Json
             $providerConfigs[$config.name] = $config

core/mcp/Resolve-ProjectRoot.ps1

@@ -27,6 +27,9 @@ function Resolve-DotbotProjectRoot {
         [string]$StartPath
     )
 
+    Set-StrictMode -Version 3.0
+    $ErrorActionPreference = "Stop"
+
     if (-not (Test-Path -LiteralPath $StartPath)) {
         return $null
     }

core/mcp/dotbot-mcp-helpers.ps1

@@ -4,13 +4,14 @@
 .DESCRIPTION
     Shared utility functions for JSON-RPC communication and date parsing
 #>
-
-
 function Write-JsonRpcResponse {
     param(
         [Parameter(Mandatory)]
         [object]$Response
     )
+
+    Set-StrictMode -Version 3.0
+    $ErrorActionPreference = "Stop"
 
     try {
         $json = $Response | ConvertTo-Json -Depth 100 -Compress
@@ -42,6 +43,10 @@ function Write-JsonRpcError {
 
         [object]$Data = $null
     )
+
+
+    Set-StrictMode -Version 3.0
+    $ErrorActionPreference = "Stop"
 
     $error = @{
         jsonrpc = '2.0'
@@ -64,6 +69,10 @@ function Get-DateFromString {
         [string]$DateString,
         [string]$Format = $null
     )
+
+
+    Set-StrictMode -Version 3.0
+    $ErrorActionPreference = "Stop"
 
     if ([string]::IsNullOrWhiteSpace($DateString)) {
         return [DateTime]::Now

core/mcp/dotbot-mcp.ps1

@@ -15,6 +15,7 @@
 [CmdletBinding()]
 param()
 
+Set-StrictMode -Version 3.0
 $ErrorActionPreference = 'Stop'
 $InformationPreference = 'SilentlyContinue'
 $ProgressPreference = 'SilentlyContinue'
@@ -93,10 +94,11 @@ foreach ($toolDirItem in $toolDirs) {
     $metadataPath = Join-Path $toolDir "metadata.yaml"
 
     if ((Test-Path $scriptPath) -and (Test-Path $metadataPath)) {
+        $toolMetadata = $null
         try {
             # Load tool script
             . $scriptPath
-            
+
             # Load tool metadata
             $toolMetadata = Get-Content $metadataPath -Raw | ConvertFrom-Yaml
 
@@ -125,6 +127,7 @@ if (Test-Path $workflowsDir) {
                 $scriptPath = Join-Path $toolDir "script.ps1"
                 $metadataPath = Join-Path $toolDir "metadata.yaml"
                 if ((Test-Path $scriptPath) -and (Test-Path $metadataPath)) {
+                    $toolMetadata = $null
                     try {
                         . $scriptPath
                         $toolMetadata = Get-Content $metadataPath -Raw | ConvertFrom-Yaml
@@ -221,6 +224,7 @@ function Invoke-CallTool {
         throw "Unknown tool: $Name"
     }
 
+    $result = $null
     try {
         # Convert tool name to function name: get_current_datetime -> Invoke-GetCurrentDateTime
         # ToUpperInvariant ensures Turkish/Azerbaijani locales don't fold "i" -> "İ".
@@ -258,6 +262,9 @@ function Start-McpServerLoop {
     [Console]::Error.WriteLine("Loaded $($tools.Count) tools")
 
     while ($true) {
+        $id = $null
+        $params = @{}
+        $toolName = $null
         try {
             $line = [Console]::ReadLine()
 
@@ -266,22 +273,24 @@ function Start-McpServerLoop {
             }
 
             $request = $line | ConvertFrom-Json -AsHashtable
-
-            $method = $request.method
-            $id = $request.id
-            $params = if ($request.params) { $request.params } else { @{} }
-
-            # Handle notifications (no id) separately
+
+            # Use ContainsKey/bracket access so optional JSON-RPC fields do not
+            # trigger PropertyNotFoundStrict under Set-StrictMode -Version 3.0.
+            $method = if ($request.ContainsKey('method')) { $request['method'] } else { $null }
+            $id = if ($request.ContainsKey('id')) { $request['id'] } else { $null }
+            $params = if ($request.ContainsKey('params')) { $request['params'] } else { @{} }
+
             if ($null -eq $id -and $method -like 'notifications/*') {
-                # Notifications don't require a response
                 continue
             }
-            
+
             $result = switch ($method) {
                 'initialize' { Invoke-Initialize -Params $params }
                 'tools/list' { Invoke-ListTools }
-                'tools/call' { 
-                    Invoke-CallTool -Name $params.name -Arguments $(if ($params.arguments) { $params.arguments } else { @{} })
+                'tools/call' {
+                    $toolName = if ($params.ContainsKey('name')) { $params['name'] } else { $null }
+                    $toolArgs = if ($params.ContainsKey('arguments')) { $params['arguments'] } else { @{} }
+                    Invoke-CallTool -Name $toolName -Arguments $toolArgs
                 }
                 default {
                     if ($null -ne $id) {

core/mcp/modules/Extract-CommitInfo.ps1

@@ -22,7 +22,6 @@
 .EXAMPLE
     Get-TaskCommitInfo -TaskId "7b012fb8" -MaxCommits 100
 #>
-
 function Get-TaskCommitInfo {
     [CmdletBinding()]
     param(
@@ -36,6 +35,9 @@ function Get-TaskCommitInfo {
         [string]$ProjectRoot = $PWD
     )
 
+    Set-StrictMode -Version 3.0
+    $ErrorActionPreference = "Stop"
+
     # Extract short task ID (first 8 characters)
     $shortTaskId = $TaskId.Substring(0, [Math]::Min(8, $TaskId.Length))
 
@@ -120,6 +122,9 @@ function Get-CommitFileChanges {
         [string]$CommitSha
     )
 
+    Set-StrictMode -Version 3.0
+    $ErrorActionPreference = "Stop"
+
     $created = @()
     $deleted = @()
     $modified = @()

core/mcp/modules/FrameworkIntegrity.psm1

@@ -262,6 +262,7 @@ function Invoke-FrameworkIntegrityGate {
         [string]$TaskId
     )
 
+    $integrity = $null
     Push-Location $ProjectRoot
     try {
         $integrity = Test-FrameworkIntegrity