forgedock 1.1.10 → 1.1.11

package/bin/forgedock.mjs

@@ -28,6 +28,7 @@ import {
   parseInstallTier,
   writeForgeYaml,
   backupExisting,
+  backfillForgeYaml,
   manualLowConfidenceKeys,
   isEphemeralCachePath,
   writeInstallReceipt,
@@ -1874,6 +1875,16 @@ async function doctor(fix = false) {
    * Reuses forge() (bin/journey.mjs) verbatim — the same repair path already
    * used by `npx forgedock update` (see relinkAndHint()) — rather than
    * duplicating symlink/copy-mode or hook-registration logic here.
+   *
+   * NOTE: `installRepairRan` only memoizes whether the repair primitive
+   * itself has executed during this invocation — it is a cross-check flag
+   * by necessity (any of the three checks below can trigger it, and it must
+   * not re-run for the other two). It must NOT be read by an individual
+   * check to decide whether THAT check was fixed — a check that was already
+   * healthy before a sibling check triggered repair would incorrectly
+   * report "repaired" too. Each check below tracks its own pre-repair
+   * broken state in a local `*WasBroken` variable for that decision instead.
+   * (forge#1975)
    */
   let installRepairRan = false;
   async function runInstallRepairOnce() {
@@ -1954,7 +1965,9 @@ async function doctor(fix = false) {
     }
 
     let cmdFiles = await detectCommandFiles();
+    let cmdFilesWasBroken = false;
     if (!cmdFiles.error && !cmdFiles.ok && fix) {
+      cmdFilesWasBroken = true;
       await runInstallRepairOnce();
       cmdFiles = await detectCommandFiles();
     }
@@ -1962,7 +1975,7 @@ async function doctor(fix = false) {
     if (cmdFiles.error) {
       fail("Command files", `Could not read commands directory: ${cmdFiles.error}`);
     } else if (cmdFiles.ok) {
-      if (fix && installRepairRan) {
+      if (fix && cmdFilesWasBroken) {
         fixed("Command files", `${cmdFiles.checked} files installed (repaired)`);
       } else {
         pass("Command files", `${cmdFiles.checked} files installed`);
@@ -2153,7 +2166,9 @@ async function doctor(fix = false) {
     }
 
     let hookReg = detectSessionStartHookRegistered();
+    let hookRegWasBroken = false;
     if (!hookReg.error && !hookReg.ok && fix) {
+      hookRegWasBroken = true;
       await runInstallRepairOnce();
       hookReg = detectSessionStartHookRegistered();
     }
@@ -2161,7 +2176,7 @@ async function doctor(fix = false) {
     if (hookReg.error) {
       fail("SessionStart hook", `Cannot read ~/.claude/settings.json: ${hookReg.error}. Run: npx forgedock install`);
     } else if (hookReg.ok) {
-      if (fix && installRepairRan) {
+      if (fix && hookRegWasBroken) {
         fixed("SessionStart hook", "registered in ~/.claude/settings.json (repaired)");
       } else {
         pass("SessionStart hook", "registered in ~/.claude/settings.json");
@@ -2221,7 +2236,9 @@ async function doctor(fix = false) {
   // ever surfaced. This check catches that silent-failure case. (forge#1895)
   {
     let hookPathResult = detectSessionStartHookPath();
+    let hookPathWasBroken = false;
     if (hookPathResult.state === "dangling" && fix) {
+      hookPathWasBroken = true;
       await runInstallRepairOnce();
       hookPathResult = detectSessionStartHookPath();
     }
@@ -2237,7 +2254,7 @@ async function doctor(fix = false) {
         `Could not parse a script path out of the registered hook command ("${hookPathResult.command}"). Run: npx forgedock install`,
       );
     } else if (hookPathResult.state === "ok") {
-      if (fix && installRepairRan) {
+      if (fix && hookPathWasBroken) {
         fixed("SessionStart hook script path", `refreshed to a valid path (${hookPathResult.path})`);
       } else {
         pass("SessionStart hook script path", `exists on disk (${hookPathResult.path})`);
@@ -2709,12 +2726,14 @@ function help() {
     ["npx forgedock resume-stalled [--dry-run]", "Fleet stall recovery — re-dispatch expired-lease issues"],
     ["npx forgedock demo", "Set up a risk-free demo repo and print next steps"],
     ["npx forgedock labels [setup] [--repo owner/repo]", "Bootstrap ForgeDock-managed labels on a GitHub repo (idempotent)"],
+    ["npx forgedock config migrate [dir]", "Backfill missing optional sections into an existing forge.yaml (idempotent)"],
     ["npx forgedock watch [--repo owner/repo]", "Live per-agent orchestration view (Ctrl+C to exit)"],
     ["npx forgedock report [--days 30] [--md] [--json]", "30-day pipeline impact receipts for your repo"],
     ["npx forgedock doctor", "Check installation health"],
     ["npx forgedock doctor --fix", "Auto-fix deterministic issues (symlinks, hook, labels, legacy block)"],
     ["npx forgedock update", "Pull latest & reinstall"],
     ["npx forgedock uninstall", "Remove commands"],
+    ["npx forgedock version", "Print the installed version and check for updates"],
     ["npx forgedock help", "Show this help"],
   ];
   const flagRows = [
@@ -2723,6 +2742,7 @@ function help() {
     ["--manual", "Plain text prompts instead of the review screen (init)"],
     ["--verbose", "Show detection sources for every field (init)"],
     ["--minimal", "Generate a minimal forge.yaml with required sections only (init)"],
+    ["--version, -v", "Print the installed version and check for updates"],
   ];
 
   process.stdout.write(
@@ -3051,7 +3071,8 @@ async function watch() {
 const SPLASH_COMMANDS = new Set(["run", "run-issue", "resume-stalled", "demo", "doctor", "watch", "help", "--help", "-h"]);
 const KNOWN_COMMANDS = new Set([
   "install", "init", "enable", "disable", "status", "uninstall", "update",
-  "run", "run-issue", "resume-stalled", "demo", "doctor", "watch", "labels", "help", "--help", "-h",
+  "run", "run-issue", "resume-stalled", "demo", "doctor", "watch", "labels", "config", "help", "--help", "-h",
+  "version", "--version", "-v",
 ]);
 if (SPLASH_COMMANDS.has(command) || !KNOWN_COMMANDS.has(command)) splash(command);
 
@@ -3200,6 +3221,60 @@ switch (command) {
     }
     break;
   }
+  case "config": {
+    const subcommand = positional[1];
+    if (subcommand === "migrate") {
+      // Directory override mirrors `status [dir]` — defaults to cwd.
+      const dir = positional[2] ? resolve(positional[2]) : process.cwd();
+      const result = backfillForgeYaml(dir);
+      if (!result.present) {
+        console.log(
+          `${RED}No forge.yaml found in ${dir}.${RESET}\n` +
+            `  Run ${cyan("npx forgedock init")} to generate one.`,
+        );
+        exitCode = 1;
+      } else if (result.added.length === 0) {
+        console.log(
+          `${GREEN}forge.yaml already has all ${result.alreadyPresent.length} optional sections.${RESET} Nothing to migrate.`,
+        );
+      } else {
+        console.log(`${GREEN}Backfilled ${result.added.length} missing optional section(s) into forge.yaml:${RESET}`);
+        for (const key of result.added) console.log(`  ${GREEN}+${RESET} ${key}`);
+        console.log(`\n  Sections already present (unchanged): ${result.alreadyPresent.join(", ") || "none"}`);
+        console.log(`\n  All added sections are commented out — edit forge.yaml to enable the ones you need.`);
+      }
+    } else {
+      console.log(`${RED}Unknown config subcommand: ${subcommand ?? "(none)"}${RESET}`);
+      console.log(
+        `Usage: ${CYAN}npx forgedock config migrate [dir]${RESET}\n` +
+          `  Backfills any of the 16 optional forge.yaml sections missing from an existing config (idempotent).`,
+      );
+      exitCode = 1;
+    }
+    break;
+  }
+  case "version":
+  case "--version":
+  case "-v": {
+    // Print the local version immediately — must work offline/instantly,
+    // no network dependency for the primary output (getVersion() reads
+    // package.json off disk only). The latest-version check below is
+    // best-effort: fetchLatestVersion() has its own 5s timeout and never
+    // rejects, so a slow/offline network never blocks or fails this
+    // command. Mirrors the version-check message pattern already used by
+    // update() (see the npm/npx branch above).
+    const localVersion = getVersion();
+    console.log(`forgedock ${localVersion ? `v${localVersion}` : `${YELLOW}version unknown${RESET}`}`);
+
+    const latestVersion = await fetchLatestVersion();
+    if (latestVersion && localVersion && compareVersions(latestVersion, localVersion) > 0) {
+      console.log(
+        `  ${GREEN}New version available: v${latestVersion}${RESET} (you have v${localVersion}). ` +
+          `Run ${CYAN}npx forgedock update${RESET} to fetch it.`,
+      );
+    }
+    break;
+  }
   case "help":
   case "--help":
   case "-h":

package/bin/init-detect.mjs

@@ -283,7 +283,7 @@ export function resolveGitRoot(cwd) {
     if (toplevel) {
       const resolved = resolve(toplevel) !== resolve(cwd);
       return {
-        root: resolved ? toplevel : cwd,
+        root: resolved ? resolve(toplevel) : cwd,
         resolved,
         why: `'${cwd}' is nested inside a git repository rooted at '${toplevel}'`,
       };

package/bin/journey.mjs

@@ -23,6 +23,242 @@ function todo(key, low) {
   return low.includes(key) ? `  # TODO(forgedock:${key}) — verify this value` : "";
 }
 
+/**
+ * Ordered list of the 16 optional forge.yaml sections. Each entry is a
+ * self-contained, fully-commented stub block (banner + example content).
+ * This is the single source of truth for optional-section text, shared by
+ * writeForgeYaml() (full-file generation for `npx forgedock init`) and
+ * backfillForgeYaml() (append-only migration for existing files, #1982) —
+ * keeping the two paths from drifting apart the same way full-generation
+ * itself drifted from forge.yaml.example before #1983.
+ *
+ * `key` is the top-level YAML key the section introduces (used by
+ * backfillForgeYaml() to detect whether a section is already present).
+ * `block(v)` renders the stub text; blocks never end with a trailing
+ * newline of their own — callers join them with `"\n\n"` to reproduce the
+ * blank-line separation between sections.
+ * @type {Array<{ key: string, block: (v: object) => string }>}
+ */
+const OPTIONAL_SECTIONS = [
+  {
+    key: "agents",
+    block: () => `# =============================================================================
+# AGENTS (OPTIONAL) — model overrides for pipeline agents.
+# Commands: all commands with an "Agent model policy" line
+# =============================================================================
+
+# agents:
+#   default_model: "sonnet"      # main orchestrator/agent model: "sonnet" | "opus" | "haiku"
+#   subagent_model: "sonnet"     # model for child sub-agents (orchestrate, review-pr, ...)`,
+  },
+  {
+    key: "repos",
+    block: (v) => `# =============================================================================
+# REPOS (OPTIONAL) — multi-repo configuration. Remove the # to enable.
+# =============================================================================
+
+# repos:
+#   default:
+#     repo: "${esc(v.owner)}/${esc(v.repo)}"
+#     staging_branch: "${esc(v.stagingBranch)}"
+#   satellites:
+#     - prefix: "mcp"
+#       repo: "${esc(v.owner)}/your-satellite-repo"
+#       staging_branch: "main"`,
+  },
+  {
+    key: "project_board",
+    block: (v) => `# =============================================================================
+# PROJECT BOARD (OPTIONAL) — GitHub Projects v2 integration.
+# To find IDs: gh project list --owner ${esc(v.owner)}
+# =============================================================================
+
+# project_board:
+#   owner: "${esc(v.owner)}"
+#   project_number: 1
+#   project_id: "PVT_kwHOxxxxxxxxxxxxxxxx"
+#   field_ids:
+#     status: "PVTSSF_xxxxxxxxxxxxxxxxxxxxxxxx"`,
+  },
+  {
+    key: "pipeline",
+    block: () => `# =============================================================================
+# PIPELINE (OPTIONAL) — tuning knobs for the /orchestrate batch engine.
+# Commands: orchestrate
+# =============================================================================
+
+# pipeline:
+#   stall_timeout_minutes: 15        # minutes an agent may sit idle before auto-resume
+#   token_budget_per_batch: 900000   # per-batch token ceiling for the review-finding cascade
+#   token_estimate_per_finding: 150000
+#   narration: "terse"               # "terse" | "verbose"`,
+  },
+  {
+    key: "services",
+    block: () => `# =============================================================================
+# SERVICES (OPTIONAL) — external service URLs for analytics/monitoring/GEO audit.
+# Commands: analytics, geo-audit, autopilot (analytics snapshot)
+# =============================================================================
+
+# services:
+#   domain: "acme.io"
+#   gsc_property: "https://acme.io"
+#   app_url: "https://acme.io"
+#   api_url: "https://api.acme.io"
+#   analytics:
+#     umami:
+#       url: "https://umami.acme.io"
+#       website_id: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
+#     clarity:
+#       project_id: "xxxxxxxxxx"
+#     ga4:
+#       property_id: "000000000"`,
+  },
+  {
+    key: "review",
+    block: () => `# =============================================================================
+# REVIEW (OPTIONAL) — context injected into review agent prompts.
+# =============================================================================
+
+# review:
+#   tech_stack: "Node.js, TypeScript, PostgreSQL"
+#   context: |
+#     Describe your repo structure and any unusual conventions here.`,
+  },
+  {
+    key: "verification",
+    block: () => `# =============================================================================
+# VERIFICATION (OPTIONAL) — health checks for quality gate / validate.
+# =============================================================================
+
+# verification:
+#   health_endpoint: "https://api.example.com/health"
+#   health_patterns:
+#     - '"status": "ok"'`,
+  },
+  {
+    key: "deploy",
+    block: () => `# =============================================================================
+# DEPLOY (OPTIONAL) — deployment model configuration.
+# Commands: deploy-info, incident-response, rollback, work-on (Phase 3J)
+# =============================================================================
+
+# deploy:
+#   workflow: "deploy.yml"           # GitHub Actions workflow filename used to trigger deploys
+#   workflow_inputs:
+#     services: "services"
+#     reason: "reason"
+#   secrets_backend: "sops"          # sops | aws-sm | vault | ci-env | none`,
+  },
+  {
+    key: "autopilot",
+    block: () => `# =============================================================================
+# AUTOPILOT (OPTIONAL) — configuration for the /autopilot autonomous deploy loop.
+# Commands: autopilot
+# =============================================================================
+
+# autopilot:
+#   ops_issue_label: "autopilot-ops"
+#   headless: false                  # opt-in to unattended fixing; default: false
+#   approve:
+#     p0: needs-human
+#     p1: needs-human
+#     p2: auto
+#     p3: auto
+#   budget:
+#     per_cycle_fixes: 3
+#     per_cycle_tokens: null`,
+  },
+  {
+    key: "billing",
+    block: () => `# =============================================================================
+# BILLING (OPTIONAL) — financial integrity checks in /security-audit.
+# Commands: security-audit (Phase 4 — Financial Integrity)
+# =============================================================================
+
+# billing:
+#   enabled: false`,
+  },
+  {
+    key: "devdocs",
+    block: () => `# =============================================================================
+# DEVDOCS (OPTIONAL) — path to the devdocs knowledge tree.
+# Commands: docs init
+# =============================================================================
+
+# devdocs:
+#   path: "devdocs"`,
+  },
+  {
+    key: "adaptive_scripts",
+    block: () => `# =============================================================================
+# ADAPTIVE_SCRIPTS (OPTIONAL) — per-repo scripts ForgeDock learns and updates.
+# Commands: work-on (script discovery), optimize (script generation)
+# =============================================================================
+
+# adaptive_scripts:
+#   enabled: true
+#   directory: ".forgedock/scripts"
+#   commit: false`,
+  },
+  {
+    key: "learned",
+    block: () => `# =============================================================================
+# LEARNED (OPTIONAL) — agent-writable patterns captured across sessions.
+# Commands: work-on (Phase 0B reads; Phase 1D writes)
+# =============================================================================
+
+# learned:
+#   branch_targets:
+#     staging: "develop"
+#   test_commands:
+#     - "pnpm typecheck"
+#   label_map:
+#     "workflow:investigating": "needs-triage"
+#   commit_style: "conventional-with-scope"`,
+  },
+  {
+    key: "index",
+    block: () => `# =============================================================================
+# INDEX (OPTIONAL) — per-commit code index for scripts/code-index.sh.
+# Commands: work-on:investigate, work-on/build/architect, review-pr
+# =============================================================================
+
+# index:
+#   languages: "Python,JavaScript,TypeScript,Go"
+#   cache_dir: ".forge/index"
+#   enabled: true`,
+  },
+  {
+    key: "attribution",
+    block: () => `# =============================================================================
+# ATTRIBUTION (OPTIONAL) — opt-in growth features (PR/annotation footer links).
+# Commands: work-on/review, review-pr
+# =============================================================================
+
+# attribution:
+#   pr_footer: true
+#   annotation_link: true`,
+  },
+  {
+    key: "pattern_feeds",
+    block: () => `# =============================================================================
+# PATTERN_FEEDS (OPTIONAL) — subscribe to external pattern card repositories.
+# Commands: scripts/build-knowledge-index.mjs, quality-gate, optimize
+# =============================================================================
+
+# pattern_feeds:
+#   feeds:
+#     - slug: "forge-core"
+#       repo: "RapierCraftStudios/forge-patterns"
+#       ref: "abc1234def5678..."   # REQUIRED: pinned commit SHA — never a branch name
+#       path: "cards"
+#       stacks: ["node", "bash", "gha"]
+#       priority: "LOW"
+#   enabled: true`,
+  },
+];
+
 /**
  * Write forge.yaml from reviewed values.
  * @param {{owner:string,repo:string,name:string,description:string,root:string,
@@ -34,13 +270,15 @@ function todo(key, low) {
  */
 export function writeForgeYaml(v, lowConfidenceKeys, outputPath) {
   const low = lowConfidenceKeys;
-  const content = `# forge.yaml — ForgeDock Configuration
+  const header = `# forge.yaml — ForgeDock Configuration
 #
 # Auto-generated by: npx forgedock
 # Fields marked with TODO comments below were guessed — verify them.
 #
 # Required sections: project, paths, branches
-# Optional sections: repos, project_board, services, review, verification
+# Optional sections: agents, repos, project_board, pipeline, services, review,
+#   verification, deploy, autopilot, billing, devdocs, adaptive_scripts,
+#   learned, index, attribution, pattern_feeds
 #
 # See docs/CONFIG.md for full reference.
 
@@ -69,51 +307,9 @@ paths:
 branches:
   default: "${esc(v.defaultBranch)}"${todo("defaultBranch", low)}
   staging: "${esc(v.stagingBranch)}"${todo("stagingBranch", low)}
-  feature_pattern: "milestone/{slug}"
-
-# =============================================================================
-# REPOS (OPTIONAL) — multi-repo configuration. Remove the # to enable.
-# =============================================================================
-
-# repos:
-#   default:
-#     repo: "${esc(v.owner)}/${esc(v.repo)}"
-#     staging_branch: "${esc(v.stagingBranch)}"
-#   satellites:
-#     - prefix: "mcp"
-#       repo: "${esc(v.owner)}/your-satellite-repo"
-#       staging_branch: "main"
-
-# =============================================================================
-# PROJECT BOARD (OPTIONAL) — GitHub Projects v2 integration.
-# To find IDs: gh project list --owner ${esc(v.owner)}
-# =============================================================================
+  feature_pattern: "milestone/{slug}"`;
 
-# project_board:
-#   owner: "${esc(v.owner)}"
-#   project_number: 1
-#   project_id: "PVT_kwHOxxxxxxxxxxxxxxxx"
-#   field_ids:
-#     status: "PVTSSF_xxxxxxxxxxxxxxxxxxxxxxxx"
-
-# =============================================================================
-# REVIEW (OPTIONAL) — context injected into review agent prompts.
-# =============================================================================
-
-# review:
-#   tech_stack: "Node.js, TypeScript, PostgreSQL"
-#   context: |
-#     Describe your repo structure and any unusual conventions here.
-
-# =============================================================================
-# VERIFICATION (OPTIONAL) — health checks for quality gate / validate.
-# =============================================================================
-
-# verification:
-#   health_endpoint: "https://api.example.com/health"
-#   health_patterns:
-#     - '"status": "ok"'
-`;
+  const content = [header, ...OPTIONAL_SECTIONS.map((s) => s.block(v))].join("\n\n") + "\n";
   // Atomic write: write to a temp file first, then rename into place.
   // If the write fails (e.g. ENOSPC), the original file is untouched and
   // any partial .tmp is cleaned up — no corrupt or missing forge.yaml.
@@ -129,6 +325,79 @@ branches:
   return { todoCount };
 }
 
+/**
+ * Backfill any of the 16 optional forge.yaml sections missing from an
+ * existing config file (#1982). Additive only — never edits, reorders, or
+ * removes existing content. Required sections, already-present optional
+ * sections, and any hand-edited content are left byte-for-byte untouched;
+ * only trailing whitespace at the very end of the file is trimmed before
+ * appending. Follows the same atomic temp+rename write pattern as
+ * writeForgeYaml() (ref: #1396 — a non-atomic write here could corrupt the
+ * user's forge.yaml on disk-full).
+ *
+ * A section counts as "present" if its top-level key appears either active
+ * (`key:` at column 0 — the user enabled it) or as the standard commented
+ * stub (`# key:`) anywhere in the file. Detection is intentionally strict
+ * about indentation (no arbitrary leading whitespace) so a same-named key
+ * nested under an unrelated section can never produce a false "present".
+ *
+ * @param {string} cwd - directory containing forge.yaml
+ * @returns {{ present: boolean, added: string[], alreadyPresent: string[] }}
+ *   `present: false` means no forge.yaml exists at cwd — added/alreadyPresent
+ *   are both empty; the caller should direct the user to `npx forgedock init`
+ *   instead of migrate.
+ */
+export function backfillForgeYaml(cwd) {
+  const outputPath = join(cwd, "forge.yaml");
+  if (!existsSync(outputPath)) {
+    return { present: false, added: [], alreadyPresent: [] };
+  }
+  const raw = readFileSync(outputPath, "utf-8");
+
+  // Best-effort values for the blocks that interpolate project identity
+  // (repos/project_board examples) — read from the existing file's REQUIRED
+  // sections so backfilled examples reference this project rather than a
+  // generic placeholder. Falls back to placeholders if unset/unparseable;
+  // these only ever land inside commented-out example text.
+  const v = {
+    owner: raw.match(/^\s*owner:\s*"([^"]*)"/m)?.[1] || "your-org",
+    repo: raw.match(/^\s*repo:\s*"([^"]*)"/m)?.[1] || "your-repo",
+    stagingBranch: raw.match(/^\s*staging:\s*"([^"]*)"/m)?.[1] || "staging",
+  };
+
+  const added = [];
+  const alreadyPresent = [];
+  const newBlocks = [];
+  for (const section of OPTIONAL_SECTIONS) {
+    const isActive = new RegExp(`^${section.key}:`, "m").test(raw);
+    const isStub = new RegExp(`^#\\s?${section.key}:`, "m").test(raw);
+    if (isActive || isStub) {
+      alreadyPresent.push(section.key);
+    } else {
+      added.push(section.key);
+      newBlocks.push(section.block(v));
+    }
+  }
+
+  if (added.length === 0) {
+    return { present: true, added, alreadyPresent };
+  }
+
+  const trimmedRaw = raw.replace(/\s+$/, "");
+  const content = `${trimmedRaw}\n\n${newBlocks.join("\n\n")}\n`;
+
+  const tmpPath = outputPath + ".tmp";
+  try {
+    writeFileSync(tmpPath, content, "utf-8");
+    renameSync(tmpPath, outputPath);
+  } catch (err) {
+    try { unlinkSync(tmpPath); } catch { /* best-effort cleanup */ }
+    throw err;
+  }
+
+  return { present: true, added, alreadyPresent };
+}
+
 /** Maps manual-flow value keys to their location in a ConfigDraft. */
 const DRAFT_KEY_PATHS = {
   owner: ["project", "owner"],

package/commands/validate.md

@@ -147,10 +147,18 @@ INPUT_ISSUE=$(echo "$ARGUMENTS" | grep -oE '#?([0-9]+)' | grep -oE '[0-9]+' | he
 GH_FLAG=$(yq -r '"-R " + .project.owner + "/" + .project.repo' forge.yaml 2>/dev/null || echo "")
 
 if [ -n "$INPUT_ISSUE" ] && [ -n "$GH_FLAG" ]; then
-  ISSUE_LABELS=$(gh issue view "$INPUT_ISSUE" "$GH_FLAG" --json labels \
-    --jq '[.labels[].name] | join(",")' 2>/dev/null || echo "")
-
-  if echo "$ISSUE_LABELS" | grep -q "needs-validation"; then
+  # forge#1997: a bare `2>/dev/null || echo ""` here collapsed "fetch
+  # failed" and "fetch succeeded, issue has no labels" into the same empty
+  # string, so a failed fetch fell through to the "no needs-validation —
+  # no label transition needed" branch below, silently misreporting a
+  # transient API failure as a legitimate no-op. Use the same
+  # `if VAR=$(cmd); then ... else ... fi` idiom already applied to
+  # scripts/transition-label.sh (forge#1991) to keep the two outcomes
+  # distinguishable.
+  if ! ISSUE_LABELS=$(gh issue view "$INPUT_ISSUE" "$GH_FLAG" --json labels \
+    --jq '[.labels[].name] | join(",")' 2>/dev/null); then
+    echo "WARNING: needs-validation label fetch failed (transient network error / rate limit?) for issue #$INPUT_ISSUE — cannot determine finding-lifecycle state. Skipping label transition." >&2
+  elif echo "$ISSUE_LABELS" | grep -q "needs-validation"; then
     echo "Issue #$INPUT_ISSUE has needs-validation — applying verdict label transition..."
 
     # Map /validate verdict to transition-label.sh verdict format

package/commands/work-on/remediate.md

@@ -240,13 +240,21 @@ POST_REVIEW_LABELS=$(gh issue view {ISSUE_NUMBER} {GH_FLAG} --json labels --jq '
 **If `workflow:awaiting-merge` is present** (clean re-review case — the only branch where `review-pr.md`'s guard has already safely parked this PR): compute the bar.
 
 ```bash
+# Trust filter: only reviews/comments from repo collaborators (OWNER/MEMBER/COLLABORATOR
+# authorAssociation) can contribute to the auto-land bar. Unlike work-on.md Phase 7A's
+# informational-only APPROVED: count (a summary-card/decision-record annotation, not a
+# merge gate), this count directly drives `gh pr merge` below — so it must not trust
+# unauthenticated signal. Any GitHub user can comment "APPROVED: ..." on a public PR;
+# authorAssociation is GitHub's own repo-permission classification and cannot be spoofed
+# by comment text. (Ref: forge#1976)
 REVIEW_BODIES=$(gh pr view {PR_NUMBER} {GH_FLAG} --json reviews,comments \
-  --jq '[.reviews[].body // ""] + [.comments[].body // ""] | .[]')
+  --jq '[.reviews[] | select(.authorAssociation == "OWNER" or .authorAssociation == "MEMBER" or .authorAssociation == "COLLABORATOR") | .body // ""] +
+        [.comments[] | select(.authorAssociation == "OWNER" or .authorAssociation == "MEMBER" or .authorAssociation == "COLLABORATOR") | .body // ""] | .[]')
 APPROVED_COUNT=$(echo "$REVIEW_BODIES" | grep -cE 'APPROVED:' 2>/dev/null || true); APPROVED_COUNT=${APPROVED_COUNT:-0}
 ```
 
 **Auto-land bar** (per #1809 Q1) — BOTH conditions required:
-1. `APPROVED_COUNT >= 2` — at least two distinct adversarial `APPROVED:` review comments (same counting convention as `work-on.md` Phase 7A).
+1. `APPROVED_COUNT >= 2` — at least two distinct adversarial `APPROVED:` review comments from repo collaborators (`OWNER`/`MEMBER`/`COLLABORATOR` authorAssociation only — see trust filter above; same counting convention as `work-on.md` Phase 7A).
 2. `GATE_PASSED = true` from this remediation's own Phase M3 quality-gate loop.
 
 **If the bar is met**:

package/commands/work-on.md

@@ -382,7 +382,16 @@ if [[ "$ADAPTIVE_DIR" != "${REPO_PATH_NORM}/"* ]]; then
   echo "WARNING: adaptive_scripts.directory resolves outside repo root ('$ADAPTIVE_DIR') — adaptive tier disabled" >&2
   ADAPTIVE_ENABLED=false
 fi
-UNIVERSAL_DIR="${FORGEDOCK_HOME:-$(dirname "$(which classify-lane.sh 2>/dev/null || echo 'scripts')")}/scripts"
+UNIVERSAL_DIR="${FORGEDOCK_HOME:-$REPO_PATH}/scripts"
+# NOTE: never resolve this via `which` or `find` — universal scripts are
+# repo-relative, not installed on $PATH, so a PATH lookup always misses.
+# REPO_PATH is already resolved from forge.yaml → paths.root earlier in
+# Phase 0, so it is the deterministic fallback when FORGEDOCK_HOME is unset.
+# Pipeline agents MUST NOT use `find` (unbounded or filesystem-wide) to
+# locate pipeline scripts under any circumstances: if UNIVERSAL_DIR/${operation}.sh
+# does not exist, resolve_script() falls through to Tier 4 (prose) below,
+# which is always safe and available. A missing script is never a reason
+# to search the filesystem. <!-- Added: forge#1984 -->
 
 resolve_script() {
   local operation="$1"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgedock",
-  "version": "1.1.10",
+  "version": "1.1.11",
   "description": "Autonomous dev pipeline for Claude Code. GitHub as institutional memory — every issue, PR, and annotation survives context resets and makes the next agent smarter.",
   "bin": {
     "forgedock": "bin/forgedock.mjs"

package/scripts/danger-zones.mjs

@@ -349,7 +349,9 @@ function collectCommits(repoPath, sinceDate) {
     const reason = result.error
       ? result.error.message
       : `exit code ${result.status}${result.signal ? ` (signal ${result.signal})` : ''}`;
-    log(`WARNING: git log failed — ${reason}`);
+    const stderrDetail =
+      result.stderr && result.stderr.trim() ? ` — ${result.stderr.trim()}` : '';
+    log(`WARNING: git log failed — ${reason}${stderrDetail}`);
     return [];
   }
 

package/scripts/transition-label.sh

@@ -83,8 +83,25 @@ if [ "${1:-}" = "--validate" ]; then
   fi
 
   # Check if issue carries needs-validation (idempotent gate)
-  CURRENT_LABELS=$(gh issue view "$ISSUE_NUMBER" "${GH_ARGS[@]}" --json labels \
-    --jq '[.labels[].name] | join(",")' 2>/dev/null || echo "")
+  #
+  # forge#1991: a bare `2>/dev/null || echo ""` here collapsed "fetch
+  # failed" and "fetch succeeded, issue has no labels" into the same empty
+  # string, so a failed fetch fell through to the "no needs-validation —
+  # no action taken (idempotent)" branch below and exited 0, silently
+  # misreporting a transient API failure as successful idempotent no-op.
+  # Use the same `if VAR=$(cmd); then ... else ... fi` idiom already
+  # applied to the workflow-mode label fetches (forge#1977/#1988/#1990) to
+  # keep the two outcomes distinguishable. This block has no
+  # TRANSITION_EXIT_CODE deferred-exit convention (that only exists in the
+  # workflow-mode block below), so failure exits 1 directly here, matching
+  # this script's documented exit codes (0 = success, 1 = error).
+  if CURRENT_LABELS=$(gh issue view "$ISSUE_NUMBER" "${GH_ARGS[@]}" --json labels \
+    --jq '[.labels[].name] | join(",")' 2>/dev/null); then
+    : # fetch succeeded; CURRENT_LABELS may legitimately be an empty string
+  else
+    echo "ERROR: needs-validation label fetch failed (transient network error / rate limit?) for issue #$ISSUE_NUMBER — cannot determine finding-lifecycle state. Aborting without action." >&2
+    exit 1
+  fi
 
   if ! echo "$CURRENT_LABELS" | grep -q "needs-validation"; then
     echo "OK: Issue #$ISSUE_NUMBER does not have needs-validation — no action taken (idempotent)"
@@ -282,9 +299,27 @@ gh issue edit "$ISSUE_NUMBER" "${GH_ARGS[@]}" --add-label "$EFFECTIVE_LABEL"
 # have doesn't need removing anyway — so intersecting against the issue's
 # current labels sidesteps the all-or-nothing failure mode entirely instead
 # of relying on `|| true` to mask it.
+#
+# forge#1990: this fetch itself can fail (transient network error, rate
+# limit) independently of whether the issue actually has any stale labels.
+# A bare `2>/dev/null || echo ""` collapsed "fetch failed" and "fetch
+# succeeded, issue has no labels" into the same empty string — so a failed
+# fetch here silently skipped the ENTIRE removal/verification block below
+# (not just its post-hoc confirmation) while the script still reported `OK`
+# on exit 0. Use the same `if VAR=$(cmd); then ... else ... fi` idiom
+# already applied to the post-removal verification fetch below (forge#1977/
+# #1988) to keep the two outcomes distinguishable, and defer a non-zero
+# exit via TRANSITION_EXIT_CODE (forge#1929 convention) instead of masking
+# the failure as success.
 # ---------------------------------------------------------------------------
-CURRENT_ISSUE_LABELS=$(gh issue view "$ISSUE_NUMBER" "${GH_ARGS[@]}" --json labels \
-  --jq '[.labels[].name] | join(",")' 2>/dev/null || echo "")
+if CURRENT_ISSUE_LABELS=$(gh issue view "$ISSUE_NUMBER" "${GH_ARGS[@]}" --json labels \
+  --jq '[.labels[].name] | join(",")' 2>/dev/null); then
+  : # fetch succeeded; CURRENT_ISSUE_LABELS may legitimately be an empty string
+else
+  echo "ERROR: pre-removal label fetch failed (transient network error / rate limit?) for issue #$ISSUE_NUMBER — cannot determine which stale workflow:* labels to remove. Skipping removal to avoid acting on incomplete data." >&2
+  CURRENT_ISSUE_LABELS=""
+  TRANSITION_EXIT_CODE=1
+fi
 
 TO_REMOVE=""
 IFS=',' read -ra REMOVE_CANDIDATES <<< "$REMOVE_LABELS"
@@ -327,35 +362,52 @@ if [ -n "$TO_REMOVE" ]; then
   # step in the one case (persistent removal failure) it's most important
   # for the caller to see a consistent, fully-applied label state.
   # -------------------------------------------------------------------------
-  POST_REMOVE_LABELS=$(gh issue view "$ISSUE_NUMBER" "${GH_ARGS[@]}" --json labels \
-    --jq '[.labels[].name] | join(",")' 2>/dev/null || echo "")
-
-  STILL_PRESENT=""
-  IFS=',' read -ra TO_REMOVE_CHECK <<< "$TO_REMOVE"
-  for candidate in "${TO_REMOVE_CHECK[@]}"; do
-    case ",$POST_REMOVE_LABELS," in
-      *",$candidate,"*)
-        STILL_PRESENT="${STILL_PRESENT:+$STILL_PRESENT,}$candidate"
-        ;;
-    esac
-  done
+  # forge#1977: the fetch itself can fail (transient network error, rate
+  # limit) independently of whether the label was actually removed. A bare
+  # `2>/dev/null || echo ""` collapses "fetch failed" and "fetch succeeded,
+  # label absent" into the same empty string, so a failed verification call
+  # was previously indistinguishable from a confirmed-clean result — masking
+  # the exact failure mode this block exists to catch. Use `if VAR=$(cmd);
+  # then ... else ... fi` (set -e-safe: command substitution failure inside
+  # an `if` condition does not trigger `set -e`) to keep the two outcomes
+  # distinguishable, and treat a failed fetch as "still present" so it flows
+  # into the existing retry / fail-loud path below instead of silently
+  # reporting success.
+  if POST_REMOVE_LABELS=$(gh issue view "$ISSUE_NUMBER" "${GH_ARGS[@]}" --json labels \
+    --jq '[.labels[].name] | join(",")' 2>/dev/null); then
+    STILL_PRESENT=""
+    IFS=',' read -ra TO_REMOVE_CHECK <<< "$TO_REMOVE"
+    for candidate in "${TO_REMOVE_CHECK[@]}"; do
+      case ",$POST_REMOVE_LABELS," in
+        *",$candidate,"*)
+          STILL_PRESENT="${STILL_PRESENT:+$STILL_PRESENT,}$candidate"
+          ;;
+      esac
+    done
+  else
+    echo "WARNING: post-removal verification API call failed (transient network error / rate limit?) — cannot confirm removal, treating ($TO_REMOVE) as unverified..." >&2
+    STILL_PRESENT="$TO_REMOVE"
+  fi
 
   if [ -n "$STILL_PRESENT" ]; then
     echo "WARNING: label removal did not take effect for ($STILL_PRESENT) — retrying once..." >&2
     gh issue edit "$ISSUE_NUMBER" "${GH_ARGS[@]}" --remove-label "$STILL_PRESENT" 2>/dev/null || true
 
-    POST_RETRY_LABELS=$(gh issue view "$ISSUE_NUMBER" "${GH_ARGS[@]}" --json labels \
-      --jq '[.labels[].name] | join(",")' 2>/dev/null || echo "")
-
-    STILL_PRESENT_AFTER_RETRY=""
-    IFS=',' read -ra RETRY_CHECK <<< "$STILL_PRESENT"
-    for candidate in "${RETRY_CHECK[@]}"; do
-      case ",$POST_RETRY_LABELS," in
-        *",$candidate,"*)
-          STILL_PRESENT_AFTER_RETRY="${STILL_PRESENT_AFTER_RETRY:+$STILL_PRESENT_AFTER_RETRY,}$candidate"
-          ;;
-      esac
-    done
+    if POST_RETRY_LABELS=$(gh issue view "$ISSUE_NUMBER" "${GH_ARGS[@]}" --json labels \
+      --jq '[.labels[].name] | join(",")' 2>/dev/null); then
+      STILL_PRESENT_AFTER_RETRY=""
+      IFS=',' read -ra RETRY_CHECK <<< "$STILL_PRESENT"
+      for candidate in "${RETRY_CHECK[@]}"; do
+        case ",$POST_RETRY_LABELS," in
+          *",$candidate,"*)
+            STILL_PRESENT_AFTER_RETRY="${STILL_PRESENT_AFTER_RETRY:+$STILL_PRESENT_AFTER_RETRY,}$candidate"
+            ;;
+        esac
+      done
+    else
+      echo "WARNING: post-retry verification API call also failed (transient network error / rate limit?) — cannot confirm removal after retry, treating ($STILL_PRESENT) as unverified..." >&2
+      STILL_PRESENT_AFTER_RETRY="$STILL_PRESENT"
+    fi
 
     if [ -n "$STILL_PRESENT_AFTER_RETRY" ]; then
       echo "ERROR: failed to remove stale label(s) ($STILL_PRESENT_AFTER_RETRY) from issue #$ISSUE_NUMBER after retry — label state machine now inconsistent (issue carries both '$EFFECTIVE_LABEL' and the stale label(s) above)." >&2