mindforge-cc 11.2.0 → 11.2.1

package/bin/security/trust-boundaries.js

@@ -70,15 +70,41 @@ function tagUntrusted(content, meta) {
 // character in a regex literal (eslint no-control-regex).
 const NUL = String.fromCharCode(0);
 
+// ${IFS} / $IFS are shell-internal field separators that expand to whitespace.
+// Attackers use them to avoid literal spaces between a destructive token and
+// its flags (rm${IFS}-rf${IFS}/). We normalize them back to a space so the
+// existing rm/-rf patterns catch the de-obfuscated form (audit #8).
+const IFS_TOKEN = /\$\{IFS\}|\$IFS/g;
+
+/**
+ * De-obfuscates shell metacharacter tricks WITHOUT emulating a real shell.
+ * Strips quotes (' ") and backslash escapes, collapses ${IFS}/$IFS to a space,
+ * then collapses runs of whitespace. This turns r''m, r"m, r\m and
+ * rm${IFS}-rf${IFS}/ back into plain `rm -rf /` so the existing patterns fire.
+ * Intentionally conservative: it removes characters rather than interpreting
+ * them, which can only make a string MORE likely to match (fail-toward-block).
+ */
+function normalizeShell(input) {
+  return input
+    .split(NUL).join('')          // shells ignore NUL; never let it split a token
+    .replace(IFS_TOKEN, ' ')       // ${IFS}/$IFS -> space
+    .replace(/[\\'"]/g, '')        // drop backslash escapes and quote chars
+    .replace(/\s+/g, ' ');         // collapse whitespace runs
+}
+
 /**
  * Detects high-impact / destructive commands via case-insensitive pattern matching.
  * Returns true if the command matches known destructive patterns.
+ *
+ * The detector errs toward blocking by design: this feeds a PreToolUse gate
+ * where approval friction is strictly preferable to a destructive bypass.
  */
 function isHighImpact(command) {
-  // Strip null bytes first — shells ignore them, so an attacker must not be
-  // able to use a NUL to split a destructive token and slip past the patterns.
-  const sanitized = String(command).split(NUL).join('');
+  // Normalize first so metacharacter-obfuscated commands (audit #8) are matched
+  // by the SAME pattern set as their plain-text equivalents.
+  const sanitized = normalizeShell(String(command));
   const patterns = [
+    // ── Original allowlist (unchanged) ──────────────────────────────────────
     /rm\s+(-\w*r\w*\s+-\w*f|(-\w*f\w*\s+-\w*r)|-\w*rf|-\w*fr)/i,
     /git\s+push\s+.*--force/i,
     /git\s+push\s+.*-f/i,
@@ -87,9 +113,75 @@ function isHighImpact(command) {
     /delete\s+from/i,
     /truncate\s+table/i,
     /\bmkfs(\.\w+)?\s+\/dev\//i,
-    /\bdd\b.*\bof=\/dev\//i,
+    // #11: any dd write target, not just /dev/ (dd if=... of=important.db).
+    // Original /dev/-only check is a subset of this, so it stays covered.
+    /\bdd\b.*\bof=/i,
     /\b(curl|wget)\b.*\|\s*(bash|sh|zsh)\b/i,
     /^\s*find\s+.*-delete\b/i,
+
+    // ── #4 Command/process substitution RCE ─────────────────────────────────
+    // `eval` anywhere is high-impact (dynamic code execution).
+    /\beval\b/i,
+    // Command substitution $(...) or backtick combined with a network fetch.
+    /\$\(\s*(curl|wget)\b/i,
+    new RegExp(String.fromCharCode(96) + '\\s*(curl|wget)\\b', 'i'),
+    // Process substitution feeding an interpreter: bash <(...), sh <(...).
+    /\b(bash|sh|zsh)\b.*<\(/i,
+    // Curl/wget directly inside a process substitution.
+    /<\(\s*(curl|wget)\b/i,
+
+    // ── #5 Interpreter invocation of a script file ──────────────────────────
+    // source <file> and `. <file>` are unambiguous script execution.
+    /\bsource\s+\S+/i,
+    /(^|[;&|]|\s)\.\s+\S+\.\w+/i,
+    // bash/sh/zsh running a .sh script — clearly script execution. Kept broad
+    // (any .sh) because shelling out to an arbitrary shell script is itself a
+    // strong execution signal; this also covers untrusted paths like
+    // `bash /tmp/x.sh`.
+    /\b(bash|sh|zsh)\s+\S*\.sh\b/i,
+    // node/python/etc. running a script — narrowed (UC-22). Running a project
+    // file is THE default safe action in a Node/Python repo, so a blanket
+    // `node <file>.js` match is a terrible signal-to-noise ratio and blocked
+    // the project's OWN idiom (`node tests/run-all.js`). We now flag ONLY when
+    // the script path looks UNTRUSTED — an absolute path (/...), a writable
+    // temp dir (/tmp, /var/tmp, /dev/shm), or a home-relative path (~/...) —
+    // i.e. the write-then-execute attack chain (drop payload in a writable
+    // location, then run it). Project-relative paths (tests/run-all.js,
+    // bin/foo.js, scripts/build.py, index.js) are NOT matched. Piped/
+    // substituted execution (curl | bash, $(...), <(...), backticks) is
+    // already covered by the #4 patterns above.
+    /\b(node|python3?|ruby|perl)\s+(~\/|\/)\S*\.(js|mjs|cjs|ts|py|rb|pl)\b/i,
+
+    // ── #7 Redirect-overwrite of critical files / devices ───────────────────
+    // > or >> targeting an absolute sensitive path (/etc/, /dev/, /boot/, /sys/,
+    // /proc/, /var/, /usr/, /bin/, /sbin/, /lib/). Project-local redirects
+    // (> out.log) are NOT matched.
+    />>?\s*\/(etc|dev|boot|sys|proc|var|usr|bin|sbin|lib|root|lib64)\//i,
+
+    // ── #8 handled by normalizeShell() above (de-obfuscation), no pattern here.
+
+    // ── #9 chmod dangerous modes ────────────────────────────────────────────
+    // Canonical dangerous octal modes only: 000 (full lockout) and the
+    // world-writable 666/777 family. Common safe modes (644/755/600/700/640)
+    // and symbolic modes (chmod +x build.sh) are intentionally NOT matched.
+    // ANY recursive chmod is also treated as high-impact regardless of mode.
+    /\bchmod\b.*\b(000|0?666|0?777)\b/i,
+    /\bchmod\s+-\w*[rR]/i,
+
+    // ── #10 chown recursive ─────────────────────────────────────────────────
+    /\bchown\s+-\w*[rR]/i,
+
+    // ── #12 mv of root / into /dev/null ─────────────────────────────────────
+    /\bmv\b.*\/dev\/null\b/i,
+    /\bmv\s+(-\w+\s+)?\/\s/i,
+
+    // ── #13 Process killers ─────────────────────────────────────────────────
+    /\bkill\s+-9\s+-1\b/i,
+    /\bkillall\b/i,
+    /\bpkill\b/i,
+
+    // ── #14 Power-state commands ────────────────────────────────────────────
+    /\b(shutdown|reboot|halt|poweroff)\b/i,
   ];
   return patterns.some(pattern => pattern.test(sanitized));
 }

package/bin/security/trust-gate-hook.js

@@ -16,13 +16,23 @@ process.stdin.on('end', () => {
     }
 
     const fullCommand = event.tool_input?.command || '';
-    const command = fullCommand.split('\n')[0];
 
-    if (isHighImpact(command)) {
+    // Check the whole command AND every individual line, blocking if ANY
+    // segment is high-impact. Per-line scanning means a benign first line
+    // cannot cloak a destructive command on a later line; the whole-string
+    // check catches patterns a line split might fragment. This is a security
+    // gate, so it errs toward blocking: a destructive keyword in (e.g.) a
+    // commit message will prompt for approval rather than risk a cloaked
+    // command slipping through. Approval friction is preferable to a bypass.
+    const lines = fullCommand.split('\n');
+    const offending = [fullCommand, ...lines].find((segment) => isHighImpact(segment));
+
+    if (offending) {
+      const display = offending.length > 80 ? offending.slice(0, 80) + '...' : offending;
       // Output a block reason (Claude Code shows this to the user)
       process.stdout.write(JSON.stringify({
         decision: 'block',
-        reason: `[TrustGate] High-impact command detected: "${command.substring(0, 80)}..." — requires explicit user approval`
+        reason: `[TrustGate] High-impact command detected: "${display}" — requires explicit user approval`
       }));
       process.exit(2); // block
     }

package/bin/skill-registry.js

@@ -124,31 +124,42 @@ function handleInstall() {
   if (tier === '1') targetBase = '.mindforge/skills';
   if (tier === '3') targetBase = '.mindforge/project-skills';
 
+  // Resolve a real local source for the skill. There is no remote registry
+  // backend, so the ONLY honest sources are an examples/ entry or a SKILL.md in
+  // the current working directory (the agentic authoring flow).
+  const exampleSrc = path.join(process.cwd(), 'examples', 'skills', `${skillName}.md`);
+  const localSrc = path.join(process.cwd(), 'SKILL.md');
+
+  let source = null;
+  if (fs.existsSync(exampleSrc)) {
+    source = exampleSrc;
+  } else if (fs.existsSync(localSrc)) {
+    source = localSrc;
+  }
+
+  if (!source) {
+    // HONEST REFUSAL (UC-22): no local source and no remote registry is
+    // configured. Do NOT write a placeholder file that masquerades as an
+    // installed skill — that would falsely report success. Refuse clearly and
+    // exit non-zero so callers can detect the failure.
+    console.error(
+      `❌ Skill '${skillName}' not found locally and no remote registry is configured — nothing installed.`
+    );
+    console.error(
+      '   Provide a source first: place a SKILL.md in the current directory ' +
+      `or add examples/skills/${skillName}.md, then re-run.`
+    );
+    process.exit(1);
+  }
+
+  // Real source found → perform the actual install.
   const targetDir = path.join(process.cwd(), targetBase, skillName);
   if (!fs.existsSync(targetDir)) {
     fs.mkdirSync(targetDir, { recursive: true });
   }
-
-  // Mock behavior for Day 3/4 testing if no real registry
-  // Expect source to be in examples/ if it exists, otherwise just touch it
-  const mockSrc = path.join(process.cwd(), 'examples', 'skills', `${skillName}.md`);
   const targetFile = path.join(targetDir, 'SKILL.md');
-
-  if (fs.existsSync(mockSrc)) {
-    fs.copyFileSync(mockSrc, targetFile);
-    console.log(`  ✅ Copied from ${mockSrc}`);
-  } else {
-    // If no source, we look for it in the current dir for the agentic flow
-    const localSrc = path.join(process.cwd(), 'SKILL.md');
-    if (fs.existsSync(localSrc)) {
-       fs.copyFileSync(localSrc, targetFile);
-       console.log('  ✅ Copied from local SKILL.md');
-    } else {
-       // Just create a placeholder for testing if nothing else
-       fs.writeFileSync(targetFile, `---\nname: ${skillName}\nversion: 1.0.0\nstatus: alpha\ntriggers: test, mock, placeholder\n---\n# ${skillName}\nPlaceholder for ${skillName} skill.\n`);
-       console.log('  ⚠️  Created mock SKILL.md (no source found)');
-    }
-  }
+  fs.copyFileSync(source, targetFile);
+  console.log(`  ✅ Installed ${skillName} from ${path.relative(process.cwd(), source)}`);
 
   process.exit(0);
 }

package/bin/sre/shadow-mirror.js

@@ -1,13 +1,28 @@
 /**
  * MindForge v9.0.0 — Temporal Shadow Mirror (Pillar XXI)
- * Hybrid isolation for incident replication.
+ *
+ * Incident replication via git-worktree isolation.
+ *
+ * ISOLATION HONESTY (audit finding #24 / UC-22):
+ * This module provides GIT WORKTREE isolation only — a separate working tree
+ * and branch off the current repo. It does NOT provide container/Docker
+ * isolation (no separate kernel, network, filesystem, or process namespaces).
+ * A `docker --version` probe gates an "enhanced" path, but that path still runs
+ * in a git worktree; real Docker orchestration (build/run/mount) is a
+ * NOT-YET-IMPLEMENTED future enhancement. The returned mirror is always a
+ * worktree, and `activeMirror.isolation` reports the actual level provided.
  */
 'use strict';
 
-const { execSync } = require('node:child_process');
+const { execSync, execFileSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
-const crypto = require('node:crypto');
+
+// remediation_id flows from the SRE sentinel (a trust boundary) into git
+// branch/worktree names. Only allow a safe identifier charset and reject
+// anything that could be read as a flag or shell metacharacter. Defence in
+// depth on top of execFileSync (argv array, no shell). Fail-closed.
+const SAFE_REMEDIATION_ID = /^[A-Za-z0-9._-]+$/;
 
 class ShadowMirror {
   constructor(options = {}) {
@@ -15,32 +30,58 @@ class ShadowMirror {
     this.activeMirror = null;
   }
 
+  /**
+   * Validates a remediation_id (trust-boundary input) before it is used to
+   * build git branch/worktree names. Fail-closed: throws on missing, empty,
+   * overlong, flag-like, or metacharacter-bearing ids. Returns the id on pass.
+   * Static so it can be unit-tested in isolation.
+   */
+  static sanitizeRemediationId(id) {
+    if (typeof id !== 'string' || id.length === 0 || id.length > 128) {
+      throw new Error('[ShadowMirror] invalid remediation_id: must be a non-empty string of <=128 chars');
+    }
+    if (id.startsWith('-')) {
+      throw new Error('[ShadowMirror] invalid remediation_id: must not start with "-"');
+    }
+    if (!SAFE_REMEDIATION_ID.test(id)) {
+      throw new Error('[ShadowMirror] invalid remediation_id: only [A-Za-z0-9._-] characters allowed');
+    }
+    return id;
+  }
+
   /**
    * Orchestrates replication based on incident severity and requirements.
    */
   async replicate(incident) {
     console.log(`🌀 Shadow Mirror: Replicating incident [${incident.remediation_id}]...`);
-    
-    // Choose isolation level
-    const level = (incident.details?.severity === 'CRITICAL') ? 2 : 1;
-    
-    if (level === 2 && this.isDockerAvailable()) {
-      return this.replicateLevel2(incident);
-    } else {
-      return this.replicateLevel1(incident);
+
+    // All replication currently runs in a git worktree (see file header).
+    // For CRITICAL incidents where a Docker toolchain is present we note that a
+    // future container-isolation path could be used, but we DO NOT claim to run
+    // it — we still replicate in a worktree and label it honestly.
+    const wantsContainer = incident.details?.severity === 'CRITICAL' && this.isDockerAvailable();
+
+    if (wantsContainer) {
+      return this.replicateCriticalWorktree(incident);
     }
+    return this.replicateLevel1(incident);
   }
 
   /**
    * Level 1 Replication: Git Worktree
-   * High-speed, lightweight logic isolation.
+   * High-speed, lightweight logic isolation (NOT container isolation).
+   *
+   * Provides a separate working tree + branch off the current repo. This
+   * isolates source/logic changes; it shares the host kernel, network,
+   * filesystem and process namespaces with the running engine.
    */
   async replicateLevel1(incident) {
-    const mirrorId = `mirror-${incident.remediation_id}`;
+    const remediationId = ShadowMirror.sanitizeRemediationId(incident.remediation_id);
+    const mirrorId = `mirror-${remediationId}`;
     const mirrorPath = path.join(this.baseDir, mirrorId);
-    const branchName = `sre-repro-${incident.remediation_id}`;
+    const branchName = `sre-repro-${remediationId}`;
 
-    console.log(`[Level 1] Creating git worktree at ${mirrorPath}...`);
+    console.log(`[worktree] Creating git worktree at ${mirrorPath}...`);
 
     try {
       if (!fs.existsSync(this.baseDir)) {
@@ -49,41 +90,46 @@ class ShadowMirror {
 
       // 1. Create a reproduction branch and add worktree in one step (Atomic)
       // In a real system, we'd base this on the commit hash from the trace_id
-      execSync(`git worktree add -b ${branchName} ${mirrorPath}`, { stdio: 'ignore' });
-      
-      this.activeMirror = { path: mirrorPath, branch: branchName, type: 'worktree' };
+      // execFileSync with an argv array — no shell, so branchName/mirrorPath
+      // cannot inject commands even if they somehow contained metacharacters.
+      execFileSync('git', ['worktree', 'add', '-b', branchName, mirrorPath], { stdio: 'ignore' });
+
+      this.activeMirror = {
+        path: mirrorPath,
+        branch: branchName,
+        type: 'worktree-isolation',
+        // Honest disclosure of the isolation actually provided.
+        isolation: 'git-worktree',
+      };
 
       // 3. Inject incident metadata for the agent to use
       fs.writeFileSync(path.join(mirrorPath, 'REPLICATION.json'), JSON.stringify(incident, null, 2));
 
       return mirrorPath;
     } catch (err) {
-      console.error(`[ShadowMirror] Level 1 replication failed: ${err.message}`);
+      console.error(`[ShadowMirror] worktree replication failed: ${err.message}`);
       throw err;
     }
   }
 
   /**
-   * Level 2 Replication: Docker Sandbox
-   * Full environment isolation for state-bound incidents.
+   * CRITICAL-incident replication when a Docker toolchain is detected.
+   *
+   * HONESTY: This still replicates in a GIT WORKTREE. It does not build or run
+   * a container, does not mount any volume, and does not provide container
+   * isolation. Real Docker sandboxing (build/run/mount) is a NOT-YET-IMPLEMENTED
+   * enhancement tracked separately; until it lands, this path is identical in
+   * isolation guarantees to {@link replicateLevel1} and is labelled as such.
    */
-  async replicateLevel2(incident) {
-    console.log('[Level 2] Initializing Docker sandbox interface...');
-    // For the hackathon demo, we'll scaffold the Docker-ready worktree which would then be mounted
+  async replicateCriticalWorktree(incident) {
+    console.log('[worktree] CRITICAL incident: replicating in git worktree (container isolation not implemented).');
     const mirrorPath = await this.replicateLevel1(incident);
-    
-    const dockerfile = `
-FROM node:18-slim
-WORKDIR /app
-COPY . .
-RUN npm install --production
-CMD ["node", "bin/engine/logic-validator.js"]
-    `;
-    
-    fs.writeFileSync(path.join(mirrorPath, 'Dockerfile.sre'), dockerfile);
-    console.log(`[Level 2] Dockerfile.sre generated at ${mirrorPath}. Mounting volume for isolation.`);
-    
-    this.activeMirror.type = 'docker-hybrid';
+
+    // Note the unimplemented future path without claiming it ran.
+    this.activeMirror.dockerAvailable = true;
+    this.activeMirror.note =
+      'docker binary detected; real container isolation is a future enhancement — this mirror used git-worktree isolation only';
+
     return mirrorPath;
   }
 
@@ -104,9 +150,13 @@ CMD ["node", "bin/engine/logic-validator.js"]
 
     console.log(`🧹 Cleaning up Shadow Mirror: ${this.activeMirror.path}...`);
     try {
-      if (this.activeMirror.type === 'worktree' || this.activeMirror.type === 'docker-hybrid') {
-        execSync(`git worktree remove ${this.activeMirror.path} --force`, { stdio: 'ignore' });
-        execSync(`git branch -D ${this.activeMirror.branch}`, { stdio: 'ignore' });
+      // Every mirror this module produces is a git worktree (see replicate()).
+      // Accept the legacy 'worktree'/'docker-hybrid' labels for backward compat
+      // in case an older serialized mirror is handed in.
+      const worktreeTypes = ['worktree-isolation', 'worktree', 'docker-hybrid'];
+      if (worktreeTypes.includes(this.activeMirror.type)) {
+        execFileSync('git', ['worktree', 'remove', this.activeMirror.path, '--force'], { stdio: 'ignore' });
+        execFileSync('git', ['branch', '-D', this.activeMirror.branch], { stdio: 'ignore' });
         // Clean up the folder just in case
         if (fs.existsSync(this.activeMirror.path)) {
           fs.rmSync(this.activeMirror.path, { recursive: true });

package/bin/utils/append-queue.js

@@ -17,6 +17,18 @@ const fs = require('fs');
 // unboundedly. Revisit with an LRU/eviction policy if dynamic paths are needed.
 const queues = new Map();
 
+/**
+ * @deprecated No production caller. The real durable-append path is
+ * `appendDurableSync` in `bin/memory/knowledge-store.js` (synchronous
+ * openSync+writeSync+fsyncSync+closeSync), which all audit/KB write sites use.
+ * This async single-writer queue is retained only as a tested reference
+ * implementation for the in-process serialized-append pattern (UC-09) and is
+ * exercised solely by `tests/append-queue.test.js`. Do NOT wire it into new
+ * code without first reconciling it with the canonical sync path.
+ *
+ * @param {string} filePath — file to serialize appends for
+ * @returns {{append: (line: string) => Promise<void>, drain: () => Promise<void>}}
+ */
 function createAppendQueue(filePath) {
   if (!queues.has(filePath)) queues.set(filePath, Promise.resolve());
 

package/bin/utils/file-io.js

@@ -3,7 +3,6 @@
 const fs = require('fs');
 const fsp = require('fs/promises');
 const path = require('path');
-const zlib = require('zlib');
 
 /**
  * Hash-chained audit writer (class API preserved for nexus-tracer + policy-engine).
@@ -28,8 +27,9 @@ class AuditWriter {
   }
 
   async write(entry) {
-    // Lazy require to avoid a require-cycle: audit-writer.js requires this file
-    // (AuditRotator) at load time, so we cannot require it at module top level.
+    // Lazy require (not module-top-level) to keep this leaf utility free of a
+    // load-time dependency on the autonomous layer and avoid any future require
+    // cycle: bin/autonomous/audit-writer.js is the canonical durable-append site.
     const { appendAuditEntrySync } = require('../autonomous/audit-writer');
     const chained = appendAuditEntrySync(this._path, entry);
     this._lastHash = chained._hash;
@@ -110,45 +110,4 @@ async function atomicWriteJSONAsync(filePath, data) {
   await fsp.rename(tmpPath, filePath);
 }
 
-class AuditRotator {
-  constructor(options = {}) {
-    this.maxLines = options.maxLines || 5000;
-  }
-
-  shouldRotate(filePath) {
-    if (!fs.existsSync(filePath)) return false;
-    const content = fs.readFileSync(filePath, 'utf8');
-    const lineCount = content.split('\n').filter(l => l.trim()).length;
-    return lineCount >= this.maxLines;
-  }
-
-  rotate(filePath, archiveDir) {
-    const dir = archiveDir || path.join(path.dirname(filePath), '..', 'audit-archive');
-    if (!fs.existsSync(dir)) {
-      fs.mkdirSync(dir, { recursive: true });
-    }
-
-    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-    const baseName = path.basename(filePath, path.extname(filePath));
-    const archiveName = `${baseName}-${timestamp}.jsonl.gz`;
-    const archivePath = path.join(dir, archiveName);
-
-    // Crash-safe: write archive FIRST, then truncate source
-    const content = fs.readFileSync(filePath);
-    const compressed = zlib.gzipSync(content);
-    fs.writeFileSync(archivePath, compressed);
-
-    const lines = content.toString('utf8').split('\n').filter(l => l.trim());
-    const carryover = lines.slice(-100).join('\n') + '\n';
-    const tmpPath = filePath + '.tmp.' + process.pid;
-    const fd = fs.openSync(tmpPath, 'w');
-    fs.writeSync(fd, carryover);
-    fs.fsyncSync(fd);
-    fs.closeSync(fd);
-    fs.renameSync(tmpPath, filePath);
-
-    return archivePath;
-  }
-}
-
-module.exports = { AuditWriter, AuditRotator, readJSON, writeJSON, readJSONL, readJSONSync, atomicWriteJSON, atomicWriteJSONAsync };
+module.exports = { AuditWriter, readJSON, writeJSON, readJSONL, readJSONSync, atomicWriteJSON, atomicWriteJSONAsync };

package/bin/utils/version-check.js

@@ -3,12 +3,25 @@
  * MindForge version single-source-of-truth + drift detector.
  * package.json is canonical; everything else must agree.
  */
+const fs = require('fs');
 const path = require('path');
 // Use the repo's stricter reader: returns null only on ENOENT and RE-THROWS on
 // parse errors. Re-throwing on a corrupt JSON source is the fail-closed
 // behavior we want — a file we cannot parse means we cannot establish truth.
 const { readJSONSync } = require('./file-io');
 
+/**
+ * Extracts `[VERSION] = X` from MINDFORGE.md. Returns null when the file is
+ * absent or the marker is missing (treated as skip, not drift).
+ */
+function readMindforgeMdVersion(projectRoot) {
+  const mdPath = path.join(projectRoot, 'MINDFORGE.md');
+  if (!fs.existsSync(mdPath)) return null;
+  const text = fs.readFileSync(mdPath, 'utf8');
+  const match = text.match(/\[VERSION\]\s*=\s*([^\s]+)/);
+  return match ? match[1].trim() : null;
+}
+
 /**
  * @param {string} projectRoot
  * @returns {{ canonical: string|null, sources: Record<string,string|null>, drift: string[] }}
@@ -18,14 +31,17 @@ function checkVersionConsistency(projectRoot) {
   const canonical = pkg ? pkg.version : null;
 
   const configJson = readJSONSync(path.join(projectRoot, '.mindforge', 'config.json'));
-  // Runtime drift coverage is intentionally limited to package.json (canonical)
-  // vs .mindforge/config.json — the live config is the operational drift risk
-  // during `auto`. Wider agreement (sdk/package.json, MINDFORGE.md [VERSION]) is
-  // enforced by the test suite (tests/version-consistency.test.js), not at
-  // runtime — do not assume this checker provides full version coverage.
+  const sdkPkg = readJSONSync(path.join(projectRoot, 'sdk', 'package.json'));
+  const mindforgeMdVersion = readMindforgeMdVersion(projectRoot);
+  // Runtime coverage now spans every source the test suite knows about, so
+  // drift in any of them halts `auto` — not just the live config. Absent
+  // optional sources (no sdk/, no MINDFORGE.md) read as null and are SKIPPED
+  // (not counted as drift); only a present-but-mismatched source flags drift.
   const sources = {
     'package.json': canonical,
     '.mindforge/config.json': configJson ? configJson.version : null,
+    'sdk/package.json': sdkPkg ? sdkPkg.version : null,
+    'MINDFORGE.md': mindforgeMdVersion,
   };
 
   const drift = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindforge-cc",
-  "version": "11.2.0",
+  "version": "11.2.1",
   "description": "MindForge \u2014 Sovereign Agentic Intelligence Framework. Sovereign Stability: Production-Hardened Agentic Intelligence (v11)",
   "bin": {
     "mindforge-cc": "bin/install.js",