mindforge-cc 11.2.0 → 11.3.0

package/bin/governance/ztai-archiver.js

@@ -20,19 +20,35 @@ class ZTAIArchiver {
    * @param {string} archiverDid - The DID of the archiver (e.g., Release Manager)
    * @returns {Promise<Object>} - The signed manifest
    */
-  async generateManifest(entries, archiverDid) {
-    if (!entries || entries.length === 0) return null;
-
-    // 1. Calculate the Merkle-like root hash of the block
-    const blockHashes = entries.map(e => 
+  /**
+   * Computes the cumulative-hash-chain "Merkle root" for a block of entries.
+   *
+   * This is the SINGLE source of truth for the root algorithm. Both
+   * generateManifest() (write path) and verifyIntegrity() (read/verify path)
+   * MUST call this so the two can never drift — a drift would re-introduce the
+   * false-assurance defect (audit finding #15 / UC-22).
+   *
+   * @param {Array<Object>} entries - Ordered block of audit entries.
+   * @returns {string} - The cumulative SHA-256 hash chain (hex).
+   */
+  _computeMerkleRoot(entries) {
+    const blockHashes = entries.map(e =>
       crypto.createHash('sha256').update(JSON.stringify(e)).digest('hex')
     );
-    
-    // Simple cumulative hash chain as a Merkle Root equivalent
+
+    // Simple cumulative hash chain as a Merkle Root equivalent.
     let cumulativeHash = '';
     for (const h of blockHashes) {
       cumulativeHash = crypto.createHash('sha256').update(cumulativeHash + h).digest('hex');
     }
+    return cumulativeHash;
+  }
+
+  async generateManifest(entries, archiverDid) {
+    if (!entries || entries.length === 0) return null;
+
+    // 1. Calculate the Merkle-like root hash of the block.
+    const cumulativeHash = this._computeMerkleRoot(entries);
 
     const manifestMetadata = {
       blockStart: entries[0].timestamp,
@@ -94,8 +110,57 @@ class ZTAIArchiver {
       throw new Error(`CRITICAL: Manifest signature invalid for ${manifestPath}`);
     }
 
-    // 2. Recalculate and Verify Merkle Root (Simulated)
-    // In a real environment, this would compare against the actual AUDIT.jsonl data slices.
+    // 2. Recalculate and Verify Merkle Root against the LIVE AUDIT.jsonl.
+    //
+    // A valid signature only proves the manifest itself is authentic; it says
+    // NOTHING about whether the underlying audit log still matches. We must
+    // recompute the root from disk and compare — anything less is false
+    // assurance (audit finding #15 / UC-22). Fail-closed on every error path:
+    // a missing/unreadable log MUST NOT pass.
+    let auditData;
+    try {
+      auditData = await fs.readFile(this.auditPath, 'utf8');
+    } catch (err) {
+      throw new Error(`CRITICAL: Audit log unreadable at ${this.auditPath} — cannot verify integrity (${err.message})`);
+    }
+
+    let allEntries;
+    try {
+      allEntries = auditData
+        .split('\n')
+        .filter(l => l.trim() !== '')
+        .map(l => JSON.parse(l));
+    } catch (err) {
+      throw new Error(`CRITICAL: Audit log corrupted / unparseable for ${manifestPath} (${err.message})`);
+    }
+
+    // Select the block this manifest covers: entries whose timestamp falls
+    // within [blockStart, blockEnd] inclusive.
+    const start = Date.parse(manifest.blockStart);
+    const end = Date.parse(manifest.blockEnd);
+    const blockEntries = allEntries.filter(e => {
+      const ts = Date.parse(e.timestamp);
+      return ts >= start && ts <= end;
+    });
+
+    // Sanity-check the selected count against the manifest. A mismatch means
+    // entries were added or deleted within the covered window.
+    if (blockEntries.length !== manifest.entryCount) {
+      throw new Error(
+        'CRITICAL: Audit log tampering detected — block entry count mismatch ' +
+        `(manifest=${manifest.entryCount}, found=${blockEntries.length}) for ${manifestPath}`
+      );
+    }
+
+    // Recompute the root with the SAME algorithm used at archive time.
+    const recomputedRoot = this._computeMerkleRoot(blockEntries);
+    if (recomputedRoot !== manifest.merkleRoot) {
+      throw new Error(
+        `CRITICAL: Audit log tampering detected — Merkle root mismatch for ${manifestPath} ` +
+        `(expected=${manifest.merkleRoot}, recomputed=${recomputedRoot}).`
+      );
+    }
+
     console.log(`[ZTAI-ARCHIVER] Integrity Verified for block ending ${manifest.blockEnd}`);
     return true;
   }

package/bin/governance/ztai-manager.js

@@ -65,7 +65,7 @@ class SecureEnclaveProvider extends KeyProvider {
   }
 
   async generate(did) {
-    console.log(`[ZTAI-HSM] Provisioning protected identity enclave for ${did}...`);
+    console.log(`[ZTAI-HSM-SIM] Provisioning simulated (in-process) identity enclave for ${did}...`);
     const { publicKey, privateKey } = await generateKeyPair('ed25519');
     const pubPEM = publicKey.export({ type: 'spki', format: 'pem' });
     
@@ -82,7 +82,7 @@ class SecureEnclaveProvider extends KeyProvider {
     const record = this.enclaveStore.get(did);
     if (!record) throw new Error(`Enclave record not found for ${did}`);
     
-    console.log(`[ZTAI-HSM] Delegating signature to hardware enclave [DID: ${did}]`);
+    console.log(`[ZTAI-HSM-SIM] Signing via simulated in-process enclave (NOT a hardware HSM/TPM) [DID: ${did}]`);
     
     // Simulate enclave "wrapping" or "sealing" logic
     const signature = crypto.sign(null, Buffer.from(data), record.privateKey);
@@ -93,7 +93,7 @@ class SecureEnclaveProvider extends KeyProvider {
   }
 
   async rotate(did) {
-    console.log(`[ZTAI-HSM] Rotating enclave keys for ${did}...`);
+    console.log(`[ZTAI-HSM-SIM] Rotating simulated enclave keys for ${did}...`);
     return this.generate(did);
   }
 

package/bin/installer-core.js

@@ -28,6 +28,7 @@ const RUNTIMES = {
     docsSubdir:     'docs',
     memorySubdir:   'memory',
     pluginsSubdir:  'plugins',
+    agentsSubdir:   'agents',
   },
   antigravity: {
     displayName:    'Antigravity',
@@ -95,6 +96,25 @@ const RUNTIMES = {
   },
 };
 
+/**
+ * Reads the target project's experimental.pqc_demo flag — the SINGLE gate that
+ * the engine (bin/governance/quantum-crypto.js) uses to enable the simulated
+ * PQAS minter. Defaults to false (engine default) when the config is absent or
+ * unreadable, so the installer never over-claims that PQAS is enabled.
+ * @param {string} cwd - Target project root being installed into.
+ * @returns {boolean} - true only when experimental.pqc_demo === true.
+ */
+function isPqcDemoEnabled(cwd) {
+  try {
+    const cfgPath = path.join(cwd, '.mindforge', 'config.json');
+    if (!fs.existsSync(cfgPath)) return false;
+    const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+    return cfg && cfg.experimental && cfg.experimental.pqc_demo === true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Generates runtime-specific entry file content.
  * e.g. replacing "Claude" with "Gemini" in GEMINI.md
@@ -184,6 +204,50 @@ const fsu = {
   },
 };
 
+/**
+ * Flatten-copy the imported Claude-Code subagents into a runtime's native agents
+ * directory. The 154 source files live under subagents/categories/NN-name/*.md;
+ * Claude Code auto-discovers agents from the top level of .claude/agents/, so we
+ * flatten (basenames are already collision-free after the -cc renames) and skip
+ * the per-category README.md index files. Returns the count installed.
+ * @param {string} agentsDir - Destination agents directory (absolute).
+ * @param {object} options - { noOverwrite }.
+ * @returns {number} number of agent files copied.
+ */
+function installSubagents(agentsDir, options = {}) {
+  const { noOverwrite = false } = options;
+  const sourceDir = src('subagents', 'categories');
+  if (!fsu.exists(sourceDir)) return 0;
+
+  fsu.ensureDir(agentsDir);
+  let count = 0;
+  for (const file of fsu.listFilesRecursive(sourceDir, '.md')) {
+    if (path.basename(file) === 'README.md') continue;
+    const dst = path.join(agentsDir, path.basename(file));
+    if (noOverwrite && fsu.exists(dst)) continue;
+    fsu.copy(file, dst);
+    count++;
+  }
+  return count;
+}
+
+/**
+ * The set of imported-subagent basenames (e.g. 'api-designer-cc.md'). Used by
+ * uninstall to remove ONLY our agents from a runtime's agents/ dir, never the
+ * user's own hand-authored agents that may live alongside them.
+ * @returns {Set<string>}
+ */
+function importedSubagentBasenames() {
+  const sourceDir = src('subagents', 'categories');
+  const names = new Set();
+  if (!fsu.exists(sourceDir)) return names;
+  for (const file of fsu.listFilesRecursive(sourceDir, '.md')) {
+    const base = path.basename(file);
+    if (base !== 'README.md') names.add(base);
+  }
+  return names;
+}
+
 // ── Registry Management ────────────────────────────────────────────────────────
 const RegistryManager = {
   getRegistryPath: () => path.join(os.homedir(), '.mindforge', 'registry.json'),
@@ -396,6 +460,13 @@ async function install(runtime, scope, options = {}) {
         }
       }
     });
+
+    if (cfg.agentsSubdir && fsu.exists(src('subagents', 'categories'))) {
+      const agentCount = fsu.listFilesRecursive(src('subagents', 'categories'), '.md')
+        .filter(f => path.basename(f) !== 'README.md').length;
+      const countStr = `${agentCount} subagents`.padEnd(12);
+      console.log(`    ${countStr} → ${path.join(baseDir, cfg.agentsSubdir)}`);
+    }
     return;
   }
 
@@ -531,6 +602,21 @@ async function install(runtime, scope, options = {}) {
     });
   }
 
+  // ── 2.2 Install Subagents (native Claude-Code agents, both scopes) ──────────
+  // The 154 imported subagents are Claude-Code-native .md files; Claude Code
+  // auto-discovers them from <runtime>/agents/. Installed for BOTH scopes so a
+  // global install also exposes them. Mirrored to .claude/agents/ for non-claude
+  // local runtimes (same cross-IDE rationale as the command mirror above).
+  if (cfg.agentsSubdir && !selfInstall) {
+    const agentsDir = path.join(baseDir, cfg.agentsSubdir);
+    const count = installSubagents(agentsDir, { noOverwrite: !force });
+    if (count > 0) Theme.printResolved(`${c.bold(`${count} subagents`)} (native agents)`);
+  }
+  if (scope === 'local' && runtime !== 'claude' && !selfInstall) {
+    const mirrorDir = path.join(process.cwd(), '.claude', 'agents');
+    installSubagents(mirrorDir, { noOverwrite: !force });
+  }
+
   // ── 3. Framework files (local scope only, non-self-install) ─────────────────
   if (scope === 'local' && !selfInstall) {
     // .mindforge/ — framework engine files
@@ -650,9 +736,19 @@ async function install(runtime, scope, options = {}) {
       }
     });
 
-    // ✨ SOVEREIGN INITIALIZATION: Mark project as PQAS & Proactive enabled
+    // ✨ SOVEREIGN INITIALIZATION: report actual security posture honestly.
+    // The PQAS minter is gated SOLELY behind experimental.pqc_demo (see
+    // bin/governance/quantum-crypto.js: getProvider/_assertPqcDemoEnabled). When
+    // that flag is off (the default) PQAS is inert/simulated — claiming it is
+    // "enabled" would contradict the engine and mislead operators (UC-22).
     Theme.printStatus(c.magenta('Sovereign Intelligence v8.2.0 activated'), 'done');
-    Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS) enabled'), 'info');
+    if (isPqcDemoEnabled(process.cwd())) {
+      Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS): SIMULATED demo ENABLED '
+        + '(experimental.pqc_demo=true — simulated lattice crypto, NOT production trust)'), 'info');
+    } else {
+      Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS): available in simulated/experimental '
+        + 'mode (inactive by default — set experimental.pqc_demo=true to enable the simulated demo)'), 'info');
+    }
     Theme.printStatus(c.dim('  - Proactive Semantic Intent Harvesting active'), 'info');
 
     // bin/ utilities (remaining non-engine scripts)
@@ -683,9 +779,16 @@ async function uninstall(runtime, scope, options = {}) {
   const cmdsDir = norm(path.join(baseDir, cfg.commandsSubdir));
   const entryFile = norm(path.join(baseDir, cfg.entryFile));
 
+  const agentsDir = cfg.agentsSubdir ? norm(path.join(baseDir, cfg.agentsSubdir)) : null;
+  const importedAgents = importedSubagentBasenames();
+
   console.log(`\n  Uninstalling MindForge (${runtime} / ${scope})...`);
   if (dryRun) {
     console.log(`  Would remove: ${cmdsDir}`);
+    if (agentsDir && fsu.exists(agentsDir)) {
+      const present = fsu.listFiles(agentsDir).filter(f => importedAgents.has(f)).length;
+      if (present > 0) console.log(`  Would remove: ${present} imported subagents from ${agentsDir}`);
+    }
     if (fsu.exists(entryFile) && fsu.read(entryFile).includes('MindForge'))
       console.log(`  Would remove: ${entryFile}`);
     return;
@@ -697,6 +800,18 @@ async function uninstall(runtime, scope, options = {}) {
     console.log(`  ✅  Removed: ${cmdsDir}`);
   }
 
+  // Remove ONLY our imported subagents — leave the user's own agents/ files intact.
+  if (agentsDir && fsu.exists(agentsDir)) {
+    let removed = 0;
+    for (const f of fsu.listFiles(agentsDir)) {
+      if (importedAgents.has(f)) {
+        fs.unlinkSync(path.join(agentsDir, f));
+        removed++;
+      }
+    }
+    if (removed > 0) console.log(`  ✅  Removed: ${removed} imported subagents from ${agentsDir}`);
+  }
+
   // Remove entry file only if it's a MindForge-generated file
   if (fsu.exists(entryFile) && fsu.read(entryFile).includes('MindForge')) {
     fs.unlinkSync(entryFile);
@@ -715,6 +830,7 @@ function collectManifestStats() {
   const stats = {
     personas: 0,
     skills: 0,
+    subagents: 0,
     governance: 0,
     integrations: 0,
     actions: 0,
@@ -731,6 +847,13 @@ function collectManifestStats() {
       stats.integrations = fsu.listFiles(path.join(forgeSrc, 'integrations')).filter(f => f.endsWith('.md')).length;
     }
 
+    // Imported subagents (subagents/categories/**, excluding category READMEs)
+    const subagentsSrc = src('subagents', 'categories');
+    if (fsu.exists(subagentsSrc)) {
+      stats.subagents = fsu.listFilesRecursive(subagentsSrc, '.md')
+        .filter(f => path.basename(f) !== 'README.md').length;
+    }
+
     // Docs & Templates count
     const refSrc = src('docs', 'references');
     const tmpSrc = src('docs', 'templates');
@@ -748,7 +871,7 @@ function collectManifestStats() {
     }
   } catch (e) {
     // Fallback to default values if counting fails
-    return { personas: 117, skills: 20, governance: 4, integrations: 6, actions: 71, docs: 12, templates: 21 };
+    return { personas: 117, skills: 20, subagents: 154, governance: 4, integrations: 6, actions: 71, docs: 12, templates: 21 };
   }
 
   return stats;

package/bin/memory/eis-client.js

@@ -100,10 +100,48 @@ class EISClient {
     return [];
   }
 
-  // TODO: implement when remote nodes are available
+  /**
+   * Verifies the provenance of a remote knowledge entry by cryptographically
+   * checking its signature against the signer DID's registered public key.
+   *
+   * HONEST / FAIL-CLOSED CONTRACT (UC-22, finding #22): this method NEVER
+   * returns true for a signature it has not actually verified. It returns true
+   * ONLY when ZTAI.verifySignature confirms the signature against a public key
+   * that is resolvable in the local trust registry. Every other case fails
+   * closed → false:
+   *   - no/empty signature,
+   *   - no signer DID on the entry,
+   *   - the DID is not resolvable here (e.g. a genuinely remote peer whose key
+   *     is not in the local registry — there is no remote DID-resolution infra
+   *     yet, see resolveRemoteNode),
+   *   - tampered payload or signature (crypto.verify returns false / throws).
+   *
+   * @param {{did?: string, signedData?: string}} entry - Provenance-bearing entry.
+   *   `did` is the signer's DID; `signedData` is the exact canonical bytes that
+   *   were signed (defaults to a deterministic JSON of the entry if absent).
+   * @param {string} signature - Base64 signature to verify.
+   * @returns {boolean} true only if cryptographically verified; false otherwise.
+   */
   verifyRemoteProvenance(entry, signature) {
-    if (!signature) return false;
-    return true;
+    if (!signature || typeof signature !== 'string') return false;
+    if (!entry || typeof entry !== 'object') return false;
+
+    const did = entry.did;
+    if (!did || typeof did !== 'string') return false;
+
+    // Canonical signed bytes: prefer an explicit signedData field, else a
+    // deterministic JSON of the entry (excluding the signature envelope).
+    const signedData = typeof entry.signedData === 'string'
+      ? entry.signedData
+      : JSON.stringify(entry);
+
+    try {
+      // ZTAI.verifySignature throws for an unresolvable (unregistered) DID —
+      // treat that as fail-closed rather than asserting verified provenance.
+      return ZTAI.verifySignature(did, signedData, signature) === true;
+    } catch {
+      return false;
+    }
   }
 
   // TODO: implement when remote nodes are available
@@ -113,7 +151,10 @@ class EISClient {
 
   /**
    * [HARDEN] Generates a cryptographically signed auth header using the agent's DID.
-   * This ensures verifiable provenance of knowledge within the mesh.
+   * This attaches OUTBOUND provenance to locally-originated requests (it signs
+   * what this node sends). It does NOT verify the provenance of inbound remote
+   * entries — that is verifyRemoteProvenance's job, which fails closed unless a
+   * signature is cryptographically verified against a resolvable public key.
    */
   async getAuthHeader(action, resource) {
     const manager = new ZTAI();

package/bin/memory/vector-hub.js

@@ -56,6 +56,26 @@ class VectorHub {
     }
   }
 
+  /**
+   * Idempotently add a column to an existing table (lightweight migration).
+   * SQLite has no "ADD COLUMN IF NOT EXISTS", so we run the ALTER and swallow
+   * only the "duplicate column name" error — which simply means the column is
+   * already present (the table was created with it, or a prior run added it).
+   * Any other error is re-thrown so genuine schema problems surface loudly.
+   * @param {string} table
+   * @param {string} column
+   * @param {string} typeDecl - e.g. 'TEXT', 'INTEGER DEFAULT 0'
+   */
+  _addColumnIfMissing(table, column, typeDecl) {
+    try {
+      this._db.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${typeDecl}`);
+    } catch (err) {
+      if (!/duplicate column name/i.test(err && err.message)) {
+        throw err;
+      }
+    }
+  }
+
   /**
    * Initialize the WASM SQLite database and create tables + indexes.
    */
@@ -124,11 +144,23 @@ class VectorHub {
         id TEXT PRIMARY KEY,
         request_id TEXT NOT NULL,
         status TEXT NOT NULL,
+        did TEXT,
+        signed_message TEXT,
         attestation_payload TEXT,
         timestamp TEXT NOT NULL
       )
     `);
 
+    // UC-22 (audit finding #2): orbital attestations must carry the signer DID
+    // and the EXACT canonical message that was signed so verify() can re-check
+    // the cryptographic signature instead of trusting status='APPROVED' alone.
+    // CREATE TABLE IF NOT EXISTS won't add columns to a database created before
+    // this fix, so back-fill them with guarded ALTER TABLE statements. SQLite
+    // throws "duplicate column name" when the column already exists — that case
+    // is the success path (already migrated), so it is swallowed.
+    this._addColumnIfMissing('attestations', 'did', 'TEXT');
+    this._addColumnIfMissing('attestations', 'signed_message', 'TEXT');
+
     this._db.run(`
       CREATE TABLE IF NOT EXISTS mesh_config (
         key TEXT PRIMARY KEY,

package/bin/review/finding-synthesizer.js

@@ -6,6 +6,10 @@
 
 const SEVERITY_ORDER = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
 
+// A severity spread of this many levels (or more) within a single location-group
+// is treated as a contradiction (e.g. CRITICAL=3 vs LOW=0 → gap 3).
+const CONTRADICTION_GAP_THRESHOLD = 2;
+
 function synthesizeFindings(reviews) {
   const allFindings = [];
   const modelSpecific = {};
@@ -18,8 +22,9 @@ function synthesizeFindings(reviews) {
     }
   }
 
-  // Detect consensus
+  // Detect consensus and contradictions from the same location-groups.
   const consensus = [];
+  const contradictions = [];
   const processed = new Set();
 
   for (let i = 0; i < allFindings.length; i++) {
@@ -31,7 +36,7 @@ function synthesizeFindings(reviews) {
     for (let j = i + 1; j < allFindings.length; j++) {
       if (processed.has(j)) continue;
       const f2 = allFindings[j];
-      
+
       if (isSameFinding(f1, f2)) {
         group.push(f2);
         processed.add(j);
@@ -45,13 +50,12 @@ function synthesizeFindings(reviews) {
         severity: getHighestSeverity(group.map(f => f.severity)),
         models: group.map(f => f.model),
       });
+
+      const contradiction = detectContradiction(f1.location, group);
+      if (contradiction) contradictions.push(contradiction);
     }
   }
 
-  // Detect contradictions (large severity gap on same finding)
-  const contradictions = [];
-  // (In a real implementation, we'd more deeply analyze conflicting logic)
-
   return {
     consensus,
     model_specific: modelSpecific,
@@ -92,6 +96,31 @@ function normalizeLocation(loc) {
   });
 }
 
+function severityRank(severity) {
+  const idx = SEVERITY_ORDER.indexOf(severity);
+  return idx < 0 ? 0 : idx;
+}
+
+// A location-group is contradictory when its reviews disagree on severity by
+// CONTRADICTION_GAP_THRESHOLD levels or more (e.g. CRITICAL vs LOW). Reuses the
+// already-computed location-group rather than re-deriving it.
+function detectContradiction(location, group) {
+  const ranks = group.map(f => severityRank(f.severity));
+  const maxRank = Math.max(...ranks);
+  const minRank = Math.min(...ranks);
+
+  if (maxRank - minRank < CONTRADICTION_GAP_THRESHOLD) return null;
+
+  return {
+    location,
+    severities: group.map(f => f.severity),
+    models: group.map(f => f.model),
+    description: `Severity disagreement at ${location}: ` +
+      `${SEVERITY_ORDER[minRank]} vs ${SEVERITY_ORDER[maxRank]} ` +
+      `(${maxRank - minRank}-level gap across ${group.length} reviews)`,
+  };
+}
+
 function getHighestSeverity(severities) {
   let highest = 0;
   for (const s of severities) {

package/bin/security/trust-boundaries.js

@@ -70,15 +70,41 @@ function tagUntrusted(content, meta) {
 // character in a regex literal (eslint no-control-regex).
 const NUL = String.fromCharCode(0);
 
+// ${IFS} / $IFS are shell-internal field separators that expand to whitespace.
+// Attackers use them to avoid literal spaces between a destructive token and
+// its flags (rm${IFS}-rf${IFS}/). We normalize them back to a space so the
+// existing rm/-rf patterns catch the de-obfuscated form (audit #8).
+const IFS_TOKEN = /\$\{IFS\}|\$IFS/g;
+
+/**
+ * De-obfuscates shell metacharacter tricks WITHOUT emulating a real shell.
+ * Strips quotes (' ") and backslash escapes, collapses ${IFS}/$IFS to a space,
+ * then collapses runs of whitespace. This turns r''m, r"m, r\m and
+ * rm${IFS}-rf${IFS}/ back into plain `rm -rf /` so the existing patterns fire.
+ * Intentionally conservative: it removes characters rather than interpreting
+ * them, which can only make a string MORE likely to match (fail-toward-block).
+ */
+function normalizeShell(input) {
+  return input
+    .split(NUL).join('')          // shells ignore NUL; never let it split a token
+    .replace(IFS_TOKEN, ' ')       // ${IFS}/$IFS -> space
+    .replace(/[\\'"]/g, '')        // drop backslash escapes and quote chars
+    .replace(/\s+/g, ' ');         // collapse whitespace runs
+}
+
 /**
  * Detects high-impact / destructive commands via case-insensitive pattern matching.
  * Returns true if the command matches known destructive patterns.
+ *
+ * The detector errs toward blocking by design: this feeds a PreToolUse gate
+ * where approval friction is strictly preferable to a destructive bypass.
  */
 function isHighImpact(command) {
-  // Strip null bytes first — shells ignore them, so an attacker must not be
-  // able to use a NUL to split a destructive token and slip past the patterns.
-  const sanitized = String(command).split(NUL).join('');
+  // Normalize first so metacharacter-obfuscated commands (audit #8) are matched
+  // by the SAME pattern set as their plain-text equivalents.
+  const sanitized = normalizeShell(String(command));
   const patterns = [
+    // ── Original allowlist (unchanged) ──────────────────────────────────────
     /rm\s+(-\w*r\w*\s+-\w*f|(-\w*f\w*\s+-\w*r)|-\w*rf|-\w*fr)/i,
     /git\s+push\s+.*--force/i,
     /git\s+push\s+.*-f/i,
@@ -87,9 +113,75 @@ function isHighImpact(command) {
     /delete\s+from/i,
     /truncate\s+table/i,
     /\bmkfs(\.\w+)?\s+\/dev\//i,
-    /\bdd\b.*\bof=\/dev\//i,
+    // #11: any dd write target, not just /dev/ (dd if=... of=important.db).
+    // Original /dev/-only check is a subset of this, so it stays covered.
+    /\bdd\b.*\bof=/i,
     /\b(curl|wget)\b.*\|\s*(bash|sh|zsh)\b/i,
     /^\s*find\s+.*-delete\b/i,
+
+    // ── #4 Command/process substitution RCE ─────────────────────────────────
+    // `eval` anywhere is high-impact (dynamic code execution).
+    /\beval\b/i,
+    // Command substitution $(...) or backtick combined with a network fetch.
+    /\$\(\s*(curl|wget)\b/i,
+    new RegExp(String.fromCharCode(96) + '\\s*(curl|wget)\\b', 'i'),
+    // Process substitution feeding an interpreter: bash <(...), sh <(...).
+    /\b(bash|sh|zsh)\b.*<\(/i,
+    // Curl/wget directly inside a process substitution.
+    /<\(\s*(curl|wget)\b/i,
+
+    // ── #5 Interpreter invocation of a script file ──────────────────────────
+    // source <file> and `. <file>` are unambiguous script execution.
+    /\bsource\s+\S+/i,
+    /(^|[;&|]|\s)\.\s+\S+\.\w+/i,
+    // bash/sh/zsh running a .sh script — clearly script execution. Kept broad
+    // (any .sh) because shelling out to an arbitrary shell script is itself a
+    // strong execution signal; this also covers untrusted paths like
+    // `bash /tmp/x.sh`.
+    /\b(bash|sh|zsh)\s+\S*\.sh\b/i,
+    // node/python/etc. running a script — narrowed (UC-22). Running a project
+    // file is THE default safe action in a Node/Python repo, so a blanket
+    // `node <file>.js` match is a terrible signal-to-noise ratio and blocked
+    // the project's OWN idiom (`node tests/run-all.js`). We now flag ONLY when
+    // the script path looks UNTRUSTED — an absolute path (/...), a writable
+    // temp dir (/tmp, /var/tmp, /dev/shm), or a home-relative path (~/...) —
+    // i.e. the write-then-execute attack chain (drop payload in a writable
+    // location, then run it). Project-relative paths (tests/run-all.js,
+    // bin/foo.js, scripts/build.py, index.js) are NOT matched. Piped/
+    // substituted execution (curl | bash, $(...), <(...), backticks) is
+    // already covered by the #4 patterns above.
+    /\b(node|python3?|ruby|perl)\s+(~\/|\/)\S*\.(js|mjs|cjs|ts|py|rb|pl)\b/i,
+
+    // ── #7 Redirect-overwrite of critical files / devices ───────────────────
+    // > or >> targeting an absolute sensitive path (/etc/, /dev/, /boot/, /sys/,
+    // /proc/, /var/, /usr/, /bin/, /sbin/, /lib/). Project-local redirects
+    // (> out.log) are NOT matched.
+    />>?\s*\/(etc|dev|boot|sys|proc|var|usr|bin|sbin|lib|root|lib64)\//i,
+
+    // ── #8 handled by normalizeShell() above (de-obfuscation), no pattern here.
+
+    // ── #9 chmod dangerous modes ────────────────────────────────────────────
+    // Canonical dangerous octal modes only: 000 (full lockout) and the
+    // world-writable 666/777 family. Common safe modes (644/755/600/700/640)
+    // and symbolic modes (chmod +x build.sh) are intentionally NOT matched.
+    // ANY recursive chmod is also treated as high-impact regardless of mode.
+    /\bchmod\b.*\b(000|0?666|0?777)\b/i,
+    /\bchmod\s+-\w*[rR]/i,
+
+    // ── #10 chown recursive ─────────────────────────────────────────────────
+    /\bchown\s+-\w*[rR]/i,
+
+    // ── #12 mv of root / into /dev/null ─────────────────────────────────────
+    /\bmv\b.*\/dev\/null\b/i,
+    /\bmv\s+(-\w+\s+)?\/\s/i,
+
+    // ── #13 Process killers ─────────────────────────────────────────────────
+    /\bkill\s+-9\s+-1\b/i,
+    /\bkillall\b/i,
+    /\bpkill\b/i,
+
+    // ── #14 Power-state commands ────────────────────────────────────────────
+    /\b(shutdown|reboot|halt|poweroff)\b/i,
   ];
   return patterns.some(pattern => pattern.test(sanitized));
 }