mindforge-cc 11.2.0 → 11.3.0

package/bin/security/trust-gate-hook.js

@@ -16,13 +16,23 @@ process.stdin.on('end', () => {
     }
 
     const fullCommand = event.tool_input?.command || '';
-    const command = fullCommand.split('\n')[0];
 
-    if (isHighImpact(command)) {
+    // Check the whole command AND every individual line, blocking if ANY
+    // segment is high-impact. Per-line scanning means a benign first line
+    // cannot cloak a destructive command on a later line; the whole-string
+    // check catches patterns a line split might fragment. This is a security
+    // gate, so it errs toward blocking: a destructive keyword in (e.g.) a
+    // commit message will prompt for approval rather than risk a cloaked
+    // command slipping through. Approval friction is preferable to a bypass.
+    const lines = fullCommand.split('\n');
+    const offending = [fullCommand, ...lines].find((segment) => isHighImpact(segment));
+
+    if (offending) {
+      const display = offending.length > 80 ? offending.slice(0, 80) + '...' : offending;
       // Output a block reason (Claude Code shows this to the user)
       process.stdout.write(JSON.stringify({
         decision: 'block',
-        reason: `[TrustGate] High-impact command detected: "${command.substring(0, 80)}..." — requires explicit user approval`
+        reason: `[TrustGate] High-impact command detected: "${display}" — requires explicit user approval`
       }));
       process.exit(2); // block
     }

package/bin/skill-registry.js

@@ -124,31 +124,42 @@ function handleInstall() {
   if (tier === '1') targetBase = '.mindforge/skills';
   if (tier === '3') targetBase = '.mindforge/project-skills';
 
+  // Resolve a real local source for the skill. There is no remote registry
+  // backend, so the ONLY honest sources are an examples/ entry or a SKILL.md in
+  // the current working directory (the agentic authoring flow).
+  const exampleSrc = path.join(process.cwd(), 'examples', 'skills', `${skillName}.md`);
+  const localSrc = path.join(process.cwd(), 'SKILL.md');
+
+  let source = null;
+  if (fs.existsSync(exampleSrc)) {
+    source = exampleSrc;
+  } else if (fs.existsSync(localSrc)) {
+    source = localSrc;
+  }
+
+  if (!source) {
+    // HONEST REFUSAL (UC-22): no local source and no remote registry is
+    // configured. Do NOT write a placeholder file that masquerades as an
+    // installed skill — that would falsely report success. Refuse clearly and
+    // exit non-zero so callers can detect the failure.
+    console.error(
+      `❌ Skill '${skillName}' not found locally and no remote registry is configured — nothing installed.`
+    );
+    console.error(
+      '   Provide a source first: place a SKILL.md in the current directory ' +
+      `or add examples/skills/${skillName}.md, then re-run.`
+    );
+    process.exit(1);
+  }
+
+  // Real source found → perform the actual install.
   const targetDir = path.join(process.cwd(), targetBase, skillName);
   if (!fs.existsSync(targetDir)) {
     fs.mkdirSync(targetDir, { recursive: true });
   }
-
-  // Mock behavior for Day 3/4 testing if no real registry
-  // Expect source to be in examples/ if it exists, otherwise just touch it
-  const mockSrc = path.join(process.cwd(), 'examples', 'skills', `${skillName}.md`);
   const targetFile = path.join(targetDir, 'SKILL.md');
-
-  if (fs.existsSync(mockSrc)) {
-    fs.copyFileSync(mockSrc, targetFile);
-    console.log(`  ✅ Copied from ${mockSrc}`);
-  } else {
-    // If no source, we look for it in the current dir for the agentic flow
-    const localSrc = path.join(process.cwd(), 'SKILL.md');
-    if (fs.existsSync(localSrc)) {
-       fs.copyFileSync(localSrc, targetFile);
-       console.log('  ✅ Copied from local SKILL.md');
-    } else {
-       // Just create a placeholder for testing if nothing else
-       fs.writeFileSync(targetFile, `---\nname: ${skillName}\nversion: 1.0.0\nstatus: alpha\ntriggers: test, mock, placeholder\n---\n# ${skillName}\nPlaceholder for ${skillName} skill.\n`);
-       console.log('  ⚠️  Created mock SKILL.md (no source found)');
-    }
-  }
+  fs.copyFileSync(source, targetFile);
+  console.log(`  ✅ Installed ${skillName} from ${path.relative(process.cwd(), source)}`);
 
   process.exit(0);
 }

package/bin/spawn-agent.js

@@ -10,17 +10,83 @@ const fs = require('fs');
 const path = require('path');
 
 const ARGS = process.argv.slice(2);
-const MODE = ARGS[0]; // 'spawn' or 'identity'
+const MODE = ARGS[0]; // 'spawn', 'identity', or 'subagent'
 const TARGET = ARGS[1];
 const IS_DRY_RUN = ARGS.includes('--dry-run');
 
 const ROOT = path.resolve(__dirname, '..');
+const SUBAGENTS_DIR = path.join(ROOT, 'subagents');
+const INDEX_PATH = path.join(ROOT, '.mindforge', 'imported-agents.jsonl');
+
+// Names are restricted to a strict allowlist: no path separators, no '..', and
+// only [A-Za-z0-9-_]. This is the first line of defense against path traversal
+// in the `subagent` mode — names that fail this never touch the filesystem.
+const SAFE_NAME_PATTERN = /^[A-Za-z0-9-_]+$/;
 
 if (!MODE || !TARGET) {
   console.error('❌ Usage: node bin/spawn-agent.js <mode> <target> [--dry-run]');
+  console.error('   modes: identity | spawn | subagent');
   process.exit(1);
 }
 
+/**
+ * Validate a user-supplied subagent name against the strict allowlist. Rejects
+ * path separators, parent-dir tokens, and any character outside [A-Za-z0-9-_].
+ * Exits the process on violation rather than returning, so no unsafe name can
+ * proceed to a filesystem lookup.
+ */
+function assertSafeName(name) {
+  if (!SAFE_NAME_PATTERN.test(name)) {
+    console.error(`❌ Invalid subagent name: "${name}" (allowed: A-Z a-z 0-9 - _)`);
+    process.exit(1);
+  }
+}
+
+/**
+ * Resolve a subagent name to its index entry by EXACT name match. Never builds
+ * a path from user input — only paths recorded in the trusted index are used.
+ * Returns the matching entry or null if no entry matches.
+ */
+function findIndexEntry(name) {
+  if (!fs.existsSync(INDEX_PATH)) {
+    console.error(`❌ Subagent index not found: ${INDEX_PATH}`);
+    console.error('   Run: node scripts/build-subagent-index.js');
+    process.exit(1);
+  }
+
+  const lines = fs.readFileSync(INDEX_PATH, 'utf8').split('\n');
+  for (const line of lines) {
+    if (!line.trim()) {
+      continue;
+    }
+    const entry = JSON.parse(line);
+    if (entry.name === name) {
+      return entry;
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolve and verify the absolute path for an index entry. Confirms the
+ * resolved path stays within the repo's subagents/ directory before returning
+ * it (defense in depth against a tampered index). Exits on any violation.
+ */
+function resolveSubagentPath(entry) {
+  const absolutePath = path.resolve(ROOT, entry.path);
+  const containmentRoot = SUBAGENTS_DIR + path.sep;
+
+  if (!absolutePath.startsWith(containmentRoot)) {
+    console.error(`❌ Resolved path escapes subagents/: ${absolutePath}`);
+    process.exit(1);
+  }
+  if (!fs.existsSync(absolutePath)) {
+    console.error(`❌ Subagent file missing: ${absolutePath}`);
+    process.exit(1);
+  }
+  return absolutePath;
+}
+
 async function run() {
   let identityPath;
   let personaPath;
@@ -39,6 +105,19 @@ async function run() {
       process.exit(1);
     }
     console.log(`🌌 Spawning persona essence: ${TARGET}`);
+  } else if (MODE === 'subagent') {
+    assertSafeName(TARGET);
+    const entry = findIndexEntry(TARGET);
+    if (!entry) {
+      console.error(`❌ Subagent not found in index: ${TARGET}`);
+      process.exit(1);
+    }
+    const subagentPath = resolveSubagentPath(entry);
+    fs.readFileSync(subagentPath, 'utf8'); // verify readability before dispatch
+    console.log(`🧬 Loading imported subagent: ${TARGET} [${entry.category}/${entry.model}]`);
+  } else {
+    console.error(`❌ Unknown mode: ${MODE} (expected identity | spawn | subagent)`);
+    process.exit(1);
   }
 
   if (IS_DRY_RUN) {

package/bin/sre/shadow-mirror.js

@@ -1,13 +1,28 @@
 /**
  * MindForge v9.0.0 — Temporal Shadow Mirror (Pillar XXI)
- * Hybrid isolation for incident replication.
+ *
+ * Incident replication via git-worktree isolation.
+ *
+ * ISOLATION HONESTY (audit finding #24 / UC-22):
+ * This module provides GIT WORKTREE isolation only — a separate working tree
+ * and branch off the current repo. It does NOT provide container/Docker
+ * isolation (no separate kernel, network, filesystem, or process namespaces).
+ * A `docker --version` probe gates an "enhanced" path, but that path still runs
+ * in a git worktree; real Docker orchestration (build/run/mount) is a
+ * NOT-YET-IMPLEMENTED future enhancement. The returned mirror is always a
+ * worktree, and `activeMirror.isolation` reports the actual level provided.
  */
 'use strict';
 
-const { execSync } = require('node:child_process');
+const { execSync, execFileSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
-const crypto = require('node:crypto');
+
+// remediation_id flows from the SRE sentinel (a trust boundary) into git
+// branch/worktree names. Only allow a safe identifier charset and reject
+// anything that could be read as a flag or shell metacharacter. Defence in
+// depth on top of execFileSync (argv array, no shell). Fail-closed.
+const SAFE_REMEDIATION_ID = /^[A-Za-z0-9._-]+$/;
 
 class ShadowMirror {
   constructor(options = {}) {
@@ -15,32 +30,58 @@ class ShadowMirror {
     this.activeMirror = null;
   }
 
+  /**
+   * Validates a remediation_id (trust-boundary input) before it is used to
+   * build git branch/worktree names. Fail-closed: throws on missing, empty,
+   * overlong, flag-like, or metacharacter-bearing ids. Returns the id on pass.
+   * Static so it can be unit-tested in isolation.
+   */
+  static sanitizeRemediationId(id) {
+    if (typeof id !== 'string' || id.length === 0 || id.length > 128) {
+      throw new Error('[ShadowMirror] invalid remediation_id: must be a non-empty string of <=128 chars');
+    }
+    if (id.startsWith('-')) {
+      throw new Error('[ShadowMirror] invalid remediation_id: must not start with "-"');
+    }
+    if (!SAFE_REMEDIATION_ID.test(id)) {
+      throw new Error('[ShadowMirror] invalid remediation_id: only [A-Za-z0-9._-] characters allowed');
+    }
+    return id;
+  }
+
   /**
    * Orchestrates replication based on incident severity and requirements.
    */
   async replicate(incident) {
     console.log(`🌀 Shadow Mirror: Replicating incident [${incident.remediation_id}]...`);
-    
-    // Choose isolation level
-    const level = (incident.details?.severity === 'CRITICAL') ? 2 : 1;
-    
-    if (level === 2 && this.isDockerAvailable()) {
-      return this.replicateLevel2(incident);
-    } else {
-      return this.replicateLevel1(incident);
+
+    // All replication currently runs in a git worktree (see file header).
+    // For CRITICAL incidents where a Docker toolchain is present we note that a
+    // future container-isolation path could be used, but we DO NOT claim to run
+    // it — we still replicate in a worktree and label it honestly.
+    const wantsContainer = incident.details?.severity === 'CRITICAL' && this.isDockerAvailable();
+
+    if (wantsContainer) {
+      return this.replicateCriticalWorktree(incident);
     }
+    return this.replicateLevel1(incident);
   }
 
   /**
    * Level 1 Replication: Git Worktree
-   * High-speed, lightweight logic isolation.
+   * High-speed, lightweight logic isolation (NOT container isolation).
+   *
+   * Provides a separate working tree + branch off the current repo. This
+   * isolates source/logic changes; it shares the host kernel, network,
+   * filesystem and process namespaces with the running engine.
    */
   async replicateLevel1(incident) {
-    const mirrorId = `mirror-${incident.remediation_id}`;
+    const remediationId = ShadowMirror.sanitizeRemediationId(incident.remediation_id);
+    const mirrorId = `mirror-${remediationId}`;
     const mirrorPath = path.join(this.baseDir, mirrorId);
-    const branchName = `sre-repro-${incident.remediation_id}`;
+    const branchName = `sre-repro-${remediationId}`;
 
-    console.log(`[Level 1] Creating git worktree at ${mirrorPath}...`);
+    console.log(`[worktree] Creating git worktree at ${mirrorPath}...`);
 
     try {
       if (!fs.existsSync(this.baseDir)) {
@@ -49,41 +90,46 @@ class ShadowMirror {
 
       // 1. Create a reproduction branch and add worktree in one step (Atomic)
       // In a real system, we'd base this on the commit hash from the trace_id
-      execSync(`git worktree add -b ${branchName} ${mirrorPath}`, { stdio: 'ignore' });
-      
-      this.activeMirror = { path: mirrorPath, branch: branchName, type: 'worktree' };
+      // execFileSync with an argv array — no shell, so branchName/mirrorPath
+      // cannot inject commands even if they somehow contained metacharacters.
+      execFileSync('git', ['worktree', 'add', '-b', branchName, mirrorPath], { stdio: 'ignore' });
+
+      this.activeMirror = {
+        path: mirrorPath,
+        branch: branchName,
+        type: 'worktree-isolation',
+        // Honest disclosure of the isolation actually provided.
+        isolation: 'git-worktree',
+      };
 
       // 3. Inject incident metadata for the agent to use
       fs.writeFileSync(path.join(mirrorPath, 'REPLICATION.json'), JSON.stringify(incident, null, 2));
 
       return mirrorPath;
     } catch (err) {
-      console.error(`[ShadowMirror] Level 1 replication failed: ${err.message}`);
+      console.error(`[ShadowMirror] worktree replication failed: ${err.message}`);
       throw err;
     }
   }
 
   /**
-   * Level 2 Replication: Docker Sandbox
-   * Full environment isolation for state-bound incidents.
+   * CRITICAL-incident replication when a Docker toolchain is detected.
+   *
+   * HONESTY: This still replicates in a GIT WORKTREE. It does not build or run
+   * a container, does not mount any volume, and does not provide container
+   * isolation. Real Docker sandboxing (build/run/mount) is a NOT-YET-IMPLEMENTED
+   * enhancement tracked separately; until it lands, this path is identical in
+   * isolation guarantees to {@link replicateLevel1} and is labelled as such.
    */
-  async replicateLevel2(incident) {
-    console.log('[Level 2] Initializing Docker sandbox interface...');
-    // For the hackathon demo, we'll scaffold the Docker-ready worktree which would then be mounted
+  async replicateCriticalWorktree(incident) {
+    console.log('[worktree] CRITICAL incident: replicating in git worktree (container isolation not implemented).');
     const mirrorPath = await this.replicateLevel1(incident);
-    
-    const dockerfile = `
-FROM node:18-slim
-WORKDIR /app
-COPY . .
-RUN npm install --production
-CMD ["node", "bin/engine/logic-validator.js"]
-    `;
-    
-    fs.writeFileSync(path.join(mirrorPath, 'Dockerfile.sre'), dockerfile);
-    console.log(`[Level 2] Dockerfile.sre generated at ${mirrorPath}. Mounting volume for isolation.`);
-    
-    this.activeMirror.type = 'docker-hybrid';
+
+    // Note the unimplemented future path without claiming it ran.
+    this.activeMirror.dockerAvailable = true;
+    this.activeMirror.note =
+      'docker binary detected; real container isolation is a future enhancement — this mirror used git-worktree isolation only';
+
     return mirrorPath;
   }
 
@@ -104,9 +150,13 @@ CMD ["node", "bin/engine/logic-validator.js"]
 
     console.log(`🧹 Cleaning up Shadow Mirror: ${this.activeMirror.path}...`);
     try {
-      if (this.activeMirror.type === 'worktree' || this.activeMirror.type === 'docker-hybrid') {
-        execSync(`git worktree remove ${this.activeMirror.path} --force`, { stdio: 'ignore' });
-        execSync(`git branch -D ${this.activeMirror.branch}`, { stdio: 'ignore' });
+      // Every mirror this module produces is a git worktree (see replicate()).
+      // Accept the legacy 'worktree'/'docker-hybrid' labels for backward compat
+      // in case an older serialized mirror is handed in.
+      const worktreeTypes = ['worktree-isolation', 'worktree', 'docker-hybrid'];
+      if (worktreeTypes.includes(this.activeMirror.type)) {
+        execFileSync('git', ['worktree', 'remove', this.activeMirror.path, '--force'], { stdio: 'ignore' });
+        execFileSync('git', ['branch', '-D', this.activeMirror.branch], { stdio: 'ignore' });
         // Clean up the folder just in case
         if (fs.existsSync(this.activeMirror.path)) {
           fs.rmSync(this.activeMirror.path, { recursive: true });

package/bin/utils/append-queue.js

@@ -17,6 +17,18 @@ const fs = require('fs');
 // unboundedly. Revisit with an LRU/eviction policy if dynamic paths are needed.
 const queues = new Map();
 
+/**
+ * @deprecated No production caller. The real durable-append path is
+ * `appendDurableSync` in `bin/memory/knowledge-store.js` (synchronous
+ * openSync+writeSync+fsyncSync+closeSync), which all audit/KB write sites use.
+ * This async single-writer queue is retained only as a tested reference
+ * implementation for the in-process serialized-append pattern (UC-09) and is
+ * exercised solely by `tests/append-queue.test.js`. Do NOT wire it into new
+ * code without first reconciling it with the canonical sync path.
+ *
+ * @param {string} filePath — file to serialize appends for
+ * @returns {{append: (line: string) => Promise<void>, drain: () => Promise<void>}}
+ */
 function createAppendQueue(filePath) {
   if (!queues.has(filePath)) queues.set(filePath, Promise.resolve());
 

package/bin/utils/file-io.js

@@ -3,7 +3,6 @@
 const fs = require('fs');
 const fsp = require('fs/promises');
 const path = require('path');
-const zlib = require('zlib');
 
 /**
  * Hash-chained audit writer (class API preserved for nexus-tracer + policy-engine).
@@ -28,8 +27,9 @@ class AuditWriter {
   }
 
   async write(entry) {
-    // Lazy require to avoid a require-cycle: audit-writer.js requires this file
-    // (AuditRotator) at load time, so we cannot require it at module top level.
+    // Lazy require (not module-top-level) to keep this leaf utility free of a
+    // load-time dependency on the autonomous layer and avoid any future require
+    // cycle: bin/autonomous/audit-writer.js is the canonical durable-append site.
     const { appendAuditEntrySync } = require('../autonomous/audit-writer');
     const chained = appendAuditEntrySync(this._path, entry);
     this._lastHash = chained._hash;
@@ -110,45 +110,4 @@ async function atomicWriteJSONAsync(filePath, data) {
   await fsp.rename(tmpPath, filePath);
 }
 
-class AuditRotator {
-  constructor(options = {}) {
-    this.maxLines = options.maxLines || 5000;
-  }
-
-  shouldRotate(filePath) {
-    if (!fs.existsSync(filePath)) return false;
-    const content = fs.readFileSync(filePath, 'utf8');
-    const lineCount = content.split('\n').filter(l => l.trim()).length;
-    return lineCount >= this.maxLines;
-  }
-
-  rotate(filePath, archiveDir) {
-    const dir = archiveDir || path.join(path.dirname(filePath), '..', 'audit-archive');
-    if (!fs.existsSync(dir)) {
-      fs.mkdirSync(dir, { recursive: true });
-    }
-
-    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
-    const baseName = path.basename(filePath, path.extname(filePath));
-    const archiveName = `${baseName}-${timestamp}.jsonl.gz`;
-    const archivePath = path.join(dir, archiveName);
-
-    // Crash-safe: write archive FIRST, then truncate source
-    const content = fs.readFileSync(filePath);
-    const compressed = zlib.gzipSync(content);
-    fs.writeFileSync(archivePath, compressed);
-
-    const lines = content.toString('utf8').split('\n').filter(l => l.trim());
-    const carryover = lines.slice(-100).join('\n') + '\n';
-    const tmpPath = filePath + '.tmp.' + process.pid;
-    const fd = fs.openSync(tmpPath, 'w');
-    fs.writeSync(fd, carryover);
-    fs.fsyncSync(fd);
-    fs.closeSync(fd);
-    fs.renameSync(tmpPath, filePath);
-
-    return archivePath;
-  }
-}
-
-module.exports = { AuditWriter, AuditRotator, readJSON, writeJSON, readJSONL, readJSONSync, atomicWriteJSON, atomicWriteJSONAsync };
+module.exports = { AuditWriter, readJSON, writeJSON, readJSONL, readJSONSync, atomicWriteJSON, atomicWriteJSONAsync };

package/bin/utils/version-check.js

@@ -3,12 +3,25 @@
  * MindForge version single-source-of-truth + drift detector.
  * package.json is canonical; everything else must agree.
  */
+const fs = require('fs');
 const path = require('path');
 // Use the repo's stricter reader: returns null only on ENOENT and RE-THROWS on
 // parse errors. Re-throwing on a corrupt JSON source is the fail-closed
 // behavior we want — a file we cannot parse means we cannot establish truth.
 const { readJSONSync } = require('./file-io');
 
+/**
+ * Extracts `[VERSION] = X` from MINDFORGE.md. Returns null when the file is
+ * absent or the marker is missing (treated as skip, not drift).
+ */
+function readMindforgeMdVersion(projectRoot) {
+  const mdPath = path.join(projectRoot, 'MINDFORGE.md');
+  if (!fs.existsSync(mdPath)) return null;
+  const text = fs.readFileSync(mdPath, 'utf8');
+  const match = text.match(/\[VERSION\]\s*=\s*([^\s]+)/);
+  return match ? match[1].trim() : null;
+}
+
 /**
  * @param {string} projectRoot
  * @returns {{ canonical: string|null, sources: Record<string,string|null>, drift: string[] }}
@@ -18,14 +31,17 @@ function checkVersionConsistency(projectRoot) {
   const canonical = pkg ? pkg.version : null;
 
   const configJson = readJSONSync(path.join(projectRoot, '.mindforge', 'config.json'));
-  // Runtime drift coverage is intentionally limited to package.json (canonical)
-  // vs .mindforge/config.json — the live config is the operational drift risk
-  // during `auto`. Wider agreement (sdk/package.json, MINDFORGE.md [VERSION]) is
-  // enforced by the test suite (tests/version-consistency.test.js), not at
-  // runtime — do not assume this checker provides full version coverage.
+  const sdkPkg = readJSONSync(path.join(projectRoot, 'sdk', 'package.json'));
+  const mindforgeMdVersion = readMindforgeMdVersion(projectRoot);
+  // Runtime coverage now spans every source the test suite knows about, so
+  // drift in any of them halts `auto` — not just the live config. Absent
+  // optional sources (no sdk/, no MINDFORGE.md) read as null and are SKIPPED
+  // (not counted as drift); only a present-but-mismatched source flags drift.
   const sources = {
     'package.json': canonical,
     '.mindforge/config.json': configJson ? configJson.version : null,
+    'sdk/package.json': sdkPkg ? sdkPkg.version : null,
+    'MINDFORGE.md': mindforgeMdVersion,
   };
 
   const drift = [];

package/bin/wizard/theme.js

@@ -125,14 +125,15 @@ const Theme = {
    * Print Manifest (Hardened for V2)
    */
   printManifest(stats = {}) {
-    const { personas = 117, skills = 20, governance = 4, integrations = 7, actions = 71, docs = 12, templates = 21 } = stats;
-    
+    const { personas = 117, skills = 20, subagents = 154, governance = 4, integrations = 7, actions = 71, docs = 12, templates = 21 } = stats;
+
     console.log(`  ${this.colors.bold('PAYLOAD MANIFEST')}`);
     console.log(`  ${this.colors.dim('┌' + '─'.repeat(74) + '┐')}`);
-    
+
     const rows = [
       ['PERSONAS', personas, 'The autonomous persona ecosystem'],
       ['SKILLS', skills, 'Enterprise-grade skill packs'],
+      ['SUBAGENTS', subagents, 'Specialized Claude Code subagents'],
       ['GOVERNANCE', governance, 'Compliance and safety modules'],
       ['INTEGRATIONS', integrations, 'Multi-platform connector suite'],
       ['REFERENCES', docs, 'Standardized architecture references'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mindforge-cc",
-  "version": "11.2.0",
+  "version": "11.3.0",
   "description": "MindForge \u2014 Sovereign Agentic Intelligence Framework. Sovereign Stability: Production-Hardened Agentic Intelligence (v11)",
   "bin": {
     "mindforge-cc": "bin/install.js",
@@ -16,6 +16,8 @@
     ".mindforge/skills/",
     ".mindforge/engine/",
     "bin/",
+    "subagents/",
+    ".mindforge/imported-agents.jsonl",
     "docs/getting-started.md",
     "docs/user-guide.md",
     "docs/sdk-reference.md",

package/subagents/.claude-plugin/marketplace.json

@@ -0,0 +1,93 @@
+{
+  "name": "mindforge-subagents",
+  "owner": {
+    "name": "MindForge Team",
+    "url": "https://github.com/sairam0424"
+  },
+  "metadata": {
+    "version": "1.0.3",
+    "description": "Curated collection of 154 specialized Claude Code subagents organized into 10 focused categories"
+  },
+  "plugins": [
+    {
+      "name": "mindforge-core-dev",
+      "source": "./categories/01-core-development",
+      "description": "Essential development subagents for everyday coding tasks - backend, frontend, fullstack, mobile, and API design",
+      "version": "1.0.2",
+      "category": "development",
+      "keywords": ["backend", "frontend", "fullstack", "mobile", "api", "microservices"]
+    },
+    {
+      "name": "mindforge-lang",
+      "source": "./categories/02-language-specialists",
+      "description": "Language-specific expert agents with deep framework knowledge - Python, TypeScript, Go, Rust, Java, and more",
+      "version": "1.0.4",
+      "category": "development",
+      "keywords": ["python", "typescript", "golang", "rust", "java", "react", "vue", "angular", "expo", "react-native", "node"]
+    },
+    {
+      "name": "mindforge-infra",
+      "source": "./categories/03-infrastructure",
+      "description": "DevOps, cloud, and deployment specialists - Kubernetes, Terraform, AWS, Azure, GCP, and SRE",
+      "version": "1.0.1",
+      "category": "infrastructure",
+      "keywords": ["devops", "docker", "kubernetes", "terraform", "aws", "azure", "gcp", "sre", "cloud"]
+    },
+    {
+      "name": "mindforge-qa-sec",
+      "source": "./categories/04-quality-security",
+      "description": "Testing, security, and code quality experts - code review, penetration testing, QA automation",
+      "version": "1.1.1",
+      "category": "quality",
+      "keywords": ["testing", "security", "code-review", "qa", "penetration-testing", "compliance", "ui-testing", "ux-testing"]
+    },
+    {
+      "name": "mindforge-data-ai",
+      "source": "./categories/05-data-ai",
+      "description": "Data engineering, ML, and AI specialists - data pipelines, machine learning, LLM architecture",
+      "version": "1.0.2",
+      "category": "data",
+      "keywords": ["data-engineering", "machine-learning", "ai", "llm", "mlops", "nlp"]
+    },
+    {
+      "name": "mindforge-dev-exp",
+      "source": "./categories/06-developer-experience",
+      "description": "Tooling and developer productivity experts - CLI tools, documentation, README generation, and DX optimization",
+      "version": "1.0.3",
+      "category": "tooling",
+      "keywords": ["developer-experience", "cli", "documentation", "readme", "tooling", "build", "dx"]
+    },
+    {
+      "name": "mindforge-domains",
+      "source": "./categories/07-specialized-domains",
+      "description": "Domain-specific technology experts - blockchain, fintech, gaming, IoT, payments",
+      "version": "1.0.2",
+      "category": "specialized",
+      "keywords": ["blockchain", "fintech", "gaming", "iot", "payments", "embedded"]
+    },
+    {
+      "name": "mindforge-biz",
+      "source": "./categories/08-business-product",
+      "description": "Product, legal, and business specialists - product strategy, licensing, project management, UX research",
+      "version": "1.0.3",
+      "category": "business",
+      "keywords": ["product-management", "business-analysis", "legal", "licensing", "ux", "scrum", "project-management"]
+    },
+    {
+      "name": "mindforge-meta",
+      "source": "./categories/09-meta-orchestration",
+      "description": "Agent coordination and meta-programming - multi-agent orchestration, workflow automation, and safe refactor governance. Works best with other mindforge plugins installed.",
+      "version": "1.0.3",
+      "category": "orchestration",
+      "keywords": ["multi-agent", "orchestration", "workflow", "coordination", "meta", "refactor", "codebase-governance"]
+    },
+    {
+      "name": "mindforge-research",
+      "source": "./categories/10-research-analysis",
+      "description": "Research, search, and analysis specialists - market research, competitive analysis, trend forecasting, and idea validation",
+      "version": "1.0.4",
+      "category": "research",
+      "keywords": ["research", "analysis", "market-research", "competitive-analysis", "trends", "idea-validation", "product-strategy"]
+    }
+  ]
+}