mindforge-cc 11.9.5 → 11.9.7

package/.mindforge/config.json

@@ -1,5 +1,5 @@
 {
-  "version": "11.9.5",
+  "version": "11.9.7",
   "environment": "development",
   "governance": {
     "drift_threshold": 0.75,

package/CHANGELOG.md

@@ -1,5 +1,172 @@
 # Changelog
 
+## [11.9.7] — 2026-09-20 — The install banner stops contradicting itself
+
+Patch release. Found by actually running the documented install command
+(`npx mindforge-cc@latest --claude --local`) in a clean project instead of stopping at
+`--version` — the check that should have caught the v11.9.6 regressions below before they
+shipped.
+
+### Fixed
+
+**Two real bugs in the install banner itself, both live in every v11.9.6 install**
+
+- **Version self-contradiction.** The top banner (`bin/wizard/theme.js`'s
+  `printBrandManifest()`) hardcoded `SOVEREIGN INTELLIGENCE v8.1.1`, while the install
+  activation line two screens later (`bin/installer-core.js`) prints `v8.2.0` for the same
+  subsystem — one command, two version numbers. Standardized on `v8.2.0`.
+- **False "Enabled" claim.** The same top banner said `PQAS & Proactive Homing Enabled`
+  unconditionally, directly contradicting the accurate disclosure a few lines later in the
+  same run: "available in simulated/experimental mode (inactive by default)". Changed to
+  `PQAS (simulated) & Proactive Homing`. `bin/engine/learning-manager.js` carried the
+  identical string; fixed there too.
+- **Dead docs link.** The banner's `Docs: https://docs.mindforge.cc` fails TLS handshake —
+  DNS resolves but no site was ever deployed there. Repointed to the real, verified-live
+  `https://github.com/sairam0424/MindForge#documentation`.
+
+**Doc regression from the v11.9.6 pass, self-inflicted**
+
+- The persona-count reconciliation in v11.9.6 used a naive
+  `find .mindforge/personas -type f | wc -l` (218), which silently swept in
+  `swarm-templates.json` and `overrides/README.md` — neither is a persona. The installer's
+  own `collectManifestStats()` counts top-level `.md` files only: **216**, matching the
+  preserved 2026-08-16 codebase-index snapshot. Reverted `README.md`,
+  `docs/CAPABILITIES-MANIFEST.md`, `docs/user-guide.md`, `docs/PERSONAS.md`,
+  `docs/registry/PERSONAS.md`, and `docs/registry/README.md`.
+
+## [11.9.6] — 2026-09-20 — The docs stop overselling what the code discloses about itself
+
+Patch release. No new features — this is the release-readiness pass before pointing real
+users at the project for the first time, and it found the same pattern one more time:
+code that honestly labels its own simulated/dormant parts, sitting under docs that hadn't
+caught up. Every fix below was hand-verified against the live source or a real command
+run, not carried over from a prior audit's prose.
+
+### Fixed
+
+**Two real, reproducible bugs**
+
+- **`/mindforge:learn` crashed on every skill that scored high enough to register.**
+  `bin/skills-builder/learn-cli.js` called `skill-registrar.js`'s `register()` with two
+  positional string arguments (`skillPath`, `'project'`); `register()` destructures a
+  single options object, so every call threw inside it, silently swallowed by the CLI's
+  generic catch. A validly-generated `SKILL.md` never reached `MANIFEST.md`, and the CLI
+  reported a bare `❌ Error`. Fixed the call site to pass `{ skillName, skillPath, tier,
+  qualityScore, sourceType, source }`, matching `register()`'s real signature.
+
+- **`bin/browser/browser-daemon.js` printed its own bearer token to stdout** (captured
+  verbatim into the persistent `.planning/browser-daemon.log` by `daemon-manager.js`),
+  and gated only `/evaluate` — `/navigate`, `/click`, `/type`, and `/screenshot` had no
+  auth check at all. The idle-timeout path also called `process.exit(0)` directly,
+  bypassing the token-file cleanup in `shutdown()`. Fixed all three: the startup log now
+  prints only the token's file path, the auth check runs once before dispatch and covers
+  every route but `/status`, and the idle path calls the real `shutdown()`.
+
+**A test with a blind spot for the exact bug it exists to catch**
+
+- `tests/sdk-exports.test.js` guards against any tracked file instructing
+  `require('@mindforge/sdk')` — the unpublished, wrong package name (`sdk/package.json`
+  publishes as `mindforge-sdk`). Its scan used `git ls-files -z '*.md' '*.ts'`, which
+  cannot match `.js` files — so it did not, and could not, catch the live occurrence in
+  `examples/sdk-integration/index.js`. Fixed both: the import, and the pathspec (now also
+  `*.js`/`*.mjs`/`*.cjs`, with `tests/` added to the same "records, not instructions"
+  allowlist as `changelogs/`, since this file's own `WRONG` string literal would otherwise
+  self-flag).
+
+**A dashboard that rendered success while showing nothing**
+
+- Three more panels in `bin/dashboard/frontend/app.js` read response fields their real
+  backing functions in `metrics-aggregator.js` have never produced — the same bug class
+  already fixed once for the avg-quality tile, left unaddressed here. `refreshMemory()`
+  read `data.graph`/`data.count`; the real shape is `{ entries, total }`. `refreshTeam()`
+  called `.map()` on the whole response object; the real shape is `{ active, conflicts }`
+  with `email`/`last_seen`/`current_task` fields, not `user`/`action`/`timestamp`.
+  `drawCharts()` read `state.costs`/`state.quality`, fields `/api/metrics` never returns;
+  the real per-session series is `state.sessions[].cost_usd` /
+  `state.sessions[].quality_score`. All three failed silently behind an empty `catch`, so
+  the panels looked idle rather than broken. Fixed to read the real shapes.
+
+**Two shipped documents that stated the opposite of the code**
+
+- `SECURITY.md` claimed `AUDIT.jsonl` "auto-archives beyond 5000 lines with gzip
+  compression" — that rotation mechanism was removed in an earlier release specifically
+  because truncating the file broke the hash chain (it orphans `previous_hash` pointers to
+  archived entries). The log grows unbounded by design; the doc now says so.
+- `docs/security/SECURITY.md` had drifted into a second, independent copy of this policy
+  with a `5.x.x`/`4.x.x`/`< 4.0.0` support table — years behind the real `11.x` line the
+  root `/SECURITY.md` (the canonical file) documents. Replaced with a pointer to the root
+  file so this can't re-drift.
+
+**A stale Homebrew formula**
+
+- `Formula/mindforge.rb` was pinned to `11.9.3` (url, sha256, and the version-assertion
+  test) — two releases behind, so `brew install mindforge` installed an old build with
+  none of 11.9.4/11.9.5's fixes. Re-pinned to the real published `11.9.5` tarball with its
+  actual sha256 (fetched and hashed directly, not carried over). This is the same drift
+  class the project has hit twice before (11.9.2 shipped with this file and `Dockerfile`
+  four releases behind); `Formula/mindforge.rb` will lag one release again until
+  `node scripts/sync-version.js --fetch-sha` runs after this version publishes — expected,
+  not a regression.
+
+### Changed — a documentation honesty pass
+
+The following describe MindForge's own PQAS (post-quantum crypto), ZTAI (Zero-Trust
+Agentic Identity), and "Pillar"-numbered subsystems as live, unconditional security
+guarantees. They are not: `bin/governance/quantum-crypto.js` and
+`bin/governance/ztai-manager.js` self-label these SIMULATED and gate them off the live
+trust path by default (`SECURITY_TIER_3_SIMULATED = true`), and `SwarmController` /
+`PersonaFactory` / `WaveExecutor` are role names in markdown specs with no backing file —
+a distinction this repo's own `.claude/CLAUDE.md` already draws, just not everywhere yet.
+Rewrote each to match the same "measured, not asserted" tone already used in
+`docs/faq.md` and `docs/troubleshooting.md` and the root README's *What is actually
+enforced* section:
+
+`docs/usp-features.md`, `CODEBASE-MAP.md`, `docs/architecture/README.md`,
+`docs/CAPABILITIES-MANIFEST.md`, `docs/governance-guide.md`,
+`docs/MIND-FORGE-REFERENCE-V6.md`, `docs/INTELLIGENCE-MESH.md`, `docs/PERSONAS.md`,
+`docs/security/threat-model.md`, `docs/security/penetration-test-results.md` (the latter
+two now banner-marked as scoped to an earlier, materially smaller predecessor system, not
+a current assessment — no new pentest content was fabricated to replace them).
+
+**Six reference docs (`docs/registry/*.md`) were stuck at v11.3.1** (six releases behind)
+with command/skill/persona/subagent counts off by 2–9x against the live filesystem, and
+listed 14+ slash commands with no backing file (`/mindforge:quantum-verify`,
+`/mindforge:hindsight`, `/mindforge:harvest`, `/mindforge:self-heal`,
+`/mindforge:swarm-execution`, `/mindforge:identity`, and others) — each individually
+re-verified against `.claude/commands/mindforge/` before being removed or reworded.
+Updated all six to the real, live-verified counts (221 commands, 232+123 skills, 217
+personas, 164 subagents) and pointed each at `docs/commands-reference.md` as the
+canonical source, so staleness here is lower-stakes going forward.
+
+Also corrected: `docs/plugin-installation.md` and `docs/reference(s)/commands.md` (stale
+hand-typed counts), `docs/References/{decimal-phase-calculation,git-integration,
+git-planning-commit}.md` (wrong CLI path — real tool is `.agent/bin/mindforge-tools.cjs`,
+not `.agent/mindforge/bin/...`), `docs/References/model-profile-resolution.md` (dead
+`@`-include path), and a fabricated `"Claude 4.5 Opus"` model-name literal in two docs
+(no such string exists anywhere in `bin/`) replaced with the real "highest-capability
+tier configured" language. Deleted two orphaned scratch files that were never real
+documentation: `docs/testing-current-version.md` (a pre-release scratch file hardcoding
+a personal machine path) and `docs/commands-skills/DISCOVERED_SKILLS.md` (stale output
+from an unrelated external tool referencing a directory that doesn't exist in this repo).
+
+### Changed — discoverability
+
+- Root `README.md`: npm-version/downloads/license/Node-version badges, an "at a glance"
+  capability summary with real counts, and jump links to the existing sections.
+- `package.json`: `description` rewritten from marketing language ("Sovereign Agentic
+  Intelligence Framework... Production-Hardened... (v11)") to concrete, keyword-bearing
+  text; added `ai-agents`, `llm-tools`, `developer-tools`, `mcp-server` to `keywords`.
+
+### Verified
+
+- `npm test`: 137 passed, 0 failed, 3 env-dependent skips (`browser.test.js`,
+  `browser-daemon-auth-live.test.js`, `sre-integration.test.js` — all three require a
+  Chromium daemon/display or git worktree support this sandbox does not have). Verified
+  clean through the real pre-commit hook, not just a standalone run.
+- `node scripts/sync-version.js`: 27 channels synced; `Formula/mindforge.rb` correctly
+  deferred (tarball doesn't exist yet); `plugins/mindforge/.claude-plugin/plugin.json` and
+  `plugins/mindforge/mcp/dist/index.js` rebuilt.
+
 ## [11.9.5] — 2026-08-22 — The release path can no longer strand itself, and the SDK ships
 
 Patch release, and the shortest one in a while. It exists because 11.9.4 published two

package/MINDFORGE.md

@@ -1,9 +1,9 @@
-# MINDFORGE.md — Parameter Registry (v11.9.5)
+# MINDFORGE.md — Parameter Registry (v11.9.7)
 
 ## 1. IDENTITY & VERSIONING
 
 [NAME]    = MindForge
-[VERSION] = 11.9.5
+[VERSION] = 11.9.7
 [STABLE]  = true
 [MODE]    = "Platform Sovereign"
 [REQUIRED_CORE_VERSION] = 11.9.1

package/README.md

@@ -1,29 +1,43 @@
 # MindForge
 
+[![npm version](https://img.shields.io/npm/v/mindforge-cc.svg)](https://www.npmjs.com/package/mindforge-cc)
+[![npm downloads](https://img.shields.io/npm/dm/mindforge-cc.svg)](https://www.npmjs.com/package/mindforge-cc)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![Node >=18](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](package.json)
+
 **An agentic intelligence framework for Claude Code** — orchestrates multi-agent workflows with governance, memory, and autonomous execution. Production-hardened with true parallelism, streaming SDK, and zero-trust security. Install once, get structured AI-driven development with built-in quality gates.
 
+**At a glance:** 221 slash commands · 355 skills (232 auto-triggered + 123 explicit) · 216 personas · 164 installable subagents · 35 pre-built multi-agent dynamic workflows · a tamper-evident audit hash-chain · cost-aware routing across Anthropic/OpenAI/Gemini/Bedrock/Ollama · a local-first knowledge graph on zero-native-dependency SQLite (sql.js) · a live Express+SSE dashboard. Ships as an npm package, a Claude Code plugin, and an MCP server.
+
+**Jump to:** [Latest release](#latest-release) · [What is actually enforced](#what-is-actually-enforced) · [Install](#install) · [Quick start](#quick-start-new-project) · [Documentation](#documentation) · [Core workflow](#core-workflow) · [Dynamic workflows](#dynamic-workflow-library)
+
 ---
 
 ## Latest release
 
-**v11.9.5** (2026-08-22) — The release path can no longer strand itself, and the SDK ships.
-11.9.4 published two packages and then failed on the third; because that step sat *before* the
-release page and the `stable` dist-tag move, its failure skipped both. Fixed two ways: the steps
-that finish a release now run ahead of any additive package publish, and a new offline preflight
-gate refuses to reach a publish that the registry will reject. Verified against a worktree at tag
-`v11.9.4` — the exact tree npm rejected — the gate exits 1 and names the file.
-
-**`mindforge-sdk` publishes for the first time since 11.8.0, and for the first time with
-provenance.** Everything fixed in it across 11.8.1–11.9.4 had reached nobody, including a
-`WebSocketEventStream` reconnect whose unhandled rejection **terminates the caller's process**.
-
-The previous release, **v11.9.4**, is where the hook gates started actually registering: 11.9.3
-shipped the code and then declined to run it on essentially every project. Measured against the
-published tarballs — 11.9.3: **11 hook scripts installed, 0 registered**; 11.9.4: **8 registered,
-3 deny-class verified blocking**. That **behaviour change under a patch bump** still applies — the
-installer writes `.claude/settings.json` where it previously declined, merging append-only and
-backing up first. See the BREAKING section in [CHANGELOG.md](./CHANGELOG.md), or
-[RELEASENOTES.md](./RELEASENOTES.md) for human-readable notes.
+**v11.9.7** (2026-09-20) — The install banner stops contradicting itself. Found by
+actually running v11.9.6's own documented install command in a clean project instead of
+stopping at `--version`: the top banner claimed `SOVEREIGN INTELLIGENCE v8.1.1` while the
+install activation line two screens later said `v8.2.0` for the same subsystem, and claimed
+`PQAS ... Enabled` right before accurately disclosing it's simulated and off by default a
+few lines down. Both fixed, plus a dead `docs.mindforge.cc` link and a persona-count doc
+regression (218 → back to the correct 216) introduced by v11.9.6's own honesty pass. No
+new features. See [RELEASENOTES.md](./RELEASENOTES.md) or [CHANGELOG.md](./CHANGELOG.md).
+
+The previous release, **v11.9.6**, was the release-readiness pass before pointing real,
+external users at the project for the first time: fixed a crash in `/mindforge:learn`, a
+token-leak in the browser daemon, three dashboard panels that silently rendered nothing, a
+stale Homebrew formula, and docs describing PQAS/ZTAI/"Pillar"-numbered subsystems as live
+guarantees when the code already self-labels them simulated. **v11.9.5** fixed a release
+pipeline that could strand itself mid-publish and shipped `mindforge-sdk` for the first
+time since 11.8.0, with provenance. **v11.9.4**, before that, is where the hook gates
+started actually registering: 11.9.3
+shipped the code and then declined to run it on essentially every project. Measured against
+the published tarballs — 11.9.3: **11 hook scripts installed, 0 registered**; 11.9.4:
+**8 registered, 3 deny-class verified blocking**. That **behaviour change under a patch
+bump** still applies — the installer writes `.claude/settings.json` where it previously
+declined, merging append-only and backing up first. See the BREAKING section in
+[CHANGELOG.md](./CHANGELOG.md).
 
 ---
 
@@ -156,7 +170,7 @@ Full verification walkthrough: [docs/quick-verify.md](docs/quick-verify.md).
 - **Audit events:** [docs/References/audit-events.md](docs/References/audit-events.md)
 - **Upgrade guide:** [docs/upgrade.md](docs/upgrade.md)
 - **Workflow atlas:** [docs/workflow-atlas.md](docs/workflow-atlas.md)
-- **Security:** [docs/security/SECURITY.md](docs/security/SECURITY.md) (MindForge never stores credentials in files)
+- **Security:** [SECURITY.md](SECURITY.md) (credentials are read from env vars and never committed to the repository)
 - **Threat model:** [docs/security/threat-model.md](docs/security/threat-model.md)
 - **Architecture:** [docs/architecture/README.md](docs/architecture/README.md)
 - **Contributing:** [docs/contributing/CONTRIBUTING.md](docs/contributing/CONTRIBUTING.md)

package/RELEASENOTES.md

@@ -1,5 +1,67 @@
 # Release Notes
 
+## v11.9.7 — 2026-09-20 — The install banner stops contradicting itself
+
+### Why this release exists
+
+Running v11.9.6's own documented install command in a clean project (instead of stopping
+at `--version`) surfaced two real bugs in the install banner itself, plus a persona-count
+regression introduced by v11.9.6's own doc-honesty pass.
+
+### The user-visible part
+
+**The install banner no longer contradicts itself.** It used to print `SOVEREIGN
+INTELLIGENCE v8.1.1` at the top and `v8.2.0` for the same subsystem two screens later, and
+claim `PQAS ... Enabled` right before accurately disclosing it's simulated and off by
+default. Both fixed. The banner's `Docs:` link no longer points at a domain with no site
+deployed on it.
+
+**Docs say 216 personas again, not 218.** v11.9.6's own persona-count fix used a count that
+accidentally included two non-persona files; reverted to the verified real number.
+
+## v11.9.6 — 2026-09-20 — The docs stop overselling what the code discloses about itself
+
+### Why this release exists
+
+This is the readiness pass before pointing real, external users at the project for the
+first time. No new features — it fixes two reproducible bugs, three dashboard panels that
+silently rendered nothing, one stale security policy and one stale Homebrew formula, and a
+long-running pattern where docs described PQAS/ZTAI/"Pillar"-numbered subsystems as live
+security guarantees when the code that implements them (`bin/governance/quantum-crypto.js`,
+`bin/governance/ztai-manager.js`) already self-labels them simulated and off-by-default.
+
+### The user-visible part
+
+**`/mindforge:learn` works again.** It crashed on every skill that scored well enough to
+auto-register — `skill-registrar.js`'s `register()` was called with the wrong argument
+shape, so the CLI printed a bare `❌ Error` and nothing ever reached `MANIFEST.md`.
+
+**The browser daemon no longer leaks its own auth token, and now actually checks it.**
+`/navigate`, `/click`, `/type`, and `/screenshot` had zero authentication before this —
+only `/evaluate` did. The startup log used to print the raw token to stdout (captured into
+a plaintext, non-gitignored log file); now it only prints where the token file lives.
+
+**Three dashboard panels (Memory, Team, and the cost/quality charts) were reading response
+fields the backing API has never produced**, so they rendered as permanently empty with no
+error. They now read the real shapes.
+
+**If you use Homebrew:** `brew install mindforge` was pinned two releases behind
+(`11.9.3`) and is now current. It will lag one release again after this one ships — that's
+expected; the formula can't point at a tarball that doesn't exist yet.
+
+### The documentation part
+
+Six reference docs (`docs/registry/*.md`) were frozen at v11.3.1 with command/skill/
+persona counts off by 2–9x and 14+ slash commands listed that don't exist. `usp-features.md`,
+`CODEBASE-MAP.md`, `docs/architecture/README.md`, and several other pages described
+post-quantum crypto and Zero-Trust Agentic Identity as unconditional, shipped security
+rather than the explicitly-simulated, opt-in-gated features they are in the actual code.
+All rewritten to match the same measured tone the README's *What is actually enforced*
+section and `docs/faq.md`/`docs/troubleshooting.md` already used. Two orphaned scratch
+files that were never real documentation were removed.
+
+See [CHANGELOG.md](./CHANGELOG.md) for the complete, file-by-file list.
+
 ## v11.9.5 — 2026-08-22 — The release path can no longer strand itself, and the SDK ships
 
 ### Why this release exists

package/SECURITY.md

@@ -1,6 +1,6 @@
 # Security Policy
 
-> **Current version:** 11.9.5 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
+> **Current version:** 11.9.7 | **npm audit:** 0 vulnerabilities across root, sdk, mcp-server
 
 ## Supported Versions
 
@@ -70,7 +70,7 @@ We follow responsible disclosure practices. We will credit reporters in the rele
   hash of the previous entry. Not a Merkle tree: there is no hash tree and no inclusion proof, so
   "Merkle" was the wrong word for it. What it detects, and does not, is measured below.
 - **AuditWriter with buffered writes** — Atomic append operations prevent partial writes from corrupting the log.
-- **Log rotation with archival** — AUDIT.jsonl auto-archives beyond 5000 lines with gzip compression, preventing unbounded disk growth.
+- **Unbounded audit log, by design** — A prior AUDIT.jsonl rotation/archival mechanism (5000-line threshold, gzip) was removed: truncating the file broke the hash chain by orphaning `previous_hash` pointers to archived entries. AUDIT.jsonl now grows without bound; chain-aware compaction is a tracked future improvement, not yet shipped.
 - **npm provenance** — Published packages include SLSA Build Level 2 attestation via `--provenance`, proving the package was built from the stated source commit in CI.
 
 ### Input Validation & Injection Prevention

package/bin/browser/browser-daemon.js

@@ -5,37 +5,33 @@
  */
 'use strict';
 
-const http      = require('http');
-const crypto    = require('crypto');
+const http = require('http');
+const crypto = require('crypto');
 const playwright = require('playwright-core');
-const fs        = require('fs');
-const path      = require('path');
+const fs = require('fs');
+const path = require('path');
+const { requiresAuth, isAuthValid } = require('./daemon-auth');
 
-const PORT      = process.env.BROWSER_PORT || 7338;
-const HEADLESS  = process.env.BROWSER_HEADLESS !== 'false';
-const TIMEOUT   = (parseInt(process.env.BROWSER_IDLE_TIMEOUT_MINUTES) || 30) * 60 * 1000;
+const PORT = process.env.BROWSER_PORT || 7338;
+const HEADLESS = process.env.BROWSER_HEADLESS !== 'false';
+const TIMEOUT =
+  (parseInt(process.env.BROWSER_IDLE_TIMEOUT_MINUTES) || 30) * 60 * 1000;
 
 // ── Bearer token authentication ──────────────────────────────────────────────
 const DAEMON_TOKEN = crypto.randomBytes(32).toString('hex');
-const DAEMON_TOKEN_FILE = path.join(process.cwd(), '.mindforge', '.browser-daemon-token');
+const DAEMON_TOKEN_FILE = path.join(
+  process.cwd(),
+  '.mindforge',
+  '.browser-daemon-token',
+);
 
 // Write token to file with restrictive permissions (owner-only read/write)
 fs.mkdirSync(path.dirname(DAEMON_TOKEN_FILE), { recursive: true });
 fs.writeFileSync(DAEMON_TOKEN_FILE, DAEMON_TOKEN, { mode: 0o600 });
 
-/**
- * Validate bearer token from Authorization header.
- * Returns true if valid, false otherwise.
- */
-function isAuthValid(req) {
-  const authHeader = req.headers.authorization;
-  if (!authHeader || !authHeader.startsWith('Bearer ')) return false;
-  const provided = authHeader.slice(7);
-  if (provided.length !== DAEMON_TOKEN.length) return false;
-  return crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(DAEMON_TOKEN));
-}
-
-let browser, lastActionAt = Date.now(), isLaunching = false;
+let browser,
+  lastActionAt = Date.now(),
+  isLaunching = false;
 const sessions = new Map(); // name -> { context, page }
 
 async function init() {
@@ -44,7 +40,7 @@ async function init() {
   try {
     browser = await playwright.chromium.launch({
       headless: HEADLESS,
-      args: ['--no-sandbox', '--disable-setuid-sandbox', '--no-first-run']
+      args: ['--no-sandbox', '--disable-setuid-sandbox', '--no-first-run'],
     });
     setInterval(checkIdle, 60000);
   } finally {
@@ -55,14 +51,14 @@ async function init() {
 function checkIdle() {
   if (Date.now() - lastActionAt > TIMEOUT) {
     console.log('[daemon] Idle timeout reached. Shutting down.');
-    process.exit(0);
+    shutdown();
   }
 }
 
 async function getOrCreateSession(name = 'default') {
   if (sessions.has(name)) return sessions.get(name);
   const context = await browser.newContext();
-  const page    = await context.newPage();
+  const page = await context.newPage();
   const s = { context, page };
   sessions.set(name, s);
   return s;
@@ -77,33 +73,64 @@ const server = http.createServer(async (req, res) => {
 
   // Only allow localhost
   const remote = req.socket.remoteAddress;
-  if (remote !== '127.0.0.1' && remote !== '::1' && remote !== '::ffff:127.0.0.1') {
+  if (
+    remote !== '127.0.0.1' &&
+    remote !== '::1' &&
+    remote !== '::ffff:127.0.0.1'
+  ) {
     return send({ error: 'Forbidden: Localhost only' }, 403);
   }
 
   let body = '';
-  req.on('data', chunk => body += chunk);
+  req.on('data', (chunk) => (body += chunk));
   req.on('end', async () => {
     try {
-      const { url, session: sessionName, selector, text, script, type, expected_text, name } = body ? JSON.parse(body) : {};
+      if (
+        requiresAuth(req.url) &&
+        !isAuthValid(req.headers.authorization, DAEMON_TOKEN)
+      ) {
+        return send(
+          {
+            error:
+              'Authentication required. Use the token written to the daemon token file at startup.',
+          },
+          401,
+        );
+      }
+      const {
+        url,
+        session: sessionName,
+        selector,
+        text,
+        script,
+        type,
+        expected_text,
+        name,
+      } = body ? JSON.parse(body) : {};
       const { page, context } = await getOrCreateSession(sessionName);
 
       if (req.url === '/status' && req.method === 'GET') {
-        return send({ alive: true, sessions: Array.from(sessions.keys()), uptime: process.uptime() });
+        return send({
+          alive: true,
+          sessions: Array.from(sessions.keys()),
+          uptime: process.uptime(),
+        });
       }
 
       if (req.url === '/navigate' && req.method === 'POST') {
         const start = Date.now();
         const r = await page.goto(url, { waitUntil: 'load', timeout: 30000 });
-        return send({ 
-          success: true, 
-          status_code: r ? r.status() : 200, 
-          load_time_ms: Date.now() - start 
+        return send({
+          success: true,
+          status_code: r ? r.status() : 200,
+          load_time_ms: Date.now() - start,
         });
       }
 
       if (req.url === '/click' && req.method === 'POST') {
-        const target = selector ? page.locator(selector) : page.getByText(text, { exact: false });
+        const target = selector
+          ? page.locator(selector)
+          : page.getByText(text, { exact: false });
         await target.first().click({ timeout: 5000 });
         return send({ success: true, element_found: true });
       }
@@ -119,9 +146,6 @@ const server = http.createServer(async (req, res) => {
       }
 
       if (req.url === '/evaluate' && req.method === 'POST') {
-        if (!isAuthValid(req)) {
-          return send({ error: 'Authentication required. Use the token printed at daemon startup.' }, 401);
-        }
         const result = await page.evaluate(script);
         return send({ success: true, result });
       }
@@ -131,11 +155,20 @@ const server = http.createServer(async (req, res) => {
           const loc = page.locator(selector).first();
           const visible = await loc.isVisible();
           const actual = visible ? await loc.innerText() : '';
-          const passed = visible && (!expected_text || actual.includes(expected_text));
+          const passed =
+            visible && (!expected_text || actual.includes(expected_text));
           return send({ passed, actual_text: actual });
         }
-        if (type === 'url') return send({ passed: page.url().includes(expected_text), actual_url: page.url() });
-        if (type === 'title') return send({ passed: (await page.title()).includes(expected_text), actual_title: await page.title() });
+        if (type === 'url')
+          return send({
+            passed: page.url().includes(expected_text),
+            actual_url: page.url(),
+          });
+        if (type === 'title')
+          return send({
+            passed: (await page.title()).includes(expected_text),
+            actual_title: await page.title(),
+          });
         if (type === 'no_console_errors') return send({ passed: true }); // simplified
       }
 
@@ -146,16 +179,19 @@ const server = http.createServer(async (req, res) => {
   });
 });
 
-init().then(() => {
-  server.listen(PORT, '127.0.0.1', () => {
-    console.log(`[BrowserDaemon] Listening on port ${PORT}`);
-    console.log(`[BrowserDaemon] Auth token: ${DAEMON_TOKEN}`);
-    console.log(`[BrowserDaemon] Token file: ${DAEMON_TOKEN_FILE}`);
+init()
+  .then(() => {
+    server.listen(PORT, '127.0.0.1', () => {
+      console.log(`[BrowserDaemon] Listening on port ${PORT}`);
+      console.log(
+        `[BrowserDaemon] Auth token written to: ${DAEMON_TOKEN_FILE}`,
+      );
+    });
+  })
+  .catch((err) => {
+    console.error('[daemon] Initialization failed:', err);
+    process.exit(1);
   });
-}).catch(err => {
-  console.error('[daemon] Initialization failed:', err);
-  process.exit(1);
-});
 
 async function shutdown() {
   console.log('[daemon] Shutting down gracefully...');

package/bin/browser/daemon-auth.js

@@ -0,0 +1,36 @@
+/**
+ * MindForge v2 — Browser Daemon Auth
+ * Pure bearer-token validation extracted from browser-daemon.js so it can be
+ * unit-tested without booting Chromium. See ADR-024 / ADR-026.
+ */
+'use strict';
+
+const crypto = require('crypto');
+
+/**
+ * Endpoints that MUST present a valid bearer token. /status is intentionally
+ * excluded: it is the unauthenticated liveness probe daemon-manager.js#isRunning
+ * relies on, it leaks only session names + uptime, and it is already covered by
+ * ADR-024's localhost bind + remoteAddress check.
+ */
+const AUTH_REQUIRED_PATHS = new Set([
+  '/navigate',
+  '/click',
+  '/type',
+  '/screenshot',
+  '/evaluate',
+  '/assert',
+]);
+
+function requiresAuth(urlPath) {
+  return AUTH_REQUIRED_PATHS.has(urlPath);
+}
+
+function isAuthValid(authHeader, token) {
+  if (!authHeader || !authHeader.startsWith('Bearer ')) return false;
+  const provided = authHeader.slice(7);
+  if (provided.length !== token.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(provided), Buffer.from(token));
+}
+
+module.exports = { AUTH_REQUIRED_PATHS, requiresAuth, isAuthValid };