thumbgate 0.9.10

package/scripts/statusline.sh

@@ -0,0 +1,116 @@
+#!/bin/bash
+# ThumbGate Status Line for Claude Code
+# Shows ThumbGate feedback stats + most recent lesson at a glance.
+# Thumbs icons trigger CLI feedback capture inline (no browser).
+# Installed by: npx thumbgate init --agent claude-code
+
+# Resolve script directory safely (CodeQL: no uncontrolled paths)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+case "$SCRIPT_DIR" in *[!a-zA-Z0-9/_.-]*) echo "ThumbGate: invalid script path"; exit 1;; esac
+
+# ── Parse Claude Code session JSON from stdin ─────────────────────
+eval "$(cat | jq -r '
+  def n(f): f // 0;
+  @sh "CTX_PCT=\(n(.context_window.used_percentage) | floor)"
+' 2>/dev/null)"
+CTX_PCT="${CTX_PCT:-0}"
+
+# ── ThumbGate stats from cache ────────────────────────────────────────
+THUMBGATE_CACHE=""
+for base in "${THUMBGATE_FEEDBACK_DIR:-.}" "." "${HOME}"; do
+  for rel in ".thumbgate/statusline_cache.json"; do
+    if [ -f "${base}/${rel}" ]; then
+      THUMBGATE_CACHE="${base}/${rel}"
+      break 2
+    fi
+  done
+done
+if [ -z "$THUMBGATE_CACHE" ]; then
+  THUMBGATE_CACHE="${THUMBGATE_FEEDBACK_DIR:-.}/.thumbgate/statusline_cache.json"
+fi
+
+UP="0"; DOWN="0"; LESSONS="0"; TREND="?"; CACHE_TS="0"
+if [ -f "$THUMBGATE_CACHE" ]; then
+  eval "$(jq -r '
+    @sh "UP=\(.thumbs_up // "0")",
+    @sh "DOWN=\(.thumbs_down // "0")",
+    @sh "LESSONS=\(.lessons // "0")",
+    @sh "TREND=\(.trend // "?")",
+    @sh "CACHE_TS=\(.updated_at // "0")"
+  ' "$THUMBGATE_CACHE" 2>/dev/null)"
+fi
+
+# Background refresh from REST API when cache is stale (>120s)
+_NOW=$(date +%s)
+if [ $(( _NOW - ${CACHE_TS:-0} )) -gt 120 ]; then
+  (
+    _R=$(curl -s --max-time 3 "http://localhost:3456/v1/feedback/stats" -H "Authorization: Bearer ${THUMBGATE_API_KEY:-tg_creator_dev_enterprise}" 2>/dev/null)
+    [ -z "$_R" ] && exit 0
+    echo "$_R" | python3 -c "
+import json,sys,time,os
+try:
+  d=json.load(sys.stdin)
+  c={'thumbs_up':str(d.get('totalPositive',0)),'thumbs_down':str(d.get('totalNegative',0)),'lessons':str(d.get('rubric',{}).get('samples',0)),'approval_rate':str(round(d.get('approvalRate',0)*100,1)),'trend':d.get('trend','?'),'total_feedback':str(d.get('total',0)),'updated_at':str(int(time.time()))}
+  os.makedirs(os.path.dirname('$THUMBGATE_CACHE'),exist_ok=True)
+  json.dump(c,open('$THUMBGATE_CACHE','w'))
+except:pass
+" 2>/dev/null
+  ) &>/dev/null &
+  disown 2>/dev/null
+fi
+
+# ── Most recent lesson from lesson-inference ──────────────────────
+LESSON_TEXT=""; LESSON_ID=""
+_LESSON_JSON=$(node "${SCRIPT_DIR}/statusline-lesson.js" 2>/dev/null)
+if [ -n "$_LESSON_JSON" ]; then
+  eval "$(echo "$_LESSON_JSON" | jq -r '
+    @sh "LESSON_TEXT=\(.text // "")",
+    @sh "LESSON_ID=\(.lessonId // "")"
+  ' 2>/dev/null)"
+fi
+
+# ── Control Tower stats ──────────────────────────────────────────
+SLO_V="0"; AT_RISK="0"; ANOMALIES="0"
+_TOWER_JSON=$(node "${SCRIPT_DIR}/statusline-tower.js" 2>/dev/null)
+if [ -n "$_TOWER_JSON" ]; then
+  eval "$(echo "$_TOWER_JSON" | jq -r '
+    @sh "SLO_V=\(.sloViolations // 0)",
+    @sh "AT_RISK=\(.atRiskToolCount // 0)",
+    @sh "ANOMALIES=\(.anomalyCount // 0)"
+  ' 2>/dev/null)"
+fi
+
+# ── Colors ────────────────────────────────────────────────────────
+G='\033[32m'; R='\033[31m'; M='\033[35m'; C='\033[36m'; D='\033[90m'; BD='\033[1m'; RST='\033[0m'
+
+# Trend arrow
+case "${TREND}" in
+  improving) ARROW="↗" ;; degrading) ARROW="↘" ;; stable) ARROW="→" ;; *) ARROW="?" ;;
+esac
+
+# ── OSC 8 clickable links ────────────────────────────────────────
+# Links use CLI commands instead of browser URLs.
+# Clicking 👍 runs: node bin/cli.js feedback --signal=up
+# Clicking 👎 runs: node bin/cli.js feedback --signal=down
+osc_link() { printf '\033]8;;%s\a%s\033]8;;\a' "$1" "$2"; }
+CLI="node ${SCRIPT_DIR}/../bin/cli.js"
+
+# ── Output (single line) ─────────────────────────────────────────
+if [ "$UP" = "0" ] && [ "$DOWN" = "0" ]; then
+  echo -e "${D}ThumbGate: no feedback yet — type 'thumbs up' or 'thumbs down'${RST}"
+else
+  # Feedback counts
+  LINE="ThumbGate: ${G}${BD}${UP}${RST}👍 ${R}${BD}${DOWN}${RST}👎 · ${M}${BD}${LESSONS}${RST} lessons ${ARROW}"
+
+  # Control Tower alerts (if any)
+  [ "${SLO_V:-0}" -gt 0 ] && LINE="${LINE} ${R}${SLO_V} SLO${RST}"
+  [ "${AT_RISK:-0}" -gt 0 ] && LINE="${LINE} ${R}${AT_RISK}⚠${RST}"
+  [ "${ANOMALIES:-0}" -gt 0 ] && LINE="${LINE} ${R}${ANOMALIES}☠${RST}"
+
+  # Most recent lesson
+  if [ -n "$LESSON_TEXT" ]; then
+    LINE="${LINE} · ${C}${LESSON_TEXT}${RST}"
+  fi
+
+  echo -e "$LINE"
+fi

package/scripts/stripe-live-status.js

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+/**
+ * stripe-live-status.js — Pull live financial data from Stripe API.
+ * Shows real revenue, not local ledger approximations.
+ */
+
+'use strict';
+
+const Stripe = require('stripe');
+
+const STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY;
+
+if (!STRIPE_SECRET_KEY) {
+  console.error('STRIPE_SECRET_KEY not set');
+  process.exit(1);
+}
+
+const stripe = new Stripe(STRIPE_SECRET_KEY);
+
+async function getLiveStatus() {
+  const [balance, charges, subscriptions, products, prices, sessions] = await Promise.all([
+    stripe.balance.retrieve(),
+    stripe.charges.list({ limit: 100 }),
+    stripe.subscriptions.list({ limit: 100, status: 'all' }),
+    stripe.products.list({ limit: 20, active: true }),
+    stripe.prices.list({ limit: 20, active: true }),
+    stripe.checkout.sessions.list({ limit: 50 }),
+  ]);
+
+  const availableBalance = balance.available.reduce((sum, b) => sum + b.amount, 0);
+  const pendingBalance = balance.pending.reduce((sum, b) => sum + b.amount, 0);
+
+  const paidCharges = charges.data.filter(c => c.paid && !c.refunded);
+  const refundedCharges = charges.data.filter(c => c.refunded);
+  const failedCharges = charges.data.filter(c => c.status === 'failed');
+
+  const grossRevenue = paidCharges.reduce((sum, c) => sum + c.amount, 0);
+  const refundedAmount = refundedCharges.reduce((sum, c) => sum + c.amount_refunded, 0);
+
+  const activeSubs = subscriptions.data.filter(s => s.status === 'active');
+  const cancelledSubs = subscriptions.data.filter(s => s.status === 'canceled');
+
+  const completedSessions = sessions.data.filter(s => s.payment_status === 'paid');
+  const expiredSessions = sessions.data.filter(s => s.status === 'expired');
+
+  const todayStart = new Date();
+  todayStart.setHours(0, 0, 0, 0);
+  const todayCharges = paidCharges.filter(c => c.created * 1000 >= todayStart.getTime());
+  const todayRevenue = todayCharges.reduce((sum, c) => sum + c.amount, 0);
+
+  const report = {
+    generatedAt: new Date().toISOString(),
+    source: 'stripe_live_api',
+    balance: {
+      available: availableBalance / 100,
+      pending: pendingBalance / 100,
+      currency: 'USD',
+    },
+    revenue: {
+      grossLifetime: grossRevenue / 100,
+      refundedLifetime: refundedAmount / 100,
+      netLifetime: (grossRevenue - refundedAmount) / 100,
+      today: todayRevenue / 100,
+      todayChargeCount: todayCharges.length,
+    },
+    charges: {
+      total: charges.data.length,
+      paid: paidCharges.length,
+      refunded: refundedCharges.length,
+      failed: failedCharges.length,
+    },
+    subscriptions: {
+      active: activeSubs.length,
+      cancelled: cancelledSubs.length,
+      total: subscriptions.data.length,
+      mrr: activeSubs.reduce((sum, s) => sum + (s.plan?.amount || 0), 0) / 100,
+    },
+    checkout: {
+      completed: completedSessions.length,
+      expired: expiredSessions.length,
+      total: sessions.data.length,
+      conversionRate: sessions.data.length > 0
+        ? (completedSessions.length / sessions.data.length * 100).toFixed(1) + '%'
+        : '0%',
+    },
+    products: products.data.map(p => ({
+      id: p.id,
+      name: p.name,
+      defaultPrice: p.default_price,
+    })),
+    activePrices: prices.data.map(p => ({
+      id: p.id,
+      amount: p.unit_amount / 100,
+      type: p.type,
+      interval: p.recurring?.interval || 'one_time',
+      product: p.product,
+    })),
+  };
+
+  return report;
+}
+
+async function main() {
+  const report = await getLiveStatus();
+  console.log(JSON.stringify(report, null, 2));
+}
+
+if (require.main === module) {
+  main().catch(err => {
+    console.error('Stripe live status failed:', err.message);
+    process.exit(1);
+  });
+}
+
+module.exports = { getLiveStatus };

package/scripts/subagent-profiles.js

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+const { loadMcpPolicy } = require('./mcp-policy');
+
+const PROJECT_ROOT = path.join(__dirname, '..');
+const DEFAULT_SUBAGENT_PROFILE_PATH = path.join(PROJECT_ROOT, 'config', 'subagent-profiles.json');
+
+function getSubagentProfilePath() {
+  return process.env.THUMBGATE_SUBAGENT_PROFILE_PATH || DEFAULT_SUBAGENT_PROFILE_PATH;
+}
+
+function loadSubagentProfiles() {
+  const raw = fs.readFileSync(getSubagentProfilePath(), 'utf-8');
+  const parsed = JSON.parse(raw);
+  if (!parsed.profiles || typeof parsed.profiles !== 'object') {
+    throw new Error('Invalid subagent profile config: missing profiles object');
+  }
+  return parsed;
+}
+
+function listSubagentProfiles() {
+  const parsed = loadSubagentProfiles();
+  return Object.keys(parsed.profiles);
+}
+
+function getSubagentProfile(name) {
+  const parsed = loadSubagentProfiles();
+  const profile = parsed.profiles[name];
+  if (!profile) {
+    throw new Error(`Unknown subagent profile: ${name}`);
+  }
+  return profile;
+}
+
+function validateSubagentProfiles() {
+  const parsed = loadSubagentProfiles();
+  const policy = loadMcpPolicy();
+  const issues = [];
+
+  for (const [name, profile] of Object.entries(parsed.profiles)) {
+    if (!profile.mcpProfile) {
+      issues.push(`${name}: missing mcpProfile`);
+    } else if (!policy.profiles[profile.mcpProfile]) {
+      issues.push(`${name}: unknown mcpProfile '${profile.mcpProfile}'`);
+    }
+
+    if (!profile.context || typeof profile.context !== 'object') {
+      issues.push(`${name}: missing context settings`);
+    } else {
+      if (!Number.isFinite(profile.context.maxItems) || profile.context.maxItems <= 0) {
+        issues.push(`${name}: invalid context.maxItems`);
+      }
+      if (!Number.isFinite(profile.context.maxChars) || profile.context.maxChars <= 0) {
+        issues.push(`${name}: invalid context.maxChars`);
+      }
+    }
+  }
+
+  return {
+    valid: issues.length === 0,
+    issues,
+  };
+}
+
+module.exports = {
+  DEFAULT_SUBAGENT_PROFILE_PATH,
+  getSubagentProfilePath,
+  loadSubagentProfiles,
+  listSubagentProfiles,
+  getSubagentProfile,
+  validateSubagentProfiles,
+};
+
+if (require.main === module) {
+  const result = validateSubagentProfiles();
+  console.log(JSON.stringify({ profiles: listSubagentProfiles(), ...result }, null, 2));
+  process.exit(result.valid ? 0 : 1);
+}

package/scripts/sync-gh-secrets-from-env.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO="${1:-IgorGanapolsky/ThumbGate}"
+
+# Runtime + deploy secrets used by hosted billing and CI.
+SECRET_KEYS=(
+  GH_PAT
+  SENTRY_DSN
+  SENTRY_AUTH_TOKEN
+  LLM_GATEWAY_BASE_URL
+  LLM_GATEWAY_API_KEY
+  TETRATE_API_KEY
+  THUMBGATE_API_KEY
+  STRIPE_SECRET_KEY
+  STRIPE_WEBHOOK_SECRET
+  GITHUB_MARKETPLACE_WEBHOOK_SECRET
+  RAILWAY_TOKEN
+)
+
+VARIABLE_KEYS=(
+  THUMBGATE_PUBLIC_APP_ORIGIN
+  THUMBGATE_BILLING_API_BASE_URL
+  THUMBGATE_FEEDBACK_DIR
+  THUMBGATE_GA_MEASUREMENT_ID
+  THUMBGATE_GOOGLE_SITE_VERIFICATION
+  RAILWAY_PROJECT_ID
+  RAILWAY_ENVIRONMENT_ID
+  RAILWAY_SERVICE
+  RAILWAY_HEALTHCHECK_URL
+  THUMBGATE_API_KEY_ROTATED_AT
+  STRIPE_SECRET_KEY_ROTATED_AT
+  STRIPE_WEBHOOK_SECRET_ROTATED_AT
+  GITHUB_MARKETPLACE_WEBHOOK_SECRET_ROTATED_AT
+  RAILWAY_TOKEN_ROTATED_AT
+  GEMINI_API_KEY_ROTATED_AT
+  PERPLEXITY_API_KEY_ROTATED_AT
+  X_API_KEY_ROTATED_AT
+  X_API_SECRET_ROTATED_AT
+  X_ACCESS_TOKEN_ROTATED_AT
+  X_ACCESS_TOKEN_SECRET_ROTATED_AT
+)
+
+echo "Syncing secrets to $REPO (only keys present in current environment)..."
+
+for key in "${SECRET_KEYS[@]}"; do
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    echo "- skip $key (not set)"
+    continue
+  fi
+
+  printf '%s' "$value" | gh secret set "$key" -R "$REPO"
+  echo "- set $key"
+done
+
+echo "Syncing repo variables to $REPO (only keys present in current environment)..."
+
+for key in "${VARIABLE_KEYS[@]}"; do
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    echo "- skip $key (not set)"
+    continue
+  fi
+
+  gh variable set "$key" -R "$REPO" --body "$value"
+  echo "- set $key"
+done
+
+echo "Done."

package/scripts/sync-github-about.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+'use strict';
+
+const {
+  compareGitHubAbout,
+  fetchLiveGitHubAbout,
+  loadGitHubAboutConfig,
+  updateLiveGitHubAbout,
+} = require('./github-about');
+
+async function main() {
+  const args = new Set(process.argv.slice(2));
+  const write = args.has('--write');
+  const about = loadGitHubAboutConfig();
+  const before = await fetchLiveGitHubAbout({ repo: about.repo });
+  const drift = compareGitHubAbout(about, before, `Live GitHub About (${about.repo})`);
+
+  if (drift.length === 0) {
+    console.log(`✅ GitHub About already matches source of truth for ${about.repo}.`);
+    return;
+  }
+
+  if (!write) {
+    console.error(`\n❌ GitHub About drift detected for ${about.repo}:\n`);
+    for (const error of drift) {
+      console.error(`  • ${error}`);
+    }
+    console.error('');
+    process.exit(1);
+  }
+
+  console.log(`Syncing GitHub About for ${about.repo}...`);
+  await updateLiveGitHubAbout({ repo: about.repo });
+
+  const after = await fetchLiveGitHubAbout({ repo: about.repo });
+  const remaining = compareGitHubAbout(about, after, `Live GitHub About (${about.repo})`);
+  if (remaining.length > 0) {
+    console.error(`\n❌ GitHub About sync incomplete for ${about.repo}:\n`);
+    for (const error of remaining) {
+      console.error(`  • ${error}`);
+    }
+    console.error('');
+    process.exit(1);
+  }
+
+  console.log(`✅ GitHub About synced for ${about.repo}.`);
+}
+
+main().catch((error) => {
+  console.error(`\n❌ GitHub About sync failed: ${error.message}\n`);
+  process.exit(1);
+});