thumbgate 0.9.10

package/scripts/mcp-config.js

@@ -0,0 +1,149 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+function isSourceCheckout(pkgRoot) {
+  return fs.existsSync(path.join(pkgRoot, '.git'));
+}
+
+function parseWorktreePaths(raw) {
+  return String(raw || '')
+    .split('\n')
+    .filter((line) => line.startsWith('worktree '))
+    .map((line) => line.slice('worktree '.length).trim())
+    .filter(Boolean);
+}
+
+function resolveStableSourceRoot(pkgRoot) {
+  if (!isSourceCheckout(pkgRoot)) {
+    return null;
+  }
+
+  try {
+    const output = execFileSync('git', ['-C', pkgRoot, 'worktree', 'list', '--porcelain'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    const worktreePaths = parseWorktreePaths(output);
+
+    for (const worktreePath of worktreePaths) {
+      const gitPath = path.join(worktreePath, '.git');
+      if (!fs.existsSync(gitPath)) {
+        continue;
+      }
+      if (fs.statSync(gitPath).isDirectory()) {
+        return worktreePath;
+      }
+    }
+  } catch (_) {
+    return pkgRoot;
+  }
+
+  return pkgRoot;
+}
+
+function resolveGitCommonDir(dirPath) {
+  try {
+    return execFileSync('git', ['-C', dirPath, 'rev-parse', '--path-format=absolute', '--git-common-dir'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch (_) {
+    return null;
+  }
+}
+
+function isSameCheckoutFamily(pkgRoot, targetDir) {
+  const packageCommonDir = resolveGitCommonDir(pkgRoot);
+  const targetCommonDir = resolveGitCommonDir(targetDir);
+
+  if (packageCommonDir && targetCommonDir) {
+    return packageCommonDir === targetCommonDir;
+  }
+
+  const resolvedPkgRoot = path.resolve(pkgRoot);
+  const resolvedTargetDir = path.resolve(targetDir);
+  return resolvedTargetDir === resolvedPkgRoot || resolvedTargetDir.startsWith(`${resolvedPkgRoot}${path.sep}`);
+}
+
+function resolveLocalServerPath(pkgRoot, scope = 'project') {
+  const baseRoot = scope === 'home' ? resolveStableSourceRoot(pkgRoot) || pkgRoot : pkgRoot;
+  return path.join(baseRoot, 'adapters', 'mcp', 'server-stdio.js');
+}
+
+function portableMcpEntry(pkgVersion) {
+  return {
+    command: 'npx',
+    args: ['-y', `thumbgate@${pkgVersion}`, 'serve'],
+  };
+}
+
+function localMcpEntry(pkgRoot, scope = 'project') {
+  return {
+    command: 'node',
+    args: [resolveLocalServerPath(pkgRoot, scope)],
+  };
+}
+
+const publicationCache = new Map();
+
+function publishedVersionOverride() {
+  const override = String(process.env.THUMBGATE_PUBLISH_STATE || '').trim().toLowerCase();
+  if (override === 'published') {
+    return true;
+  }
+  if (override === 'unpublished') {
+    return false;
+  }
+  return null;
+}
+
+function isVersionPublished(pkgVersion) {
+  const override = publishedVersionOverride();
+  if (override !== null) {
+    return override;
+  }
+  if (publicationCache.has(pkgVersion)) {
+    return publicationCache.get(pkgVersion);
+  }
+
+  let published = false;
+  try {
+    execFileSync('npm', ['view', `thumbgate@${pkgVersion}`, 'version'], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      timeout: 5000,
+    });
+    published = true;
+  } catch (_) {
+    published = false;
+  }
+
+  publicationCache.set(pkgVersion, published);
+  return published;
+}
+
+function resolveMcpEntry({ pkgRoot, pkgVersion, scope = 'project', targetDir = pkgRoot }) {
+  if (!isSourceCheckout(pkgRoot)) {
+    return portableMcpEntry(pkgVersion);
+  }
+  if (scope === 'project' && !isSameCheckoutFamily(pkgRoot, targetDir) && isVersionPublished(pkgVersion)) {
+    return portableMcpEntry(pkgVersion);
+  }
+  return localMcpEntry(pkgRoot, scope);
+}
+
+module.exports = {
+  isVersionPublished,
+  isSourceCheckout,
+  isSameCheckoutFamily,
+  localMcpEntry,
+  parseWorktreePaths,
+  portableMcpEntry,
+  resolveGitCommonDir,
+  resolveLocalServerPath,
+  resolveMcpEntry,
+  resolveStableSourceRoot,
+};

package/scripts/mcp-policy.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+
+const PROJECT_ROOT = path.join(__dirname, '..');
+const DEFAULT_POLICY_PATH = path.join(PROJECT_ROOT, 'config', 'mcp-allowlists.json');
+const DEFAULT_SUBAGENT_PROFILE_PATH = path.join(PROJECT_ROOT, 'config', 'subagent-profiles.json');
+
+function getPolicyPath() {
+  return process.env.THUMBGATE_MCP_POLICY_PATH || DEFAULT_POLICY_PATH;
+}
+
+function loadMcpPolicy() {
+  const policyPath = getPolicyPath();
+  const raw = fs.readFileSync(policyPath, 'utf-8');
+  const parsed = JSON.parse(raw);
+  if (!parsed.profiles || typeof parsed.profiles !== 'object') {
+    throw new Error('Invalid MCP policy: missing profiles object');
+  }
+  return parsed;
+}
+
+function loadSubagentProfiles() {
+  const profilePath = process.env.THUMBGATE_SUBAGENT_PROFILE_PATH || DEFAULT_SUBAGENT_PROFILE_PATH;
+  const raw = fs.readFileSync(profilePath, 'utf-8');
+  const parsed = JSON.parse(raw);
+  if (!parsed.profiles || typeof parsed.profiles !== 'object') {
+    throw new Error('Invalid subagent profile config: missing profiles object');
+  }
+  return parsed;
+}
+
+function getActiveMcpProfile(toolName) {
+  const explicitProfile = process.env.THUMBGATE_MCP_PROFILE || null;
+  const runtimeSubagentProfile = process.env.THUMBGATE_SUBAGENT_PROFILE || null;
+  const autoRoute = process.env.THUMBGATE_AUTO_PROFILE_ROUTING !== 'false';
+
+  if (!runtimeSubagentProfile) {
+    // Auto-route when no explicit profile and auto-routing is enabled
+    if (!explicitProfile && autoRoute && toolName) {
+      const { routeProfile } = require('./profile-router');
+      const routing = routeProfile({ toolName });
+      return routing.profile;
+    }
+    return explicitProfile || 'default';
+  }
+
+  const config = loadSubagentProfiles();
+  const subagent = config.profiles[runtimeSubagentProfile];
+  if (!subagent || !subagent.mcpProfile) {
+    throw new Error(`Unknown subagent profile: ${runtimeSubagentProfile}`);
+  }
+
+  if (explicitProfile && explicitProfile !== subagent.mcpProfile) {
+    throw new Error(
+      `MCP profile conflict: THUMBGATE_MCP_PROFILE='${explicitProfile}' does not match subagent profile '${runtimeSubagentProfile}' (${subagent.mcpProfile})`,
+    );
+  }
+
+  return subagent.mcpProfile;
+}
+
+function getAllowedTools(profileName = getActiveMcpProfile()) {
+  const policy = loadMcpPolicy();
+  const tools = policy.profiles[profileName];
+  if (!tools) {
+    throw new Error(`Unknown MCP profile: ${profileName}`);
+  }
+  return tools;
+}
+
+function isToolAllowed(toolName, profileName = getActiveMcpProfile()) {
+  const allowed = getAllowedTools(profileName);
+  return allowed.includes(toolName);
+}
+
+function assertToolAllowed(toolName, profileName = getActiveMcpProfile()) {
+  if (!isToolAllowed(toolName, profileName)) {
+    throw new Error(`Tool '${toolName}' is not allowed in MCP profile '${profileName}'`);
+  }
+}
+
+module.exports = {
+  DEFAULT_POLICY_PATH,
+  getPolicyPath,
+  loadMcpPolicy,
+  loadSubagentProfiles,
+  getActiveMcpProfile,
+  getAllowedTools,
+  isToolAllowed,
+  assertToolAllowed,
+  DEFAULT_SUBAGENT_PROFILE_PATH,
+};
+
+if (require.main === module) {
+  const profile = getActiveMcpProfile();
+  const tools = getAllowedTools(profile);
+  console.log(JSON.stringify({ profile, tools }, null, 2));
+}

package/scripts/memalign-recall.js

@@ -0,0 +1,111 @@
+'use strict';
+
+/**
+ * MemAlign dual-memory working memory construction.
+ *
+ * Combines:
+ *   - Semantic memory (principles distilled from NL feedback)
+ *   - Episodic memory (contextfs context packs)
+ *
+ * Budget split: 20% chars for principles, 80% for episodes.
+ */
+
+const { constructContextPack } = require('./contextfs');
+const { getPrinciples } = require('./principle-extractor');
+
+/**
+ * Build a dual-memory working memory object.
+ *
+ * @param {object} opts
+ * @param {string}   opts.query - Recall query.
+ * @param {number}   [opts.maxItems=10] - Max episodic items.
+ * @param {number}   [opts.maxChars=4000] - Total char budget.
+ * @param {string[]} [opts.namespaces] - Episodic search namespaces.
+ * @param {number}   [opts.maxPrinciples=5] - Max principles to include.
+ * @returns {{ principles: object[], episodes: object, charBudget: { total: number, principles: number, episodes: number } }}
+ */
+function constructWorkingMemory({ query, maxItems = 10, maxChars = 4000, namespaces, maxPrinciples = 5 } = {}) {
+  const principlesBudget = Math.floor(maxChars * 0.2);
+  const episodesBudget = maxChars - principlesBudget;
+
+  // Retrieve principles (semantic memory)
+  const allPrinciples = getPrinciples({ limit: maxPrinciples });
+
+  // Trim principles to char budget
+  const selectedPrinciples = [];
+  let usedPrincipleChars = 0;
+  for (const p of allPrinciples) {
+    const len = (p.text || '').length;
+    if (usedPrincipleChars + len > principlesBudget) break;
+    selectedPrinciples.push(p);
+    usedPrincipleChars += len;
+  }
+
+  // Retrieve episodic context pack
+  const episodes = constructContextPack({
+    query: query || '',
+    maxItems,
+    maxChars: episodesBudget,
+    namespaces,
+  });
+
+  return {
+    principles: selectedPrinciples,
+    episodes,
+    charBudget: {
+      total: maxChars,
+      principles: principlesBudget,
+      episodes: episodesBudget,
+    },
+  };
+}
+
+/**
+ * Format a working memory object as markdown for context injection.
+ *
+ * @param {object} wm - Working memory from constructWorkingMemory.
+ * @returns {string} Markdown string.
+ */
+function formatWorkingMemoryForContext(wm) {
+  const lines = [];
+
+  lines.push('## Principles (Semantic Memory)');
+  lines.push('');
+  if (wm.principles && wm.principles.length > 0) {
+    for (const p of wm.principles) {
+      lines.push(`- ${p.text}`);
+    }
+  } else {
+    lines.push('_No principles extracted yet._');
+  }
+
+  lines.push('');
+  lines.push('## Relevant Past Episodes (Episodic Memory)');
+  lines.push('');
+  if (wm.episodes && wm.episodes.retrieval && wm.episodes.retrieval.strategy === 'hierarchical') {
+    const themes = Array.isArray(wm.episodes.retrieval.selectedThemes)
+      ? wm.episodes.retrieval.selectedThemes.map((theme) => theme.replace(/-/g, ' '))
+      : [];
+    if (themes.length > 0) {
+      lines.push(`Themes: ${themes.join(', ')}`);
+      lines.push('');
+    }
+  }
+  if (wm.episodes && Array.isArray(wm.episodes.items) && wm.episodes.items.length > 0) {
+    for (const item of wm.episodes.items) {
+      lines.push(`- **${item.title || item.id}**`);
+      if (item.structuredContext && item.structuredContext.rawContent) {
+        lines.push(`  ${item.structuredContext.rawContent.slice(0, 200)}`);
+      }
+    }
+  } else {
+    lines.push('_No relevant episodes found._');
+  }
+
+  return lines.join('\n');
+}
+
+module.exports = {
+  constructWorkingMemory,
+  formatWorkingMemoryForContext,
+};

package/scripts/memory-firewall.js

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+'use strict';
+
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { scanText, buildSafeSummary, redactText } = require('./secret-scanner');
+
+const SHIELDCORTEX_RUNNER_PATH = path.join(__dirname, 'shieldcortex-memory-firewall-runner.mjs');
+const VALID_PROVIDERS = new Set(['auto', 'shieldcortex', 'local', 'off']);
+const VALID_MODES = new Set(['strict', 'balanced', 'permissive']);
+
+function resolveMemoryFirewallProvider(provider) {
+  const configured = String(
+    provider || process.env.THUMBGATE_MEMORY_FIREWALL_PROVIDER || 'auto'
+  ).trim().toLowerCase();
+  return VALID_PROVIDERS.has(configured) ? configured : 'auto';
+}
+
+function resolveMemoryFirewallMode(mode) {
+  const configured = String(
+    mode || process.env.THUMBGATE_MEMORY_FIREWALL_MODE || 'strict'
+  ).trim().toLowerCase();
+  return VALID_MODES.has(configured) ? configured : 'strict';
+}
+
+function canResolveShieldCortex() {
+  try {
+    require.resolve('shieldcortex/package.json');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function buildIngressRecord(feedbackEvent = {}, memoryRecord = null) {
+  const feedbackPayload = {
+    signal: feedbackEvent.signal || null,
+    context: feedbackEvent.context || '',
+    whatWentWrong: feedbackEvent.whatWentWrong || null,
+    whatToChange: feedbackEvent.whatToChange || null,
+    whatWorked: feedbackEvent.whatWorked || null,
+    reasoning: feedbackEvent.reasoning || null,
+    visualEvidence: feedbackEvent.visualEvidence || null,
+    tags: Array.isArray(feedbackEvent.tags) ? feedbackEvent.tags : [],
+    skill: feedbackEvent.skill || null,
+    actionType: feedbackEvent.actionType || null,
+    actionReason: feedbackEvent.actionReason || null,
+  };
+
+  const memoryPayload = memoryRecord
+    ? {
+        category: memoryRecord.category || null,
+        title: memoryRecord.title || null,
+        pattern: memoryRecord.pattern || null,
+        solution: memoryRecord.solution || null,
+        tags: Array.isArray(memoryRecord.tags) ? memoryRecord.tags : [],
+      }
+    : null;
+
+  const tags = new Set([
+    ...(Array.isArray(feedbackPayload.tags) ? feedbackPayload.tags : []),
+    ...(memoryPayload && Array.isArray(memoryPayload.tags) ? memoryPayload.tags : []),
+  ]);
+
+  return {
+    title: memoryPayload && memoryPayload.title
+      ? memoryPayload.title
+      : `feedback_ingress:${feedbackPayload.signal || 'unknown'}`,
+    content: JSON.stringify(
+      {
+        feedback: feedbackPayload,
+        promotedMemory: memoryPayload,
+      },
+      null,
+      2
+    ),
+    tags: [...tags],
+    metadata: {
+      project: 'thumbgate',
+      feedbackSignal: feedbackPayload.signal || null,
+      memoryCategory: memoryPayload ? memoryPayload.category : null,
+    },
+  };
+}
+
+function buildLocalFirewallDecision(record, options = {}) {
+  const scanResult = scanText(record.content, {
+    provider: options.secretProvider,
+    source: 'memory_ingress',
+  });
+
+  if (!scanResult.detected) {
+    return {
+      allowed: true,
+      provider: 'local',
+      mode: options.mode,
+      reason: 'Local memory-ingress scan passed.',
+      threatIndicators: [],
+      findings: [],
+      redactedPreview: redactText(record.content).slice(0, 400),
+    };
+  }
+
+  return {
+    allowed: false,
+    provider: 'local',
+    mode: options.mode,
+    reason: buildSafeSummary(
+      scanResult.findings,
+      'Memory ingestion blocked because it appears to contain secret material'
+    ),
+    threatIndicators: ['credential_leak'],
+    findings: scanResult.findings,
+    redactedPreview: redactText(record.content).slice(0, 400),
+  };
+}
+
+function runShieldCortexFirewall(record, options = {}) {
+  const child = spawnSync(
+    process.execPath,
+    [SHIELDCORTEX_RUNNER_PATH],
+    {
+      input: JSON.stringify({
+        record,
+        options: {
+          mode: options.mode,
+          sourceType: options.sourceType || 'hook',
+          sourceIdentifier: options.sourceIdentifier || 'feedback-loop',
+        },
+      }),
+      encoding: 'utf8',
+      maxBuffer: 4 * 1024 * 1024,
+      env: process.env,
+    }
+  );
+
+  if (child.error) {
+    return {
+      available: false,
+      error: child.error.message,
+    };
+  }
+
+  const output = String(child.stdout || '').trim();
+  if (!output) {
+    return {
+      available: false,
+      error: child.stderr || `ShieldCortex runner exited with code ${child.status}`,
+    };
+  }
+
+  try {
+    return JSON.parse(output);
+  } catch (error) {
+    return {
+      available: false,
+      error: `Invalid ShieldCortex runner output: ${error.message}`,
+    };
+  }
+}
+
+function evaluateMemoryIngress({
+  feedbackEvent,
+  memoryRecord = null,
+  provider,
+  mode,
+  sourceType = 'hook',
+  sourceIdentifier = 'feedback-loop',
+  secretProvider,
+} = {}) {
+  const resolvedProvider = resolveMemoryFirewallProvider(provider);
+  const resolvedMode = resolveMemoryFirewallMode(mode);
+  const record = buildIngressRecord(feedbackEvent, memoryRecord);
+
+  if (resolvedProvider === 'off') {
+    return {
+      allowed: true,
+      provider: 'off',
+      mode: resolvedMode,
+      reason: 'Memory-ingress firewall disabled.',
+      threatIndicators: [],
+      findings: [],
+      redactedPreview: redactText(record.content).slice(0, 400),
+    };
+  }
+
+  const wantsShieldCortex = resolvedProvider === 'shieldcortex' || resolvedProvider === 'auto';
+  if (wantsShieldCortex && canResolveShieldCortex()) {
+    const decision = runShieldCortexFirewall(record, {
+      mode: resolvedMode,
+      sourceType,
+      sourceIdentifier,
+    });
+    if (decision && decision.available) {
+      return decision;
+    }
+  }
+
+  const localDecision = buildLocalFirewallDecision(record, {
+    mode: resolvedMode,
+    secretProvider,
+  });
+
+  if (resolvedProvider === 'shieldcortex') {
+    return {
+      ...localDecision,
+      degraded: true,
+      requestedProvider: 'shieldcortex',
+      reason: `ShieldCortex unavailable; ${localDecision.reason}`,
+    };
+  }
+
+  return localDecision;
+}
+
+module.exports = {
+  buildIngressRecord,
+  buildLocalFirewallDecision,
+  evaluateMemoryIngress,
+  resolveMemoryFirewallMode,
+  resolveMemoryFirewallProvider,
+};