thumbgate 0.9.9

package/scripts/operational-dashboard.js

@@ -0,0 +1,103 @@
+'use strict';
+
+const { resolveAnalyticsWindow } = require('./analytics-window');
+const { getBillingSummaryLive } = require('./billing');
+const { generateDashboard } = require('./dashboard');
+const { getFeedbackPaths } = require('./feedback-loop');
+const { resolveHostedBillingConfig } = require('./hosted-config');
+
+function normalizeText(value) {
+  if (value === undefined || value === null) return null;
+  const text = String(value).trim();
+  return text || null;
+}
+
+function shouldPreferHostedDashboard() {
+  return String(process.env.THUMBGATE_METRICS_SOURCE || '').trim().toLowerCase() !== 'local';
+}
+
+function resolveHostedDashboardConfig() {
+  const runtimeConfig = resolveHostedBillingConfig();
+  const apiBaseUrl = normalizeText(process.env.THUMBGATE_BILLING_API_BASE_URL) || runtimeConfig.billingApiBaseUrl;
+  const apiKey = normalizeText(process.env.THUMBGATE_API_KEY);
+  return {
+    apiBaseUrl,
+    apiKey,
+  };
+}
+
+async function buildOperationalDashboard(options = {}) {
+  const analyticsWindow = resolveAnalyticsWindow(options);
+  const feedbackDir = options.feedbackDir || getFeedbackPaths().FEEDBACK_DIR;
+  const billingSummary = await getBillingSummaryLive(analyticsWindow);
+
+  return generateDashboard(feedbackDir, {
+    analyticsWindow,
+    billingSummary,
+    billingSource: 'live',
+    billingFallbackReason: null,
+  });
+}
+
+async function fetchHostedDashboard(options = {}, config = resolveHostedDashboardConfig()) {
+  const analyticsWindow = resolveAnalyticsWindow(options);
+  if (!shouldPreferHostedDashboard()) {
+    const err = new Error('Hosted operational dashboard is disabled.');
+    err.code = 'hosted_dashboard_disabled';
+    throw err;
+  }
+  if (!config.apiBaseUrl || !config.apiKey) {
+    const err = new Error('Hosted operational dashboard is not configured.');
+    err.code = 'hosted_dashboard_unconfigured';
+    throw err;
+  }
+
+  const requestUrl = new URL('/v1/dashboard', config.apiBaseUrl);
+  requestUrl.searchParams.set('window', analyticsWindow.window);
+  requestUrl.searchParams.set('timezone', analyticsWindow.timeZone);
+  requestUrl.searchParams.set('now', analyticsWindow.now);
+
+  const response = await fetch(requestUrl, {
+    method: 'GET',
+    headers: {
+      authorization: `Bearer ${config.apiKey}`,
+      accept: 'application/json',
+    },
+  });
+
+  if (!response.ok) {
+    const detail = await response.text().catch(() => '');
+    const err = new Error(`Hosted operational dashboard request failed (${response.status}): ${detail || 'unknown error'}`);
+    err.code = 'hosted_dashboard_http_error';
+    err.status = response.status;
+    throw err;
+  }
+
+  return response.json();
+}
+
+async function getOperationalDashboard(options = {}) {
+  const analyticsWindow = resolveAnalyticsWindow(options);
+  try {
+    const data = await fetchHostedDashboard(analyticsWindow);
+    return {
+      source: 'hosted',
+      data,
+      fallbackReason: null,
+    };
+  } catch (err) {
+    return {
+      source: 'local',
+      data: await buildOperationalDashboard(analyticsWindow),
+      fallbackReason: err && err.message ? err.message : 'hosted_dashboard_unavailable',
+    };
+  }
+}
+
+module.exports = {
+  buildOperationalDashboard,
+  fetchHostedDashboard,
+  getOperationalDashboard,
+  resolveHostedDashboardConfig,
+  shouldPreferHostedDashboard,
+};

package/scripts/operational-summary.js

@@ -0,0 +1,93 @@
+'use strict';
+
+const { getBillingSummaryLive } = require('./billing');
+const { resolveAnalyticsWindow } = require('./analytics-window');
+const { resolveHostedBillingConfig } = require('./hosted-config');
+
+function normalizeText(value) {
+  if (value === undefined || value === null) return null;
+  const text = String(value).trim();
+  return text || null;
+}
+
+function shouldPreferHostedSummary() {
+  return String(process.env.THUMBGATE_METRICS_SOURCE || '').trim().toLowerCase() !== 'local';
+}
+
+function resolveHostedSummaryConfig() {
+  const runtimeConfig = resolveHostedBillingConfig();
+  const apiBaseUrl = normalizeText(process.env.THUMBGATE_BILLING_API_BASE_URL) || runtimeConfig.billingApiBaseUrl;
+  const apiKey = normalizeText(process.env.THUMBGATE_API_KEY);
+  return {
+    apiBaseUrl,
+    apiKey,
+  };
+}
+
+async function fetchHostedBillingSummary(options = {}, config = resolveHostedSummaryConfig()) {
+  const analyticsWindow = resolveAnalyticsWindow(options);
+  if (!shouldPreferHostedSummary()) {
+    const err = new Error('Hosted operational summary is disabled.');
+    err.code = 'hosted_summary_disabled';
+    throw err;
+  }
+  if (!config.apiBaseUrl || !config.apiKey) {
+    const err = new Error('Hosted operational summary is not configured.');
+    err.code = 'hosted_summary_unconfigured';
+    throw err;
+  }
+
+  const requestUrl = new URL('/v1/billing/summary', config.apiBaseUrl);
+  requestUrl.searchParams.set('window', analyticsWindow.window);
+  requestUrl.searchParams.set('timezone', analyticsWindow.timeZone);
+  if (options.now !== undefined && options.now !== null && options.now !== '') {
+    requestUrl.searchParams.set('now', analyticsWindow.now);
+  }
+
+  const response = await fetch(requestUrl, {
+    method: 'GET',
+    headers: {
+      authorization: `Bearer ${config.apiKey}`,
+      accept: 'application/json',
+    },
+  });
+
+  if (!response.ok) {
+    const detail = await response.text().catch(() => '');
+    const err = new Error(`Hosted operational summary request failed (${response.status}): ${detail || 'unknown error'}`);
+    err.code = 'hosted_summary_http_error';
+    err.status = response.status;
+    throw err;
+  }
+
+  return response.json();
+}
+
+async function getOperationalBillingSummary(options = {}) {
+  const analyticsWindow = resolveAnalyticsWindow(options);
+  try {
+    const summary = await fetchHostedBillingSummary(analyticsWindow);
+    return {
+      source: 'hosted',
+      summary,
+      fallbackReason: null,
+    };
+  } catch (err) {
+    const reason = err && err.message ? err.message : 'hosted_summary_unavailable';
+    // TODO: Configure hosted billing via THUMBGATE_BILLING_API_BASE_URL and THUMBGATE_API_KEY
+    // to avoid falling back to local state. See docs/PRICING_RESEARCH_2026-03-10.md
+    console.warn(`[operational-summary] Hosted billing not configured — falling back to local state. Reason: ${reason}`);
+    return {
+      source: 'local',
+      summary: await getBillingSummaryLive(analyticsWindow),
+      fallbackReason: reason,
+    };
+  }
+}
+
+module.exports = {
+  fetchHostedBillingSummary,
+  getOperationalBillingSummary,
+  resolveHostedSummaryConfig,
+  shouldPreferHostedSummary,
+};

package/scripts/optimize-context.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+const CLAUDE_MD_PATH = path.join(process.cwd(), 'CLAUDE.md');
+const THUMBGATE_DIR = path.join(process.cwd(), '.rlhf');
+const RULES_PATH = path.join(THUMBGATE_DIR, 'prevention-rules.md');
+function optimize() {
+  console.log('🚀 [Context Optimizer] Starting CLAUDE.md migration...');
+  if (!fs.existsSync(CLAUDE_MD_PATH)) return;
+  const content = fs.readFileSync(CLAUDE_MD_PATH, 'utf8');
+  if (!fs.existsSync(THUMBGATE_DIR)) fs.mkdirSync(THUMBGATE_DIR, { recursive: true });
+  const migrationHeader = '\n### [MIGRATED] Rules from CLAUDE.md\n';
+  fs.appendFileSync(RULES_PATH, migrationHeader + content.slice(0, 500) + '\n');
+  console.log('✅ Migrated rules to the Pre-Action Gates.');
+}
+if (require.main === module) optimize();
+module.exports = { optimize };

package/scripts/org-dashboard.js

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Org Dashboard — Multi-Agent Orchestration Visibility
+ *
+ * Aggregates gate decisions, audit trails, and session data across
+ * multiple agent sessions into a single org-wide view. CIOs want to
+ * see what ALL their agents are doing, not just one at a time.
+ *
+ * "I'm not going to have 10,000 agents running in the environment
+ *  that I don't know what they're doing" — CIO.com, March 2026
+ *
+ * Pro feature: free tier gets single-agent dashboard only.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { resolveFeedbackDir } = require('./feedback-paths');
+const { readAuditLog, auditStats, skillAdherence } = require('./audit-trail');
+const { isProTier } = require('./rate-limiter');
+
+// ---------------------------------------------------------------------------
+// Agent Registry
+// ---------------------------------------------------------------------------
+
+const REGISTRY_FILENAME = 'agent-registry.jsonl';
+
+function getRegistryPath() {
+  return path.join(resolveFeedbackDir(), REGISTRY_FILENAME);
+}
+
+/**
+ * Register an agent session. Called on MCP server startup or agent bootstrap.
+ *
+ * @param {object} params
+ * @param {string} params.agentId - Unique agent identifier
+ * @param {string} [params.source] - Where the agent was spawned from (cli, mcp, github, slack)
+ * @param {string} [params.project] - Project/repo name
+ * @param {string} [params.branch] - Git branch
+ * @param {object} [params.metadata] - Arbitrary metadata
+ * @returns {object} The registered agent record
+ */
+function registerAgent({ agentId, source, project, branch, metadata } = {}) {
+  const id = agentId || `agent_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  const record = {
+    id,
+    registeredAt: new Date().toISOString(),
+    lastSeenAt: new Date().toISOString(),
+    source: source || 'unknown',
+    project: project || path.basename(process.cwd()),
+    branch: branch || null,
+    toolCalls: 0,
+    gateBlocks: 0,
+    gateWarns: 0,
+    metadata: metadata || {},
+  };
+
+  const registryPath = getRegistryPath();
+  const dir = path.dirname(registryPath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.appendFileSync(registryPath, JSON.stringify(record) + '\n');
+  return record;
+}
+
+/**
+ * Record agent activity — called after each tool call evaluation.
+ *
+ * @param {string} agentId
+ * @param {string} decision - 'allow' | 'deny' | 'warn'
+ */
+function recordAgentActivity(agentId, decision) {
+  const registryPath = getRegistryPath();
+  if (!fs.existsSync(registryPath)) return;
+
+  const lines = fs.readFileSync(registryPath, 'utf-8').trim().split('\n');
+  const updated = [];
+  let found = false;
+
+  for (const line of lines) {
+    try {
+      const record = JSON.parse(line);
+      if (record.id === agentId && !found) {
+        record.lastSeenAt = new Date().toISOString();
+        record.toolCalls = (record.toolCalls || 0) + 1;
+        if (decision === 'deny') record.gateBlocks = (record.gateBlocks || 0) + 1;
+        if (decision === 'warn') record.gateWarns = (record.gateWarns || 0) + 1;
+        found = true;
+      }
+      updated.push(JSON.stringify(record));
+    } catch {
+      updated.push(line);
+    }
+  }
+
+  fs.writeFileSync(registryPath, updated.join('\n') + '\n');
+}
+
+/**
+ * Load all registered agent sessions.
+ */
+function loadAgentRegistry() {
+  const registryPath = getRegistryPath();
+  if (!fs.existsSync(registryPath)) return [];
+  const raw = fs.readFileSync(registryPath, 'utf-8').trim();
+  if (!raw) return [];
+  return raw.split('\n').map(line => {
+    try { return JSON.parse(line); }
+    catch { return null; }
+  }).filter(Boolean);
+}
+
+// ---------------------------------------------------------------------------
+// Org Dashboard Aggregation
+// ---------------------------------------------------------------------------
+
+/**
+ * Generate org-wide dashboard aggregating all agent sessions.
+ * Pro feature — returns limited data on free tier.
+ *
+ * @param {object} [opts]
+ * @param {number} [opts.windowHours=24] - Lookback window in hours
+ * @returns {object} Org dashboard data
+ */
+function generateOrgDashboard(opts = {}) {
+  const windowHours = opts.windowHours || 24;
+  const cutoff = Date.now() - windowHours * 60 * 60 * 1000;
+  const pro = typeof opts.proOverride === 'boolean'
+    ? opts.proOverride
+    : isProTier(opts.authContext);
+
+  // Load all agents
+  const allAgents = loadAgentRegistry();
+  const activeAgents = allAgents.filter(a => new Date(a.lastSeenAt).getTime() > cutoff);
+
+  // Aggregate audit trail
+  const audit = auditStats();
+  const adherence = skillAdherence();
+
+  // Per-agent summary
+  const agentSummaries = activeAgents.map(a => ({
+    id: a.id,
+    source: a.source,
+    project: a.project,
+    branch: a.branch,
+    registeredAt: a.registeredAt,
+    lastSeenAt: a.lastSeenAt,
+    toolCalls: a.toolCalls || 0,
+    gateBlocks: a.gateBlocks || 0,
+    gateWarns: a.gateWarns || 0,
+    adherenceRate: a.toolCalls > 0
+      ? Math.round(((a.toolCalls - (a.gateBlocks || 0) - (a.gateWarns || 0)) / a.toolCalls) * 10000) / 100
+      : 100,
+  }));
+
+  // Top blocked gates across all agents
+  const topBlockedGates = Object.entries(audit.byGate || {})
+    .map(([gateId, counts]) => ({ gateId, blocked: counts.deny || 0, warned: counts.warn || 0 }))
+    .sort((a, b) => b.blocked - a.blocked)
+    .slice(0, 10);
+
+  // Risk agents — those with lowest adherence
+  const riskAgents = agentSummaries
+    .filter(a => a.toolCalls >= 3)
+    .sort((a, b) => a.adherenceRate - b.adherenceRate)
+    .slice(0, 5);
+
+  const summary = {
+    windowHours,
+    totalAgents: allAgents.length,
+    activeAgents: activeAgents.length,
+    totalToolCalls: audit.total,
+    totalBlocked: audit.deny,
+    totalWarned: audit.warn,
+    totalAllowed: audit.allow,
+    orgAdherenceRate: adherence.overall,
+    topBlockedGates,
+    riskAgents: pro ? riskAgents : riskAgents.slice(0, 1),
+    agents: pro ? agentSummaries : agentSummaries.slice(0, 3),
+    proRequired: !pro,
+  };
+
+  if (!pro) {
+    summary.upgradeMessage = 'Upgrade to Pro for full org visibility — all agents, all gates, all history. https://thumbgate-production.up.railway.app/checkout/pro';
+  }
+
+  return summary;
+}
+
+// ---------------------------------------------------------------------------
+// Exports
+// ---------------------------------------------------------------------------
+
+module.exports = {
+  registerAgent,
+  recordAgentActivity,
+  loadAgentRegistry,
+  generateOrgDashboard,
+  getRegistryPath,
+  REGISTRY_FILENAME,
+};

package/scripts/partner-orchestration.js

@@ -0,0 +1,146 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const PROJECT_ROOT = path.join(__dirname, '..');
+const DEFAULT_CONFIG_PATH = path.join(PROJECT_ROOT, 'config', 'partner-routing.json');
+
+function clamp(value, min, max) {
+  return Math.min(max, Math.max(min, value));
+}
+
+function loadPartnerRoutingConfig(configPath = DEFAULT_CONFIG_PATH) {
+  const raw = fs.readFileSync(configPath, 'utf-8');
+  const parsed = JSON.parse(raw);
+
+  if (!parsed || typeof parsed !== 'object') {
+    throw new Error('Invalid partner routing config: expected object');
+  }
+  if (!parsed.defaultProfile || typeof parsed.defaultProfile !== 'string') {
+    throw new Error('Invalid partner routing config: missing defaultProfile');
+  }
+  if (!parsed.profiles || typeof parsed.profiles !== 'object') {
+    throw new Error('Invalid partner routing config: missing profiles');
+  }
+
+  return parsed;
+}
+
+function normalizePartnerProfile(partnerProfile, config = loadPartnerRoutingConfig()) {
+  if (!partnerProfile) {
+    return config.defaultProfile;
+  }
+
+  const raw = String(partnerProfile).trim().toLowerCase();
+  const alias = config.aliases && config.aliases[raw];
+  const resolved = alias || raw;
+
+  if (!config.profiles[resolved]) {
+    throw new Error(`Unknown partner profile: ${partnerProfile}`);
+  }
+
+  return resolved;
+}
+
+function getPartnerCategory(partnerProfile) {
+  return `partner_${partnerProfile}`;
+}
+
+function scaleBudgetValue(value, multiplier) {
+  if (!Number.isFinite(value) || value <= 0) {
+    return value;
+  }
+  const effectiveMultiplier = Number.isFinite(multiplier) && multiplier > 0 ? multiplier : 1;
+  return Math.max(1, Math.round(value * effectiveMultiplier));
+}
+
+function scaleTokenBudget(tokenBudget, multipliers = {}) {
+  if (!tokenBudget || typeof tokenBudget !== 'object') {
+    return null;
+  }
+
+  return {
+    total: scaleBudgetValue(tokenBudget.total, multipliers.total),
+    perAction: scaleBudgetValue(tokenBudget.perAction, multipliers.perAction),
+    contextPack: scaleBudgetValue(tokenBudget.contextPack, multipliers.contextPack),
+  };
+}
+
+function buildPartnerStrategy(options = {}) {
+  const config = loadPartnerRoutingConfig(options.configPath);
+  const profile = normalizePartnerProfile(options.partnerProfile, config);
+  const profileConfig = config.profiles[profile] || {};
+
+  return {
+    profile,
+    label: profileConfig.label || profile,
+    description: profileConfig.description || '',
+    verificationMode: profileConfig.verificationMode || 'standard',
+    maxRetryDelta: Number.isFinite(profileConfig.maxRetryDelta) ? profileConfig.maxRetryDelta : 0,
+    rewardBias: Number.isFinite(profileConfig.rewardBias) ? profileConfig.rewardBias : 0,
+    partnerCategory: getPartnerCategory(profile),
+    actionBiases: profileConfig.actionBiases || {},
+    recommendedChecks: Array.isArray(profileConfig.recommendedChecks) ? profileConfig.recommendedChecks.slice() : [],
+    tokenBudget: scaleTokenBudget(options.tokenBudget, profileConfig.tokenBudgetMultiplier || {}),
+  };
+}
+
+function getPartnerActionBias(action, partnerStrategy) {
+  if (!action || !partnerStrategy || !partnerStrategy.actionBiases) {
+    return 0;
+  }
+  return Number(partnerStrategy.actionBiases[action.name] || 0);
+}
+
+function resolveVerificationRetries(baseMaxRetries, partnerStrategy) {
+  const requested = Number.isFinite(baseMaxRetries) ? baseMaxRetries : 3;
+  const delta = partnerStrategy && Number.isFinite(partnerStrategy.maxRetryDelta)
+    ? partnerStrategy.maxRetryDelta
+    : 0;
+  return Math.max(1, requested + delta);
+}
+
+function computePartnerReward(params = {}) {
+  const config = loadPartnerRoutingConfig(params.configPath);
+  const rewardModel = config.rewardModel || {};
+  const accepted = params.accepted === true;
+  const attempts = Number.isFinite(params.attempts) ? params.attempts : 1;
+  const violationCount = Number.isFinite(params.violationCount) ? params.violationCount : 0;
+  const partnerStrategy = params.partnerStrategy || buildPartnerStrategy({
+    partnerProfile: params.partnerProfile,
+  });
+
+  const baseReward = accepted ? Number(rewardModel.accepted || 1) : Number(rewardModel.rejected || -1);
+  const attemptPenalty = Math.max(0, attempts - 1) * Number(rewardModel.attemptPenalty || 0);
+  const violationPenalty = Math.min(
+    violationCount * Number(rewardModel.violationPenalty || 0),
+    Number(rewardModel.maxViolationPenalty || 0),
+  );
+  const rawReward = baseReward - attemptPenalty - violationPenalty + Number(partnerStrategy.rewardBias || 0);
+  const reward = Math.round(clamp(rawReward, -1, 1) * 1000) / 1000;
+
+  return {
+    profile: partnerStrategy.profile,
+    reward,
+    weightMultiplier: 1 + Math.abs(reward),
+    components: {
+      baseReward,
+      attemptPenalty,
+      violationPenalty,
+      rewardBias: Number(partnerStrategy.rewardBias || 0),
+    },
+  };
+}
+
+module.exports = {
+  DEFAULT_CONFIG_PATH,
+  loadPartnerRoutingConfig,
+  normalizePartnerProfile,
+  getPartnerCategory,
+  scaleTokenBudget,
+  buildPartnerStrategy,
+  getPartnerActionBias,
+  resolveVerificationRetries,
+  computePartnerReward,
+};