thumbgate 1.2.0 → 1.4.0

package/scripts/prove-packaged-runtime.js

@@ -0,0 +1,326 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const http = require('http');
+const net = require('net');
+const { execFileSync } = require('child_process');
+
+const ROOT = path.join(__dirname, '..');
+const DEFAULT_TIMEOUT_MS = 15000;
+const DEFAULT_PUBLISH_INSTALL_RETRIES = 6;
+const DEFAULT_PUBLISH_INSTALL_DELAY_MS = 5000;
+const MAX_PUBLISH_INSTALL_DELAY_MS = 30000;
+const STATUSLINE_INPUT = JSON.stringify({ context_window: { used_percentage: 12 } });
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const parsed = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith('--')) continue;
+    const [rawKey, inlineValue] = token.slice(2).split('=');
+    const key = rawKey.replace(/-([a-z])/g, (_, char) => char.toUpperCase());
+    const value = inlineValue !== undefined ? inlineValue : argv[index + 1];
+    parsed[key] = value;
+    if (inlineValue === undefined) index += 1;
+  }
+  return parsed;
+}
+
+function pkgVersion() {
+  return require(path.join(ROOT, 'package.json')).version;
+}
+
+function packCurrentRepo(packDir) {
+  fs.mkdirSync(packDir, { recursive: true });
+  const output = execFileSync('npm', ['pack', '--json', '--pack-destination', packDir], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const parsed = JSON.parse(output);
+  const fileName = parsed && parsed[0] && parsed[0].filename;
+  if (!fileName) {
+    throw new Error('npm pack did not return a tarball filename');
+  }
+  return path.join(packDir, fileName);
+}
+
+function installPackage(prefixDir, packageSpec) {
+  fs.mkdirSync(prefixDir, { recursive: true });
+  execFileSync('npm', ['install', '--prefix', prefixDir, '--no-fund', '--no-audit', packageSpec], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  return path.join(prefixDir, 'node_modules', '.bin', 'thumbgate');
+}
+
+function isRemotePackageSpec(packageSpec) {
+  if (!packageSpec) return false;
+  return !/^(?:\.{0,2}\/|\/|file:)/.test(packageSpec) && !packageSpec.endsWith('.tgz');
+}
+
+function isTransientRegistryMiss(error) {
+  const text = [
+    error && error.message,
+    error && error.stdout,
+    error && error.stderr,
+  ]
+    .filter(Boolean)
+    .join('\n');
+  return /ETARGET|No matching version found|npm error code E404|404 Not Found/i.test(text);
+}
+
+async function installPackageWithRetry(prefixDir, packageSpec, options = {}) {
+  const installImpl = options.installImpl || installPackage;
+  const sleepImpl = options.sleepImpl || sleep;
+  const remotePackage = options.remotePackage !== undefined ? options.remotePackage : isRemotePackageSpec(packageSpec);
+  const attempts = remotePackage ? Number(options.attempts || DEFAULT_PUBLISH_INSTALL_RETRIES) : 1;
+  let delayMs = Number(options.delayMs || DEFAULT_PUBLISH_INSTALL_DELAY_MS);
+  let lastError = null;
+
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    if (attempt > 1) {
+      fs.rmSync(prefixDir, { recursive: true, force: true });
+    }
+    try {
+      return installImpl(prefixDir, packageSpec);
+    } catch (error) {
+      lastError = error;
+      const retryable = remotePackage && isTransientRegistryMiss(error) && attempt < attempts;
+      if (!retryable) {
+        throw error;
+      }
+      process.stderr.write(
+        `Retrying published package install for ${packageSpec} after transient registry miss (${attempt}/${attempts - 1})\n`
+      );
+      await sleepImpl(delayMs);
+      delayMs = Math.min(Math.round(delayMs * 1.5), MAX_PUBLISH_INSTALL_DELAY_MS);
+    }
+  }
+
+  throw lastError || new Error(`Failed to install package ${packageSpec}`);
+}
+
+function request(url, timeoutMs = 2000) {
+  return new Promise((resolve, reject) => {
+    const req = http.get(url, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (chunk) => { body += chunk; });
+      res.on('end', () => resolve({ statusCode: res.statusCode, body }));
+    });
+    req.on('error', reject);
+    req.setTimeout(timeoutMs, () => {
+      req.destroy(new Error(`Timed out requesting ${url}`));
+    });
+  });
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function getAvailablePort() {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer();
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address();
+      const port = address && address.port;
+      server.close((error) => {
+        if (error) {
+          reject(error);
+          return;
+        }
+        resolve(port);
+      });
+    });
+    server.on('error', reject);
+  });
+}
+
+async function waitForHealthy(origin, expectedVersion, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < timeoutMs) {
+    try {
+      const response = await request(`${origin}/health`);
+      if (response.statusCode === 200) {
+        const body = JSON.parse(response.body);
+        if (body.version === expectedVersion) {
+          return body;
+        }
+      }
+    } catch {
+      // Keep polling until the detached API server comes online.
+    }
+    await sleep(250);
+  }
+  throw new Error(`Timed out waiting for packaged runtime health at ${origin}`);
+}
+
+function renderStatusline(runtimeBin, projectDir, env) {
+  return execFileSync(runtimeBin, ['statusline-render'], {
+    cwd: projectDir,
+    env,
+    encoding: 'utf8',
+    input: STATUSLINE_INPUT,
+    stdio: ['pipe', 'pipe', 'pipe'],
+    timeout: 10000,
+  });
+}
+
+function runtimeStatePath(homeDir) {
+  return path.join(homeDir, '.thumbgate', 'runtime', 'statusline-api.json');
+}
+
+async function stopDetachedRuntime(homeDir) {
+  try {
+    const state = JSON.parse(fs.readFileSync(runtimeStatePath(homeDir), 'utf8'));
+    const pid = Number(state && state.pid);
+    if (!Number.isInteger(pid) || pid <= 0) return;
+    try {
+      process.kill(pid, 'SIGTERM');
+    } catch {
+      return;
+    }
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+      await sleep(100);
+      try {
+        process.kill(pid, 0);
+      } catch {
+        return;
+      }
+    }
+    try {
+      process.kill(pid, 'SIGKILL');
+    } catch {
+      // Ignore cleanup races.
+    }
+  } catch {
+    // No runtime state means nothing to clean up.
+  }
+}
+
+async function runPackagedRuntimeSmoke(options = {}) {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'thumbgate-packaged-runtime-'));
+  const homeDir = path.join(tempRoot, 'home');
+  const projectDir = path.join(tempRoot, 'project');
+  const packDir = path.join(tempRoot, 'pack');
+  const runtimeDir = path.join(tempRoot, 'runtime');
+  const expectedVersion = options.expectedVersion || pkgVersion();
+  const feedbackDir = path.join(projectDir, '.thumbgate');
+  fs.mkdirSync(homeDir, { recursive: true });
+  fs.mkdirSync(projectDir, { recursive: true });
+  fs.mkdirSync(feedbackDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(feedbackDir, 'feedback-log.jsonl'),
+    [
+      JSON.stringify({ signal: 'positive', timestamp: '2026-04-08T20:00:00.000Z', context: 'packaged runtime smoke pass' }),
+      JSON.stringify({ signal: 'negative', timestamp: '2026-04-08T20:01:00.000Z', context: 'packaged runtime smoke fail path' }),
+    ].join('\n') + '\n'
+  );
+
+  try {
+    const packageSpec = options.packageSpec || packCurrentRepo(packDir);
+    const runtimeBin = await installPackageWithRetry(runtimeDir, packageSpec, {
+      attempts: options.installAttempts,
+      delayMs: options.installDelayMs,
+    });
+    if (!fs.existsSync(runtimeBin)) {
+      throw new Error(`Installed runtime binary is missing: ${runtimeBin}`);
+    }
+
+    const port = await getAvailablePort();
+    const origin = `http://127.0.0.1:${port}`;
+    const env = {
+      ...process.env,
+      HOME: homeDir,
+      THUMBGATE_PROJECT_DIR: projectDir,
+      THUMBGATE_LOCAL_API_ORIGIN: origin,
+      THUMBGATE_API_KEY: 'tg_packaged_runtime_smoke',
+      NO_COLOR: '1',
+    };
+
+    const initialStatusline = renderStatusline(runtimeBin, projectDir, env);
+    if (!initialStatusline.includes(`ThumbGate v${expectedVersion}`)) {
+      throw new Error(`Statusline version mismatch before boot: ${initialStatusline.trim()}`);
+    }
+    if (!/(Dashboard|Dashboard…)/.test(initialStatusline) || !/(Lessons|Lessons…)/.test(initialStatusline)) {
+      throw new Error(`Statusline missing dashboard affordances before boot: ${initialStatusline.trim()}`);
+    }
+
+    const health = await waitForHealthy(origin, expectedVersion, Number(options.timeoutMs || DEFAULT_TIMEOUT_MS));
+    const dashboard = await request(`${origin}/dashboard`);
+    const lessons = await request(`${origin}/lessons`);
+    if (dashboard.statusCode !== 200) {
+      throw new Error(`Packaged dashboard returned ${dashboard.statusCode}`);
+    }
+    if (lessons.statusCode !== 200) {
+      throw new Error(`Packaged lessons returned ${lessons.statusCode}`);
+    }
+
+    const readyStatusline = renderStatusline(runtimeBin, projectDir, env);
+    if (!/(Dashboard|Dashboard…)/.test(readyStatusline)) {
+      throw new Error(`Ready statusline missing dashboard label: ${readyStatusline.trim()}`);
+    }
+    if (!/(Lessons|Lessons…)/.test(readyStatusline)) {
+      throw new Error(`Ready statusline missing lessons label: ${readyStatusline.trim()}`);
+    }
+    if (readyStatusline.includes(`${origin}/dashboard`)) {
+      throw new Error(`Ready statusline leaked dashboard URL: ${readyStatusline.trim()}`);
+    }
+    if (readyStatusline.includes(`${origin}/lessons`)) {
+      throw new Error(`Ready statusline leaked lessons URL: ${readyStatusline.trim()}`);
+    }
+    // Thumbs-up/down icons stay inline while dashboard + lessons remain compact
+    // labels, even after the local API is up.
+    if (!readyStatusline.includes('👍')) {
+      throw new Error(`Ready statusline missing thumbs-up icon: ${readyStatusline.trim()}`);
+    }
+    if (!readyStatusline.includes('👎')) {
+      throw new Error(`Ready statusline missing thumbs-down icon: ${readyStatusline.trim()}`);
+    }
+
+    return {
+      packageSpec,
+      expectedVersion,
+      origin,
+      health,
+    };
+  } finally {
+    await stopDetachedRuntime(homeDir);
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+async function main() {
+  const args = parseArgs();
+  const result = await runPackagedRuntimeSmoke({
+    packageSpec: args.packageSpec,
+    expectedVersion: args.expectedVersion,
+    timeoutMs: args.timeoutMs,
+    installAttempts: args.installAttempts,
+    installDelayMs: args.installDelayMs,
+  });
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+}
+
+if (require.main === module) {
+  main().catch((error) => {
+    process.stderr.write(`${error.message || String(error)}\n`);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  getAvailablePort,
+  installPackageWithRetry,
+  isRemotePackageSpec,
+  isTransientRegistryMiss,
+  packCurrentRepo,
+  runPackagedRuntimeSmoke,
+  waitForHealthy,
+};

package/scripts/prove-predictive-insights.js

@@ -4,6 +4,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { ensureDir } = require('./fs-utils');
 
 const ROOT = path.join(__dirname, '..');
 
@@ -16,9 +17,6 @@ function resolveProofPaths() {
   };
 }
 
-function ensureDir(dirPath) {
-  fs.mkdirSync(dirPath, { recursive: true });
-}
 
 function buildStubTelemetry() {
   return {

package/scripts/prove-runtime.js

@@ -5,6 +5,7 @@ const os = require('os');
 const path = require('path');
 
 const { buildManagedScheduleCommand } = require('./schedule-manager');
+const { runPackagedRuntimeSmoke } = require('./prove-packaged-runtime');
 
 const ROOT = path.join(__dirname, '..');
 const RUNNER_PATH = require.resolve('./async-job-runner');
@@ -275,6 +276,18 @@ async function run() {
         }
       },
     },
+    {
+      id: 'RUNTIME-07',
+      desc: 'packaged thumbgate runtime boots local API and serves dashboard affordances',
+      fn: async () => {
+        const result = await runPackagedRuntimeSmoke({
+          expectedVersion: require(path.join(ROOT, 'package.json')).version,
+        });
+        if (!result.health || result.health.version !== require(path.join(ROOT, 'package.json')).version) {
+          throw new Error('Packaged runtime health version did not match package.json');
+        }
+      },
+    },
   ];
 
   console.log('Interruptible Runtime - Proof Gate\n');

package/scripts/prove-training-export.js

@@ -13,15 +13,13 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const { execSync } = require('child_process');
+const { ensureDir } = require('./fs-utils');
 
 const ROOT = path.join(__dirname, '..');
 function getProofDir() {
   return process.env.THUMBGATE_PROOF_DIR || path.join(ROOT, 'proof');
 }
 
-function ensureDir(d) {
-  if (!fs.existsSync(d)) fs.mkdirSync(d, { recursive: true });
-}
 
 function runTests() {
   try {

package/scripts/prove-workflow-contract.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 const fs = require('node:fs');
 const path = require('node:path');
+const { ensureDir } = require('./fs-utils');
 const {
   runWorkflowContractValidation,
 } = require('./validate-workflow-contract');
@@ -8,11 +9,6 @@ const {
 const PROJECT_ROOT = path.join(__dirname, '..');
 const DEFAULT_PROOF_DIR = path.join(PROJECT_ROOT, 'proof', 'workflow-contract');
 
-function ensureDir(dirPath) {
-  if (!fs.existsSync(dirPath)) {
-    fs.mkdirSync(dirPath, { recursive: true });
-  }
-}
 
 function toMarkdown(report) {
   const lines = [

package/scripts/rate-limiter.js

@@ -5,14 +5,16 @@ const fs = require('fs');
 const path = require('path');
 const {
   PRO_MONTHLY_PAYMENT_LINK,
+  PRO_PRICE_LABEL,
+  TEAM_PRICE_LABEL,
 } = require('./commercial-offer');
 
 const USAGE_FILE = path.join(process.env.HOME || '/tmp', '.thumbgate', 'usage-limits.json');
 
 const FREE_TIER_LIMITS = {
-  capture_feedback: { daily: Infinity, label: 'feedback captures' },
+  capture_feedback: { daily: 3, label: 'feedback captures' },
   search_lessons: { daily: 5, label: 'lesson searches' },
-  search_thumbgate: { daily: 10, label: 'ThumbGate searches' },
+  search_thumbgate: { daily: 5, label: 'ThumbGate searches' },
   commerce_recall: { daily: 5, label: 'commerce recalls' },
   export_dpo: { daily: 0, label: 'DPO exports (Pro only)' },
   export_databricks: { daily: 0, label: 'Databricks exports (Pro only)' },
@@ -20,7 +22,7 @@ const FREE_TIER_LIMITS = {
 
 const FREE_TIER_MAX_GATES = 5;
 
-const UPGRADE_MESSAGE = `Upgrade to Pro ($19/mo) for a personal local dashboard, DPO export, and optional hosted API key: ${PRO_MONTHLY_PAYMENT_LINK}`;
+const UPGRADE_MESSAGE = `Pro: ${PRO_PRICE_LABEL} — dashboard and DPO export: ${PRO_MONTHLY_PAYMENT_LINK}\n  Team: ${TEAM_PRICE_LABEL} after workflow qualification.`;
 
 function isProTier(authContext) {
   if (authContext && authContext.tier === 'pro') return true;
@@ -83,7 +85,7 @@ function checkLimit(action, authContext) {
   const current = usage.counts[action] || 0;
 
   if (current >= dailyLimit) {
-    return { allowed: false, message: UPGRADE_MESSAGE, used: current, limit: dailyLimit };
+    return { allowed: false, message: `Free tier limit reached. Upgrade to Pro for unlimited: https://thumbgate-production.up.railway.app/pro\n${UPGRADE_MESSAGE}`, used: current, limit: dailyLimit };
   }
 
   // Increment

package/scripts/reddit-dm-outreach.js

@@ -151,13 +151,23 @@ async function main() {
     const messages = [
       {
         to: 'game-of-kton',
-        subject: 'ThumbGate Pro — Try it free, get the hook',
-        text: 'Hey, thanks for the thoughtful comments on the Cursor thread about agent memory. You clearly get the hooks-based enforcement approach. Would you be open to trying ThumbGate Pro for free? I\'d love to get your honest take — if you like it, a one-sentence quote I can use on the landing page would be huge. No strings attached either way. Here\'s the repo: https://github.com/IgorGanapolsky/ThumbGate'
+        subject: 'Quick question about your agent workflow',
+        text: 'Hey — you left some really thoughtful comments on the AI coding agent thread. I\'m building ThumbGate (agent mistake prevention via PreToolUse hooks) and your feedback was the most useful I got.\n\nI\'m trying to figure out if this is worth building further. Would you be open to a quick 15-min call this week? Just want to understand how you handle agent mistakes in your workflow.\n\nI\'ll give you lifetime Pro access regardless — no strings attached.\n\nHere\'s the repo if you want to look first: https://github.com/IgorGanapolsky/ThumbGate'
       },
       {
         to: 'Deep_Ad1959',
-        subject: 'ThumbGate Pro — Context-dependent blocking (your idea)',
-        text: 'Hey, your point about context-dependent blocking was spot on — it\'s exactly why we use Thompson Sampling instead of hard binary blocks. Would you be interested in trying ThumbGate Pro for free? If you find it useful, I\'d appreciate a quick testimonial quote for the site. No obligation. Repo: https://github.com/IgorGanapolsky/ThumbGate'
+        subject: 'Your context-dependent blocking idea',
+        text: 'Hey — your point about context-dependent blocking was really insightful. That\'s exactly the problem I\'m trying to solve with ThumbGate (using Thompson Sampling for adaptive gates instead of hard binary blocks).\n\nWould you be open to a quick 15-min call this week? I\'m trying to figure out what developers would actually pay for in this space. Your perspective would be genuinely valuable.\n\nLifetime Pro access is yours either way. Repo: https://github.com/IgorGanapolsky/ThumbGate'
+      },
+      {
+        to: 'leogodin217',
+        subject: 'Quick question about AI agent safety in your workflow',
+        text: 'Hey — you engaged with one of my posts about AI coding agent tooling and your take stood out. I\'m building ThumbGate (prevents AI agents from repeating mistakes via automated prevention rules).\n\nI\'m at the stage where I need honest feedback from people who actually use agents daily. Would you do a quick 15-min call this week? Just want to understand your pain points.\n\nLifetime Pro access is yours regardless. Repo: https://github.com/IgorGanapolsky/ThumbGate'
+      },
+      {
+        to: 'Enthu-Cutlet-1337',
+        subject: 'Quick question about your AI coding agent setup',
+        text: 'Hey — you commented on one of my posts about agent memory/safety tooling and your feedback was one of the few that was genuinely useful.\n\nI\'m building ThumbGate (automated mistake prevention for AI coding agents) and I\'m trying to figure out if this solves a real problem or if everyone just uses CLAUDE.md files. Would you be open to a quick 15-min call this week?\n\nLifetime Pro access is yours either way — no pitch, just questions. Repo: https://github.com/IgorGanapolsky/ThumbGate'
       }
     ];
 

package/scripts/schedule-manager.js

@@ -6,13 +6,11 @@ const path = require('path');
 const os = require('os');
 const { execSync } = require('child_process');
 const { buildAgenticDataPipelineJobSpec } = require('./agentic-data-pipeline');
+const { ensureDir } = require('./fs-utils');
 
 const SCHEDULES_DIR = path.join(os.homedir(), '.thumbgate', 'schedules');
 const PLIST_PREFIX = 'com.thumbgate.schedule';
 
-function ensureDir() {
-  if (!fs.existsSync(SCHEDULES_DIR)) fs.mkdirSync(SCHEDULES_DIR, { recursive: true });
-}
 
 function escapePlistString(value) {
   return String(value || '')
@@ -153,7 +151,7 @@ function buildAgenticDataPipelineSchedule(params = {}) {
 }
 
 function createSchedule(params) {
-  ensureDir();
+  ensureDir(SCHEDULES_DIR);
 
   const id = params.id || params.name || `sched_${Date.now()}`;
   const calendarInterval = parseCronSpec(params.schedule);
@@ -214,7 +212,7 @@ function createSchedule(params) {
 }
 
 function listSchedules() {
-  ensureDir();
+  ensureDir(SCHEDULES_DIR);
   const files = fs.readdirSync(SCHEDULES_DIR).filter(f => f.endsWith('.json'));
   return files.map(f => {
     try {