thumbgate 1.27.10 → 1.27.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.27.10",
+  "version": "1.27.11",
   "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 36 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
   "homepage": "https://thumbgate.ai",
   "repository": {

package/scripts/gate-stats.js

@@ -11,6 +11,11 @@ const PROJECT_ROOT = path.join(__dirname, '..');
 const MANUAL_GATES_PATH = path.join(PROJECT_ROOT, 'config', 'gates', 'default.json');
 const STATS_PATH = path.join(process.env.HOME || '/tmp', '.thumbgate', 'gate-stats.json');
 
+function safeOccurrenceCount(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? n : 0;
+}
+
 function loadGatesFile(filePath) {
   if (!fs.existsSync(filePath)) return [];
   try {
@@ -39,16 +44,16 @@ function calculateStats() {
   // Count total blocks/warns from occurrences in auto-promoted gates
   const totalBlocked = autoGates
     .filter((g) => g.action === 'block')
-    .reduce((sum, g) => sum + (g.occurrences || 0), 0);
+    .reduce((sum, g) => sum + safeOccurrenceCount(g.occurrences), 0);
   const totalWarned = autoGates
     .filter((g) => g.action === 'warn')
-    .reduce((sum, g) => sum + (g.occurrences || 0), 0);
+    .reduce((sum, g) => sum + safeOccurrenceCount(g.occurrences), 0);
 
   // Top blocked gate. A configured block rule with zero occurrences is not a
   // "top blocker"; only recorded block events should appear here.
   const topBlocked = [...allGates]
-    .filter((g) => g.action === 'block' && Number(g.occurrences || 0) > 0)
-    .sort((a, b) => (b.occurrences || 0) - (a.occurrences || 0))
+    .filter((g) => g.action === 'block' && safeOccurrenceCount(g.occurrences) > 0)
+    .sort((a, b) => safeOccurrenceCount(b.occurrences) - safeOccurrenceCount(a.occurrences))
     .at(0) || null;
 
   // Last promotion event
@@ -105,7 +110,7 @@ function computeCalibration(gates) {
   const calibration = [];
   for (const gate of gates || []) {
     if (!gate || !gate.id) continue;
-    const occurrences = Number(gate.occurrences || 0);
+    const occurrences = safeOccurrenceCount(gate.occurrences);
     const action = gate.action || 'unknown';
     // Only annotate gates with recorded occurrence data
     if (occurrences === 0) continue;
@@ -258,6 +263,7 @@ module.exports = {
   loadGatesFile,
   tryComputeBayesErrorRate,
   computeCalibration,
+  safeOccurrenceCount,
   MANUAL_GATES_PATH,
   STATS_PATH,
 };

package/scripts/hook-stop-anti-claim.js

@@ -16,10 +16,11 @@
  * ThumbGate dogfood — we are the prevention-rule generator and a perfect
  * customer for our own gate.
  *
- * Wires through .claude/settings.json Stop hooks list. Always exits 0
- * (informational): the goal is to surface a system reminder in the next
- * turn so the agent corrects mid-conversation rather than to hard-block
- * the turn that already happened.
+ * Wires through .claude/settings.json Stop hooks list. Always exits 0 and
+ * emits a Claude-hook `decision:"block"` JSON payload when a final-response
+ * violation can be evaluated before the response is accepted. Transcript-only
+ * runs still surface a reminder for the next turn when the host has already
+ * written the assistant response.
  *
  * Stdin: Claude Code passes the hook payload as JSON on stdin. We read
  * `transcript_path` to locate the JSONL session log and scan the last
@@ -203,6 +204,79 @@ function hasProof(combined) {
   return PROOF_PATTERNS.some((p) => p.test(combined));
 }
 
+function extractPayloadText(payload) {
+  if (!payload || typeof payload !== 'object') return '';
+  const candidates = [
+    payload.response,
+    payload.assistant_response,
+    payload.assistantResponse,
+    payload.final_response,
+    payload.finalResponse,
+    payload.text,
+    payload.output,
+    payload.message,
+  ];
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.trim()) return candidate;
+    if (candidate && typeof candidate === 'object') {
+      const extracted = extractText(candidate);
+      if (extracted.trim()) return extracted;
+    }
+  }
+  return '';
+}
+
+function extractPayloadPreviousUserText(payload) {
+  if (!payload || typeof payload !== 'object') return '';
+  const candidates = [
+    payload.previous_user_text,
+    payload.previousUserText,
+    payload.user_prompt,
+    payload.userPrompt,
+    payload.prompt,
+  ];
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.trim()) return candidate;
+    if (candidate && typeof candidate === 'object') {
+      const extracted = extractText(candidate);
+      if (extracted.trim()) return extracted;
+    }
+  }
+  return '';
+}
+
+function buildResponseQualityReason() {
+  return [
+    'ThumbGate response-quality gate: final response answered positive feedback',
+    'with a low-value social closeout instead of silence-level brevity or an evidence checkpoint.',
+    'Positive feedback after operational work should trigger either no extra noise,',
+    'a compact evidence checkpoint, or a concrete next-state update.',
+    'Do not reply with generic "Good / Great / Use X/Y" filler.',
+  ].join(' ');
+}
+
+function buildResponseQualityReminder() {
+  return [
+    '⚠️ ThumbGate response-quality gate: previous turn answered positive feedback',
+    '   with a low-value social closeout instead of silence-level brevity or an evidence checkpoint.',
+    '   Positive feedback after operational work should trigger either no extra noise,',
+    '   a compact evidence checkpoint, or a concrete next-state update.',
+    '   Do not reply with generic "Good / Great / Use X/Y" filler.',
+  ].join('\n');
+}
+
+function writeBlock(reason) {
+  process.stdout.write(JSON.stringify({
+    decision: 'block',
+    reason,
+    hookSpecificOutput: {
+      hookEventName: 'Stop',
+      permissionDecision: 'deny',
+      permissionDecisionReason: reason,
+    },
+  }) + '\n');
+}
+
 function readStdinSync() {
   try {
     return fs.readFileSync(0, 'utf8');
@@ -221,6 +295,17 @@ function main() {
   }
 
   const transcriptPath = payload.transcript_path || process.env.CLAUDE_TRANSCRIPT_PATH;
+  const directText = extractPayloadText(payload) || process.env.CLAUDE_RESPONSE || '';
+  const directPreviousUserText = extractPayloadPreviousUserText(payload)
+    || process.env.CLAUDE_PREVIOUS_USER_TEXT
+    || process.env.CLAUDE_PREVIOUS_USER
+    || '';
+
+  if (directText && hasPositiveFeedback(directPreviousUserText) && isLowValueCloseout(directText, '')) {
+    writeBlock(buildResponseQualityReason());
+    return;
+  }
+
   const message = readLastAssistantTurn(transcriptPath);
   if (!message) return; // no transcript visible; nothing to check
 
@@ -229,14 +314,7 @@ function main() {
   const previousUserText = readPreviousUserText(transcriptPath);
 
   if (hasPositiveFeedback(previousUserText) && isLowValueCloseout(text, toolUseSummary)) {
-    const reminder = [
-      '⚠️ ThumbGate response-quality gate: previous turn answered positive feedback',
-      '   with a low-value social closeout instead of silence-level brevity or an evidence checkpoint.',
-      '   Positive feedback after operational work should trigger either no extra noise,',
-      '   a compact evidence checkpoint, or a concrete next-state update.',
-      '   Do not reply with generic "Good / Great / Use X/Y" filler.',
-    ].join('\n');
-    process.stdout.write(reminder + '\n');
+    process.stdout.write(buildResponseQualityReminder() + '\n');
     return;
   }
 
@@ -282,6 +360,9 @@ module.exports = {
   hasProof,
   hasPositiveFeedback,
   isLowValueCloseout,
+  extractPayloadText,
+  extractPayloadPreviousUserText,
+  buildResponseQualityReason,
   extractText,
   extractToolUseSummary,
   readPreviousUserText,