thumbgate 1.27.17 → 1.27.19

package/adapters/policy-engine/thumbgate-policy-engine-adapter.js

@@ -1,260 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-const { normalizeProviderAction } = require('../../scripts/provider-action-normalizer');
-
-const BLOCK_DECISIONS = new Set([
-  'block',
-  'blocked',
-  'deny',
-  'denied',
-  'disallow',
-  'disallowed',
-  'fail',
-  'failed',
-  'forbid',
-  'forbidden',
-  'reject',
-  'rejected',
-  'unsafe',
-  'violation',
-]);
-
-const REVIEW_DECISIONS = new Set([
-  'approval',
-  'approval-required',
-  'approval_required',
-  'approve',
-  'human-review',
-  'human_review',
-  'manual-review',
-  'manual_review',
-  'review',
-  'requires-approval',
-  'requires_approval',
-  'requires-review',
-  'requires_review',
-]);
-
-const ALLOW_DECISIONS = new Set([
-  'accept',
-  'accepted',
-  'allow',
-  'allowed',
-  'ok',
-  'pass',
-  'passed',
-  'permit',
-  'permitted',
-  'safe',
-]);
-
-function asObject(value) {
-  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
-
-function asArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-
-function firstString(...values) {
-  for (const value of values) {
-    const text = String(value || '').trim();
-    if (text) return text;
-  }
-  return '';
-}
-
-function normalizeDecisionToken(value) {
-  return String(value || '')
-    .trim()
-    .toLowerCase()
-    .replace(/\s+/g, '-');
-}
-
-function normalizeEvidence(value) {
-  const direct = asArray(value.evidence);
-  const citations = asArray(value.citations);
-  const violations = asArray(value.violations);
-  const reasons = asArray(value.reasons);
-  const reasoning = asArray(value.reasoning);
-  const threatTypes = asArray(value.threat_types || value.threatTypes)
-    .map((threatType) => ({
-      code: String(threatType || '').trim(),
-      message: `Threat type: ${String(threatType || '').trim()}`,
-      source: 'guardian',
-      severity: firstString(value.threat_level, value.threatLevel),
-    }));
-  return [...direct, ...citations, ...violations, ...reasons, ...reasoning, ...threatTypes]
-    .map((entry) => {
-      if (typeof entry === 'string') return { text: entry };
-      const object = asObject(entry);
-      if (!Object.keys(object).length) return null;
-      return {
-        id: firstString(object.id, object.ruleId, object.rule_id, object.code),
-        text: firstString(object.text, object.reason, object.message, object.description, object.title),
-        source: firstString(object.source, object.provider, object.policy),
-        severity: firstString(object.severity, object.level),
-        raw: object,
-      };
-    })
-    .filter(Boolean);
-}
-
-function extractPolicyDecision(input = {}) {
-  const event = asObject(input);
-  for (const candidate of [
-    event.policyDecision,
-    event.policy_decision,
-    event.guardrailResult,
-    event.guardrail_result,
-    event.result,
-  ]) {
-    const object = asObject(candidate);
-    if (Object.keys(object).length) return object;
-  }
-  return event;
-}
-
-function classifyPolicyDecision(input = {}) {
-  const value = extractPolicyDecision(input);
-  const token = normalizeDecisionToken(firstString(
-    value.decision,
-    value.action,
-    value.status,
-    value.result,
-    value.verdict,
-    value.outcome,
-    value.effect,
-    value.recommended_action,
-    value.recommendedAction,
-  ));
-
-  if (
-    value.allowed === false
-    || value.is_safe === false
-    || value.isSafe === false
-    || value.accepted === false
-    || value.blocked === true
-    || value.denied === true
-    || BLOCK_DECISIONS.has(token)
-  ) {
-    return 'block';
-  }
-  if (
-    value.requiresApproval === true
-    || value.requires_approval === true
-    || value.reviewRequired === true
-    || value.review_required === true
-    || REVIEW_DECISIONS.has(token)
-  ) {
-    return 'approval_required';
-  }
-  if (
-    value.allowed === true
-    || value.is_safe === true
-    || value.isSafe === true
-    || value.accepted === true
-    || ALLOW_DECISIONS.has(token)
-  ) {
-    return 'allow';
-  }
-  return 'unknown';
-}
-
-function normalizePolicyDecision(input = {}, options = {}) {
-  const value = extractPolicyDecision(input);
-  const decision = classifyPolicyDecision(value);
-  const source = firstString(
-    options.source,
-    value.source,
-    value.provider,
-    value.engine,
-    value.policyEngine,
-    value.policy_engine,
-    'policy-engine'
-  );
-  const reason = firstString(
-    value.reason,
-    value.message,
-    value.explanation,
-    value.summary,
-    asArray(value.reasoning).join('; '),
-    asArray(value.reasons).join('; '),
-    decision === 'unknown' ? 'Policy engine returned an unknown decision; approval required before execution.' : ''
-  );
-
-  return {
-    allowed: decision === 'allow',
-    blocked: decision === 'block',
-    approvalRequired: decision === 'approval_required' || decision === 'unknown',
-    decision,
-    reason,
-    source,
-    confidence: Number.isFinite(Number(value.confidence)) ? Number(value.confidence) : null,
-    policyId: firstString(value.policyId, value.policy_id, value.ruleId, value.rule_id, value.id),
-    severity: firstString(value.severity, value.level, value.threat_level, value.threatLevel),
-    score: Number.isFinite(Number(value.score))
-      ? Number(value.score)
-      : (Number.isFinite(Number(value.threat_score)) ? Number(value.threat_score) : null),
-    evidence: normalizeEvidence(value),
-    raw: value,
-  };
-}
-
-function normalizePolicyAction(input = {}) {
-  const event = asObject(input);
-  return {
-    ...normalizeProviderAction({
-      ...event,
-      provider: firstString(event.provider, event.agentRuntime, event.runtime, 'policy-engine'),
-      toolName: firstString(event.toolName, event.tool_name, event.name),
-      input: asObject(event.toolInput || event.input || event.arguments || event.args),
-    }),
-    policyContext: asObject(event.policyContext || event.policy_context),
-  };
-}
-
-function createPolicyEngineGuard({
-  policyCheck,
-  executeTool,
-  gateCheck,
-  onDecision,
-  source = 'policy-engine',
-} = {}) {
-  if (typeof policyCheck !== 'function') {
-    throw new TypeError('createPolicyEngineGuard requires a policyCheck function');
-  }
-  if (typeof executeTool !== 'function') {
-    throw new TypeError('createPolicyEngineGuard requires an executeTool function');
-  }
-
-  return async function guardedPolicyTool(input = {}) {
-    const normalizedAction = normalizePolicyAction(input);
-    const policyDecision = normalizePolicyDecision(await policyCheck(normalizedAction), { source });
-    const gateDecision = typeof gateCheck === 'function'
-      ? normalizePolicyDecision(await gateCheck({ normalizedAction, policyDecision }), { source: 'thumbgate' })
-      : null;
-    const effectiveDecision = gateDecision && !gateDecision.allowed ? gateDecision : policyDecision;
-
-    if (typeof onDecision === 'function') {
-      await onDecision({ normalizedAction, policyDecision, gateDecision, effectiveDecision });
-    }
-
-    if (!effectiveDecision.allowed) {
-      const error = new Error(effectiveDecision.reason || 'ThumbGate blocked this action before execution.');
-      error.code = effectiveDecision.approvalRequired ? 'THUMBGATE_APPROVAL_REQUIRED' : 'THUMBGATE_BLOCKED';
-      error.thumbgate = { normalizedAction, policyDecision, gateDecision, effectiveDecision };
-      throw error;
-    }
-
-    return executeTool(input, { normalizedAction, policyDecision, gateDecision, effectiveDecision });
-  };
-}
-
-module.exports = {
-  createPolicyEngineGuard,
-  extractPolicyDecision,
-  normalizePolicyAction,
-  normalizePolicyDecision,
-};

package/bench/observability-eval-suite.json

@@ -1,26 +0,0 @@
-{
-  "cases": [
-    {
-      "id": "checkout-link-grounding",
-      "traceId": "trace_checkout_001",
-      "question": "Is the Pro checkout link working?",
-      "response": "The Pro checkout link is working because the checkout diagnostic confirms Stripe Pro checkout is reachable.",
-      "retrievedContexts": [
-        "Stripe Pro checkout diagnostic confirms the Pro checkout link is reachable and returns a valid checkout target.",
-        "The workflow sprint checkout is intake-led and should not expose a stale payment link."
-      ],
-      "reference": "The Pro checkout link is reachable when the Stripe diagnostic passes."
-    },
-    {
-      "id": "letta-tool-gate",
-      "traceId": "trace_letta_001",
-      "question": "Should Letta execute a force push tool call?",
-      "response": "ThumbGate blocks force push before execution for Letta tool calls.",
-      "retrievedContexts": [
-        "ThumbGate's Letta adapter wraps Letta tool calls and runs gate-check before the executor is called.",
-        "Force push to main is a blocked high-risk git action."
-      ],
-      "reference": "ThumbGate blocks high-risk Letta tool calls before execution."
-    }
-  ]
-}

package/bin/dashboard-cli.js

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-// Insert 'dashboard' and '--open' as the subcommands/arguments
-process.argv.splice(2, 0, 'dashboard', '--open');
-
-require('./cli.js');

package/commands/dashboard.md

@@ -1,15 +0,0 @@
----
-name: dashboard
-description: Open the local HTTP dashboard for the current project in your web browser.
----
-
-# Open Dashboard
-
-Open the local HTTP dashboard for the current project in your web browser.
-
-## Instructions
-Execute the following command in the project directory to open the browser dashboard scoped to the current repository:
-```bash
-thumbgate-dashboard
-```
-

package/commands/thumbgate-dashboard.md

@@ -1,15 +0,0 @@
----
-name: thumbgate-dashboard
-description: Open the local HTTP dashboard for the current project in your web browser.
----
-
-# Open Scoped ThumbGate Dashboard
-
-Open the local HTTP dashboard for the current project in your web browser.
-
-## Instructions
-Execute the following command in the project directory to open the browser dashboard:
-```bash
-thumbgate-dashboard
-```
-

package/config/builtin-lessons.json

@@ -1,23 +0,0 @@
-{
-  "version": 1,
-  "lessons": [
-    {
-      "id": "builtin-response-quality-shallow-positive-closeout",
-      "title": "MISTAKE: Assistant gave shallow acknowledgement after user said thumbs up",
-      "content": "What went wrong: Assistant gave shallow acknowledgement after positive feedback, such as thumbs up, perfect, good, or thank you, instead of staying quiet or giving an evidence checkpoint.\nHow to avoid: If the previous user message is positive feedback and the proposed final response is a low-value social closeout, block it and require either silence-level brevity or a compact evidence checkpoint with proof, result, residual risk, and next state.\nAction needed: Enforce this at the final-response boundary, not only as PreToolUse context.\nReasoning: Stored lessons and retrieval are not enough when the model can still ignore the lesson at generation time.",
-      "category": "error",
-      "importance": "high",
-      "tags": [
-        "feedback",
-        "negative",
-        "response-quality",
-        "final-response",
-        "positive-feedback",
-        "shallow-closeout",
-        "enforcement"
-      ],
-      "timestamp": "2026-06-20T19:01:58.000Z",
-      "source": "packaged-builtin"
-    }
-  ]
-}

package/public/about.html

@@ -1,162 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta name="generator" content="ThumbGate">
-<meta name="author" content="Igor Ganapolsky">
-<meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
-__GOOGLE_SITE_VERIFICATION_META__
-<link rel="icon" type="image/png" href="/thumbgate-icon.png">
-<link rel="alternate icon" type="image/svg+xml" href="/assets/brand/thumbgate-mark.svg">
-<title>About Igor Ganapolsky — ThumbGate</title>
-<meta name="description" content="Igor Ganapolsky — Senior AI &amp; Mobile Engineer building ThumbGate, an agent-governance layer for Claude Code, Cursor, Codex, and Gemini. Production Stripe Connect, Agentic RAG, and React Native experience.">
-<meta property="og:title" content="About Igor Ganapolsky — ThumbGate">
-<meta property="og:description" content="Senior AI &amp; Mobile Engineer. Builder of ThumbGate. Production Stripe Connect + Agentic RAG + React Native engineer for hire.">
-<meta property="og:type" content="profile">
-<meta property="og:url" content="https://thumbgate.ai/about">
-<meta property="og:image" content="https://thumbgate.ai/og.png">
-<meta name="twitter:card" content="summary_large_image">
-<link rel="canonical" href="https://thumbgate.ai/about">
-<link rel="alternate" type="text/markdown" title="ThumbGate LLM context" href="https://thumbgate.ai/llm-context.md">
-
-<script type="application/ld+json">
-{
-  "@context": "https://schema.org",
-  "@type": "Person",
-  "name": "Igor Ganapolsky",
-  "givenName": "Igor",
-  "familyName": "Ganapolsky",
-  "alternateName": ["iganapolsky", "IgorGanapolsky"],
-  "url": "https://thumbgate.ai/about",
-  "image": "https://thumbgate.ai/og.png",
-  "jobTitle": "Senior AI & Mobile Engineer",
-  "description": "Production Stripe Connect, Agentic RAG, React Native, and AI-agent governance engineer. Creator of ThumbGate — pre-action defense for AI coding agents.",
-  "knowsAbout": [
-    "Agentic RAG",
-    "Stripe Connect",
-    "Stripe Billing",
-    "React Native",
-    "Android",
-    "Claude Code",
-    "Cursor",
-    "Codex",
-    "Gemini",
-    "AI agent governance",
-    "LLM cost optimization",
-    "Pre-action checks",
-    "Workflow hardening",
-    "Context engineering",
-    "MCP servers",
-    "LangChain",
-    "LangGraph",
-    "Patchright",
-    "Playwright",
-    "OpenAI API",
-    "Anthropic API"
-  ],
-  "address": {
-    "@type": "PostalAddress",
-    "addressLocality": "Coral Springs",
-    "addressRegion": "FL",
-    "addressCountry": "US"
-  },
-  "email": "iganapolsky@gmail.com",
-  "sameAs": [
-    "https://github.com/IgorGanapolsky",
-    "https://www.linkedin.com/in/igor-ganapolsky-5324b7330",
-    "https://dev.to/igorganapolsky",
-    "https://www.upwork.com/freelancers/~01b5f08ed8b1a9a3c1",
-    "https://huggingface.co/IgorGanapolsky",
-    "https://x.com/igorganapolsky"
-  ],
-  "worksFor": {
-    "@type": "Organization",
-    "name": "ThumbGate",
-    "url": "https://thumbgate.ai/"
-  },
-  "owns": {
-    "@type": "SoftwareApplication",
-    "name": "ThumbGate",
-    "applicationCategory": "DeveloperApplication",
-    "description": "Pre-action defense for AI coding agents — thumbs up/down become history-aware lessons across Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode."
-  }
-}
-</script>
-
-<style>
-body{margin:0;font-family:-apple-system,BlinkMacSystemFont,"SF Pro Text",Inter,system-ui,sans-serif;line-height:1.6;color:#0f172a;background:#fafafa}
-header{padding:1rem 1.5rem;border-bottom:1px solid #e5e7eb;background:#fff;display:flex;align-items:center;gap:1rem}
-header a{color:#0f172a;text-decoration:none;font-weight:600}
-main{max-width:780px;margin:0 auto;padding:2.5rem 1.5rem}
-h1{font-size:2rem;margin:0 0 .25rem}
-h2{margin-top:2rem;font-size:1.25rem}
-.lede{font-size:1.125rem;color:#475569}
-.chips{display:flex;flex-wrap:wrap;gap:.4rem;margin:.75rem 0 0}
-.chip{display:inline-block;padding:.2rem .55rem;border:1px solid #e2e8f0;border-radius:9999px;font-size:.85rem;color:#334155;background:#fff}
-ul.links{list-style:none;padding:0;margin:1rem 0;display:grid;grid-template-columns:repeat(auto-fill,minmax(180px,1fr));gap:.5rem}
-ul.links li a{display:block;padding:.6rem .8rem;background:#fff;border:1px solid #e2e8f0;border-radius:.5rem;color:#0f172a;text-decoration:none}
-ul.links li a:hover{border-color:#0f172a}
-.section{background:#fff;border:1px solid #e5e7eb;border-radius:.75rem;padding:1.25rem 1.5rem;margin:1.25rem 0}
-footer{padding:2rem 1.5rem;color:#64748b;font-size:.9rem;text-align:center}
-</style>
-</head>
-<body>
-
-<header>
-<a href="/">ThumbGate</a>
-<span style="color:#94a3b8">/</span>
-<span>About</span>
-</header>
-
-<main>
-
-<h1>Igor Ganapolsky</h1>
-<p class="lede">Senior AI &amp; Mobile Engineer. Builder of <a href="/">ThumbGate</a> — pre-action defense for AI coding agents. Available for high-leverage Stripe Connect, Agentic RAG, and React Native contract engagements.</p>
-
-<div class="chips">
-  <span class="chip">Coral Springs, FL · US</span>
-  <span class="chip">Agentic RAG</span>
-  <span class="chip">Stripe Connect</span>
-  <span class="chip">React Native</span>
-  <span class="chip">Android</span>
-  <span class="chip">Claude Code · Cursor · Codex · Gemini</span>
-</div>
-
-<section class="section">
-<h2>What I build</h2>
-<p><strong>ThumbGate</strong> is the agent-governance layer that turns 👍 / 👎 signals into history-aware lessons across Claude Code, Cursor, Codex, Gemini, Amp, Cline, and OpenCode. Pre-Action Checks block the next repeated mistake before the tool call runs — workflow shape, inspection evidence, token budget, and repeated-failure memory in one gate.</p>
-<p>Outside ThumbGate, I ship production Stripe Connect marketplaces, Agentic RAG systems with LanceDB / pgvector / FAISS retrieval, React Native + Android apps, and LLM cost-instrumentation layers.</p>
-</section>
-
-<section class="section">
-<h2>Recent ships</h2>
-<ul>
-<li><strong>Hilltown Media Group · Pretix Stripe Connect plugin</strong> — production payments + automation, 100% test coverage, milestone-funded delivery.</li>
-<li><strong>ThumbGate v1.27</strong> — pre-action governance for AI coding agents, available on npm as <code>thumbgate</code>.</li>
-<li><strong>Resume revenue ML stack</strong> — Thompson-sampling bandit + copy/buyer logistic regression + Agentic RAG for closed-loop UpWork bidding.</li>
-</ul>
-</section>
-
-<section class="section">
-<h2>For hire</h2>
-<p>Available for fixed-price engagements ≥ $2K and ongoing retainers. Standard rate $120–150/hr 1099. Strong signal on Stripe Connect &amp; Billing audits, RAG + LLM evaluation harnesses, and React Native + Android engineering. Email <a href="mailto:iganapolsky@gmail.com">iganapolsky@gmail.com</a> or reach me on <a href="https://www.upwork.com/freelancers/~01b5f08ed8b1a9a3c1">Upwork</a>.</p>
-</section>
-
-<h2>Links</h2>
-<ul class="links">
-<li><a href="https://github.com/IgorGanapolsky" rel="me">GitHub</a></li>
-<li><a href="https://www.linkedin.com/in/igor-ganapolsky-5324b7330" rel="me">LinkedIn</a></li>
-<li><a href="https://dev.to/igorganapolsky" rel="me">dev.to</a></li>
-<li><a href="https://www.upwork.com/freelancers/~01b5f08ed8b1a9a3c1" rel="me">Upwork</a></li>
-<li><a href="https://huggingface.co/IgorGanapolsky" rel="me">Hugging Face</a></li>
-<li><a href="https://x.com/igorganapolsky" rel="me">X</a></li>
-</ul>
-
-</main>
-
-<footer>
-© 2026 ThumbGate · Built by <a href="/about">Igor Ganapolsky</a>
-</footer>
-
-</body>
-</html>