thumbgate 1.27.18 → 1.27.19

package/scripts/local-model-profile.js

@@ -111,7 +111,8 @@ function isSparseAttentionFamily(modelFamily) {
 
 function resolveProviderMode(env = process.env) {
   const explicit = normalizeSlug(env.THUMBGATE_PROVIDER_MODE || env.THUMBGATE_MODEL_PROVIDER_MODE);
-  if (explicit === 'local' || explicit === 'managed') return explicit;
+  if (explicit === 'local' || explicit === 'managed' || explicit === 'vertex') return explicit;
+  if (env.VERTEX_PROJECT_ID || env.VERTEX_API_ENDPOINT) return 'vertex';
   if (env.THUMBGATE_LOCAL_MODEL_FAMILY || env.THUMBGATE_LOCAL_MODEL_SERVER) return 'local';
   return 'managed';
 }
@@ -133,6 +134,7 @@ function resolveModelFamily(env = process.env) {
 }
 
 function buildBackendLabel(providerMode, modelFamily) {
+  if (providerMode === 'vertex') return 'Vertex AI secure cloud backend';
   if (providerMode === 'managed') return 'Managed API backend';
   if (modelFamily.startsWith('deepseek')) return 'Local DeepSeek sparse backend';
   if (modelFamily.startsWith('glm')) return 'Local GLM sparse backend';
@@ -148,14 +150,18 @@ function detectInferenceBackend(env = process.env) {
     && supportsSparseAttention
     && INDEXCACHE_SERVER_ENGINES.has(serverEngine);
   const indexCacheEnabled = indexCacheEligible && parseBoolean(env.THUMBGATE_INDEXCACHE_ENABLED, false);
-  const id = providerMode === 'managed'
-    ? 'managed-api'
-    : supportsSparseAttention
-      ? `local-${modelFamily}-sparse`
-      : 'local-dense';
+  const id = providerMode === 'vertex'
+    ? 'vertex-api'
+    : providerMode === 'managed'
+      ? 'managed-api'
+      : supportsSparseAttention
+        ? `local-${modelFamily}-sparse`
+        : 'local-dense';
 
   let rationale = 'Baseline backend with no sparse-attention acceleration.';
-  if (providerMode === 'managed') {
+  if (providerMode === 'vertex') {
+    rationale = 'Vertex AI secure cloud backend providing compliant enterprise Gemini models inside VPC boundary.';
+  } else if (providerMode === 'managed') {
     rationale = 'Managed API path does not expose sparse-attention kernel controls like IndexCache.';
   } else if (indexCacheEnabled) {
     rationale = `Local ${modelFamily} backend is sparse-attention capable and IndexCache-ready on ${serverEngine}.`;
@@ -336,7 +342,8 @@ function resolveModelRole(role, env) {
   const envKey = `THUMBGATE_MODEL_ROLE_${normalized.toUpperCase()}`;
   const modelFamily = resolveModelFamily(e);
   const isLocalGlm = modelFamily.startsWith('glm');
-  const provider = isLocalGlm ? 'local' : 'gemini';
+  const providerMode = resolveProviderMode(e);
+  const provider = isLocalGlm ? 'local' : (providerMode === 'vertex' ? 'vertex' : 'gemini');
   const defaultModel = isLocalGlm ? (GLM_MODEL_ROLES[normalized] || MODEL_ROLES[normalized]) : MODEL_ROLES[normalized];
   const model = (e[envKey] && String(e[envKey]).trim()) || defaultModel;
   return { role: normalized, model, provider, envKey };

package/scripts/mcp-config.js

@@ -107,9 +107,15 @@ function portableMcpEntry(pkgVersion) {
 }
 
 function codexAutoUpdateCliEntry(commandArgs = []) {
+  // Fast-start from the installed runtime binary; only resolve @latest via npx
+  // when the runtime is absent (e.g. first launch). This matches the hook
+  // commands and must never block MCP server startup on a per-launch reinstall
+  // (a blocking `npm install thumbgate@latest` on every launch caused
+  // capture/serve timeouts on slow or offline networks — a failed install left
+  // the chained `exec` unreached, so the server never started).
   return {
     command: 'sh',
-    args: ['-lc', publishedCliShellCommand('latest', commandArgs, { preferInstalled: false })],
+    args: ['-lc', publishedCliShellCommand('latest', commandArgs)],
   };
 }
 

package/scripts/memory-scope-readiness.js

@@ -2,6 +2,38 @@
 'use strict';
 
 const REQUIRED_SCOPE_FIELDS = ['entityId', 'projectId', 'processId', 'sessionId'];
+const MEMORY_OS_LAYERS = Object.freeze([
+  {
+    id: 'file_layer',
+    name: 'File Layer',
+    purpose: 'Raw feedback, tool receipts, sessions, and memory rows are durably stored before interpretation.',
+  },
+  {
+    id: 'vector_db_layer',
+    name: 'Vector DB Layer',
+    purpose: 'Semantic retrieval can find related lessons without stuffing every raw memory into context.',
+  },
+  {
+    id: 'structured_facts_layer',
+    name: 'Structured Facts Layer',
+    purpose: 'Confirmed account, project, policy, and budget facts are typed separately from fuzzy memories.',
+  },
+  {
+    id: 'auto_curation_layer',
+    name: 'Auto Curation Layer',
+    purpose: 'Duplicate, stale, contradictory, and unscoped memories are consolidated before retrieval quality decays.',
+  },
+  {
+    id: 'context_layer',
+    name: 'Context Layer',
+    purpose: 'Only relevant scoped memories enter a given tool call, PR, deployment, or support session.',
+  },
+  {
+    id: 'interface_layer',
+    name: 'Interface Layer',
+    purpose: 'The memory contract is exposed through CLI, MCP, hooks, dashboards, and agent adapters without model lock-in.',
+  },
+]);
 
 const FIELD_ALIASES = {
   entityId: [
@@ -228,6 +260,128 @@ function buildRecommendations({ unscopedRecords, crossScopeDuplicates }) {
   return recommendations;
 }
 
+function hasEmbeddingEvidence(record = {}) {
+  return Boolean(
+    record.embedding
+    || record.vector
+    || record.embeddingId
+    || record.metadata?.embedding
+    || record.metadata?.embeddingId
+    || record.metadata?.vectorId
+    || record.semanticKey
+    || record.metadata?.semanticKey
+  );
+}
+
+function hasStructuredFactEvidence(record = {}) {
+  const type = String(record.type || record.kind || record.memoryType || record.metadata?.type || '').toLowerCase();
+  return type === 'fact'
+    || type === 'structured_fact'
+    || Boolean(record.factKey || record.fact || record.metadata?.factKey || record.metadata?.fact);
+}
+
+function hasContextEvidence(record = {}) {
+  return Boolean(
+    record.contextPackId
+    || record.contextPack
+    || record.metadata?.contextPackId
+    || record.metadata?.contextPack
+    || record.retrievalQuery
+    || record.metadata?.retrievalQuery
+  );
+}
+
+function boolCapability(capabilities = {}, ...keys) {
+  return keys.some((key) => capabilities[key] === true);
+}
+
+function buildMemoryOsLayerReport(records = [], capabilities = {}) {
+  const scopeReport = buildMemoryScopeReadinessReport(records);
+  const semanticRecords = records.filter(hasEmbeddingEvidence);
+  const structuredFactRecords = records.filter(hasStructuredFactEvidence);
+  const contextRecords = records.filter(hasContextEvidence);
+  const curationReady = scopeReport.unscopedRecords === 0 && scopeReport.crossScopeDuplicates.length === 0;
+
+  const checks = [
+    {
+      id: 'file_layer',
+      ok: records.length > 0 || boolCapability(capabilities, 'rawStorage', 'fileLayer'),
+      evidence: {
+        records: records.length,
+        durableStore: Boolean(records.length > 0 || capabilities.rawStorage || capabilities.fileLayer),
+      },
+      recommendation: 'Capture raw feedback, action receipts, and tool outcomes before promoting memories.',
+    },
+    {
+      id: 'vector_db_layer',
+      ok: semanticRecords.length > 0 || boolCapability(capabilities, 'semanticSearch', 'vectorDbLayer'),
+      evidence: {
+        semanticRecords: semanticRecords.length,
+        semanticSearch: Boolean(capabilities.semanticSearch || capabilities.vectorDbLayer),
+      },
+      recommendation: 'Index lessons with semantic keys or embeddings so related failures are retrieved before action.',
+    },
+    {
+      id: 'structured_facts_layer',
+      ok: structuredFactRecords.length > 0 || boolCapability(capabilities, 'structuredFacts', 'structuredFactsLayer'),
+      evidence: {
+        structuredFactRecords: structuredFactRecords.length,
+        structuredFacts: Boolean(capabilities.structuredFacts || capabilities.structuredFactsLayer),
+      },
+      recommendation: 'Store confirmed customer, project, policy, and budget facts as typed records, not just prose.',
+    },
+    {
+      id: 'auto_curation_layer',
+      ok: curationReady && boolCapability(capabilities, 'autoCuration', 'dedupe', 'autoCurationLayer'),
+      evidence: {
+        unscopedRecords: scopeReport.unscopedRecords,
+        crossScopeDuplicates: scopeReport.crossScopeDuplicates.length,
+        autoCuration: Boolean(capabilities.autoCuration || capabilities.dedupe || capabilities.autoCurationLayer),
+      },
+      recommendation: 'Run dedupe, contradiction, stale-memory, and scope-isolation checks before memories can become gates.',
+    },
+    {
+      id: 'context_layer',
+      ok: contextRecords.length > 0 || boolCapability(capabilities, 'contextPacks', 'contextLayer', 'scopedRetrieval'),
+      evidence: {
+        contextRecords: contextRecords.length,
+        scopedRetrieval: Boolean(capabilities.contextPacks || capabilities.contextLayer || capabilities.scopedRetrieval),
+      },
+      recommendation: 'Inject scoped context packs per task instead of loading every memory into the model window.',
+    },
+    {
+      id: 'interface_layer',
+      ok: boolCapability(capabilities, 'mcp', 'cli', 'hooks', 'dashboard', 'interfaceLayer'),
+      evidence: {
+        cli: Boolean(capabilities.cli),
+        mcp: Boolean(capabilities.mcp),
+        hooks: Boolean(capabilities.hooks),
+        dashboard: Boolean(capabilities.dashboard),
+      },
+      recommendation: 'Expose the same memory contract through CLI, MCP, hooks, dashboard, and agent adapters.',
+    },
+  ].map((check) => {
+    const layer = MEMORY_OS_LAYERS.find((candidate) => candidate.id === check.id);
+    return {
+      ...layer,
+      ...check,
+    };
+  });
+
+  const missingLayers = checks.filter((check) => !check.ok).map((check) => check.id);
+
+  return {
+    ready: missingLayers.length === 0,
+    riskLevel: missingLayers.length === 0 ? 'low' : missingLayers.length <= 2 ? 'medium' : 'high',
+    layers: checks,
+    missingLayers,
+    scopeReport,
+    recommendations: checks
+      .filter((check) => !check.ok)
+      .map((check) => check.recommendation),
+  };
+}
+
 function selectRecordsForScope(records = [], requestedScope = {}, options = {}) {
   const requested = normalizeScope(requestedScope);
   const requestedKey = memoryScopeKey(requested);
@@ -265,6 +419,7 @@ function buildMemoriStyleBenchmarkRecords() {
       projectId: 'thumbgate',
       processId: 'agent-a',
       sessionId: 'session-1',
+      metadata: { semanticKey: 'checkout-readiness', contextPackId: 'checkout-pro' },
       content: 'Use the paid sprint checklist before changing checkout code.',
     },
     {
@@ -298,14 +453,18 @@ function buildMemoriStyleBenchmarkRecords() {
       processId: 'agent-a',
       sessionId: 'session-1',
       visibility: 'shared',
+      type: 'fact',
+      factKey: 'checkout.mutation_policy',
       content: 'Shared rule: checkout mutations require audit evidence.',
     },
   ];
 }
 
 module.exports = {
+  MEMORY_OS_LAYERS,
   REQUIRED_SCOPE_FIELDS,
   buildMemoriStyleBenchmarkRecords,
+  buildMemoryOsLayerReport,
   buildMemoryScopeReadinessReport,
   isSharedMemory,
   memoryScopeKey,

package/scripts/meta-agent-loop.js

@@ -282,6 +282,8 @@ function buildPromotedGate(candidate, metrics, runId) {
     occurrences: metrics.hits,
     promotedAt: new Date().toISOString(),
     source: 'meta-agent',
+    // origin distinguishes silent-failure-clustered candidates from feedback-derived ones
+    origin: candidate.origin || 'user-feedback',
     runId,
     score: parseFloat(metrics.score.toFixed(3)),
     hitRate: parseFloat(metrics.hitRate.toFixed(3)),
@@ -371,6 +373,38 @@ async function runMetaAgentLoop({ dryRun = false, verbose = false } = {}) {
     candidates = generateCandidatesHeuristic(failures, blockPatterns);
   }
 
+  // Tag existing-pipeline candidates with their origin so downstream precision
+  // measurement (silentFailureDerivedGates vs user-feedback-derived) is possible.
+  candidates = candidates.map((c) => (c.origin ? c : { ...c, origin: 'user-feedback' }));
+
+  // Step 3b: Silent-failure clustering — DEFAULT-ON as of 2026-05-21
+  // (flipped from opt-in by PR #2289). Opt out via
+  // THUMBGATE_SILENT_FAILURE_CLUSTERING=0 (or NODE_ENV=test). Candidates flow
+  // through the SAME scoring / fp-rate eval below; we do not bypass any
+  // guardrail. The point of this clustering is to cover the case where users
+  // are lazy and never give thumbs-down — keeping it opt-in meant the users
+  // who need it most never got the benefit.
+  let silentFailureStats = null;
+  const { isSilentFailureClusteringEnabled, generateSilentFailureCandidates } = require('./silent-failure-cluster');
+  if (isSilentFailureClusteringEnabled()) {
+    try {
+      const sfResult = generateSilentFailureCandidates({ feedbackLogPath });
+      silentFailureStats = sfResult.stats;
+      if (sfResult.candidates && sfResult.candidates.length > 0) {
+        candidates = candidates.concat(sfResult.candidates);
+      }
+      if (verbose) {
+        process.stdout.write(
+          `[meta-agent] silent-failure-cluster: candidates=${sfResult.candidates.length} `
+          + `failed=${sfResult.stats.failedCalls} clusters=${sfResult.stats.clusters} `
+          + `skipped=${sfResult.stats.skippedReason || 'none'}\n`
+        );
+      }
+    } catch (err) {
+      if (verbose) process.stdout.write(`[meta-agent] silent-failure-cluster failed (non-fatal): ${err.message}\n`);
+    }
+  }
+
   if (verbose) {
     process.stdout.write(`[meta-agent] candidates generated: ${candidates.length} (mode=${analysisMode})\n`);
   }
@@ -507,6 +541,8 @@ async function runMetaAgentLoop({ dryRun = false, verbose = false } = {}) {
         skipped: evolutionResult.skipped || false,
       }
       : null,
+    silentFailureCluster: silentFailureStats,
+    silentFailureDerivedGates: promotedGates.filter((g) => g.origin === 'silent-failure-cluster').length,
   };
 
   if (!dryRun) {

package/scripts/operational-integrity.js

@@ -580,17 +580,51 @@ function resolveGitHubRepository(env = process.env) {
 function findOpenPrForBranch({ branchName, runner = runGh, env = process.env } = {}) {
   const normalizedBranch = String(branchName || '').trim();
   if (!normalizedBranch) return null;
-  if (!env.GH_TOKEN && !env.GITHUB_TOKEN) {
+  const token = env.GH_TOKEN || env.GITHUB_TOKEN;
+  if (!token) {
     return null;
   }
-  const args = ['pr', 'list'];
   const repository = resolveGitHubRepository(env);
-  if (repository) {
-    args.push('--repo', repository);
+  if (!repository) return null;
+
+  // Try REST API first as it is much more robust and doesn't rely on gh CLI's GraphQL auth
+  try {
+    const owner = repository.split('/')[0];
+    const url = `https://api.github.com/repos/${repository}/pulls?head=${encodeURIComponent(owner + ':' + normalizedBranch)}&state=open`;
+    const curlConfig = `header = "Authorization: token ${token}"\nheader = "User-Agent: ThumbGate-CI"`;
+    const curlResult = spawnSync('curl', [
+      '-s',
+      '-K', '-',
+      url
+    ], {
+      encoding: 'utf8',
+      input: curlConfig
+    });
+
+    if (curlResult && curlResult.status === 0) {
+      const prs = JSON.parse(curlResult.stdout || '[]');
+      if (Array.isArray(prs) && prs.length > 0) {
+        return {
+          number: prs[0].number,
+          state: prs[0].state,
+          isDraft: prs[0].draft || false,
+          url: prs[0].html_url
+        };
+      }
+    }
+  } catch (err) {
+    console.warn(`[findOpenPrForBranch] REST fallback failed: ${err.message}`);
   }
-  args.push('--head', normalizedBranch, '--state', 'open', '--json', 'number,state,isDraft,url');
+
+  // Fall back to gh CLI
+  const args = ['pr', 'list', '--repo', repository, '--head', normalizedBranch, '--state', 'open', '--json', 'number,state,isDraft,url'];
   const result = runner(args);
   if (!result || result.status !== 0) {
+    if (result) {
+      console.warn(`[findOpenPrForBranch] gh command failed with status ${result.status}. Stderr: ${result.stderr || ''}`);
+    } else {
+      console.warn(`[findOpenPrForBranch] gh command failed to spawn.`);
+    }
     return null;
   }
   try {

package/scripts/oss-pr-opportunity-scout.js

@@ -8,6 +8,7 @@ const DEFAULT_PACKAGE_PATH = path.join(__dirname, '..', 'package.json');
 const DEFAULT_OUTPUT_DIR = path.join(__dirname, '..', 'docs', 'marketing');
 const KNOWN_REPOS = Object.freeze({
   '@anthropic-ai/sdk': 'anthropics/anthropic-sdk-typescript',
+  '@modelcontextprotocol/sdk': 'modelcontextprotocol/typescript-sdk',
   '@google/genai': 'googleapis/js-genai',
   '@huggingface/transformers': 'huggingface/transformers.js',
   '@lancedb/lancedb': 'lancedb/lancedb',
@@ -23,6 +24,24 @@ const KNOWN_REPOS = Object.freeze({
   undici: 'nodejs/undici',
 });
 
+// Communities where ThumbGate's buyers live even though they are not npm
+// dependencies. ThumbGate ships an MCP server, so the Model Context Protocol
+// repos are the single highest-ROI ecosystem to contribute to — but the
+// dependency-scan above would never surface them. These are always scouted on
+// the default (no explicit --dependencies) path, de-duped against package.json.
+const STRATEGIC_DEPENDENCIES = Object.freeze([
+  '@modelcontextprotocol/sdk', // MCP TypeScript SDK — the protocol ThumbGate implements
+  'modelcontextprotocol/servers', // MCP servers ecosystem — where MCP authors (our buyers) collaborate
+]);
+
+// Honest, repo-accurate framing for the outreach draft. ThumbGate does not
+// `import` these — it implements the protocol — so the generic "while using X"
+// line would be a false claim. Keep drafts truthful (CEO honesty rule).
+const RELATIONSHIP_OVERRIDES = Object.freeze({
+  '@modelcontextprotocol/sdk': 'building ThumbGate as an MCP server against the Model Context Protocol spec',
+  'modelcontextprotocol/servers': 'building and testing ThumbGate as an MCP server alongside the reference MCP servers',
+});
+
 const BOUNTY_KEYWORDS = [
   'bug bounty',
   'bounty',
@@ -70,7 +89,10 @@ function dependencyNames(pkg = {}) {
 }
 
 function repoFromDependency(name) {
-  return KNOWN_REPOS[name] || '';
+  if (KNOWN_REPOS[name]) return KNOWN_REPOS[name];
+  // A strategic identifier may itself be an "owner/repo" slug (not an npm name).
+  if (!name.startsWith('@') && /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(name)) return name;
+  return '';
 }
 
 function buildIssueSearchQueries(repo) {
@@ -89,14 +111,18 @@ function scoreOpportunity(depName, repo, options = {}) {
     score += 20;
     reasons.push('known upstream repository');
   }
-  if (/sdk|genai|stripe|playwright|lancedb|transformers|sqlite|undici/i.test(depName)) {
+  if (/sdk|genai|stripe|playwright|lancedb|transformers|sqlite|undici|mcp|modelcontext/i.test(depName)) {
     score += 20;
     reasons.push('high product adjacency for agent tooling');
   }
-  if (/anthropic|google|huggingface|stripe|microsoft|nodejs/i.test(repo)) {
+  if (/anthropic|google|huggingface|stripe|microsoft|nodejs|modelcontextprotocol/i.test(repo)) {
     score += 15;
     reasons.push('large ecosystem visibility');
   }
+  if (/modelcontext|mcp/i.test(depName) || /modelcontextprotocol/i.test(repo)) {
+    score += 12;
+    reasons.push("ThumbGate's own protocol surface — buyers are MCP authors");
+  }
   if (options.includeBounties) {
     score += 10;
     reasons.push('bounty search enabled');
@@ -138,7 +164,7 @@ function buildOpportunity(depName, options = {}) {
       'no bounty, security, or maintainer-policy claim without source link',
     ],
     outreachDraft: repo
-      ? `I found this while using ${depName} in ThumbGate. I reproduced the issue, added a minimal fix with tests, and kept the PR scoped to the maintainer's issue.`
+      ? `I found this while ${RELATIONSHIP_OVERRIDES[depName] || `using ${depName} in ThumbGate`}. I reproduced the issue, added a minimal fix with tests, and kept the PR scoped to the maintainer's issue.`
       : '',
   };
 }
@@ -149,7 +175,9 @@ function buildOssPrOpportunityScoutPlan(rawOptions = {}) {
   const explicitDeps = splitList(rawOptions.dependencies || rawOptions.deps);
   const includeBounties = rawOptions.includeBounties !== false && rawOptions['include-bounties'] !== false;
   const maxRepos = Math.max(1, Number.parseInt(String(rawOptions.maxRepos || rawOptions['max-repos'] || 12), 10) || 12);
-  const deps = explicitDeps.length ? explicitDeps : dependencyNames(pkg);
+  const deps = explicitDeps.length
+    ? explicitDeps
+    : [...new Set([...dependencyNames(pkg), ...STRATEGIC_DEPENDENCIES])];
   const opportunities = deps
     .map((dep) => buildOpportunity(dep, { includeBounties }))
     .filter((opportunity) => opportunity.repo)
@@ -223,6 +251,8 @@ function writeOssPrOpportunityScoutPack(outputDir = DEFAULT_OUTPUT_DIR, options
 
 module.exports = {
   KNOWN_REPOS,
+  STRATEGIC_DEPENDENCIES,
+  RELATIONSHIP_OVERRIDES,
   buildIssueSearchQueries,
   buildOpportunity,
   buildOssPrOpportunityScoutPlan,

package/scripts/plausible-server-events.js

@@ -24,23 +24,25 @@
  */
 
 const https = require('node:https');
+const {
+  resolvePlausibleDataDomain,
+} = require('./plausible-domain-config');
 
-const DEFAULT_PLAUSIBLE_DOMAIN = 'thumbgate-production.up.railway.app';
 const PLAUSIBLE_ENDPOINT = 'https://plausible.io/api/event';
 const REQUEST_TIMEOUT_MS = 2_000;
 
 function isPlausibleDisabled() {
   if (process.env.THUMBGATE_PLAUSIBLE_DISABLE === '1') return true;
   if (process.env.DO_NOT_TRACK === '1') return true;
-  // NODE_ENV-based detection was tried and dropped: `node --test` does not
-  // set NODE_ENV automatically, so the check produced surprising behavior
-  // in test vs. production. Tests must opt out explicitly via the dedicated
-  // THUMBGATE_PLAUSIBLE_DISABLE flag.
+  // Automatically disable Plausible events in local development unless explicitly overridden in tests
+  if (process.env.THUMBGATE_PLAUSIBLE_DISABLE !== '0' && process.env.NODE_ENV !== 'production') {
+    return true;
+  }
   return false;
 }
 
 function getPlausibleDomain() {
-  return process.env.THUMBGATE_PLAUSIBLE_DOMAIN || DEFAULT_PLAUSIBLE_DOMAIN;
+  return resolvePlausibleDataDomain();
 }
 
 /**
@@ -142,6 +144,7 @@ const CHECKOUT_EVENT_NAMES = Object.freeze({
   view: 'Checkout Pro Viewed',
   emailSubmitted: 'Checkout Pro Email Submitted',
   stripeRedirect: 'Checkout Pro Stripe Redirect Started',
+  purchase: 'Checkout Pro Purchase Completed',
 });
 
 function recordCheckoutFunnelEvent(stage, options = {}) {

package/scripts/pro-local-dashboard.js

@@ -16,7 +16,7 @@ const CREATOR_SYNTHETIC_KEY = process.env.THUMBGATE_DEV_KEY || '';
  *   2. Env var: THUMBGATE_DEV_BYPASS=[set via THUMBGATE_DEV_SECRET env var]
  * Requires a specific non-obvious value (not boolean) to prevent accidental activation.
  */
-function isCreatorDev({ env = process.env, homeDir = os.homedir() } = {}) {
+function isCreatorDev({ env = process.env, homeDir = env.HOME || env.USERPROFILE || os.homedir() } = {}) {
   // Layer 1: env var with specific value
   if (CREATOR_BYPASS_VALUE && String(env[CREATOR_BYPASS_ENV] || '') === CREATOR_BYPASS_VALUE) {
     return true;
@@ -37,7 +37,7 @@ function isCreatorDev({ env = process.env, homeDir = os.homedir() } = {}) {
  * with any non-empty bypass value. No env var needed — just the config file.
  * Used by the server to skip auth on localhost during local development.
  */
-function hasDevOverride(homeDir = os.homedir()) {
+function hasDevOverride(homeDir = process.env.HOME || process.env.USERPROFILE || os.homedir()) {
   // Disabled during test runs to avoid interfering with auth assertions
   if (process.env.NODE_TEST_CONTEXT || process.env.THUMBGATE_TESTING) return false;
   try {
@@ -47,11 +47,11 @@ function hasDevOverride(homeDir = os.homedir()) {
   } catch { return false; }
 }
 
-function getLicenseDir(homeDir = os.homedir()) {
+function getLicenseDir(homeDir = process.env.HOME || process.env.USERPROFILE || os.homedir()) {
   return path.join(homeDir, '.thumbgate');
 }
 
-function getLicensePath(homeDir = os.homedir()) {
+function getLicensePath(homeDir = process.env.HOME || process.env.USERPROFILE || os.homedir()) {
   return path.join(getLicenseDir(homeDir), 'license.json');
 }
 

package/scripts/proxy-pointer-rag-guardrails.js

@@ -39,9 +39,23 @@ function normalizeOptions(options = {}) {
     ...splitCsv(options.documents),
     ...splitCsv(options['document-ids']),
   ]);
+  const sourcePointers = unique([
+    ...splitCsv(options['source-pointers']),
+    ...splitCsv(options.pointers),
+    ...splitCsv(options.sources),
+  ]);
   const candidateImages = Number.isFinite(Number(options['candidate-images']))
     ? Number(options['candidate-images'])
     : null;
+  const extractedEntities = Number.isFinite(Number(options['extracted-entities']))
+    ? Number(options['extracted-entities'])
+    : 0;
+  const extractedRelations = Number.isFinite(Number(options['extracted-relations']))
+    ? Number(options['extracted-relations'])
+    : 0;
+  const promotionThreshold = Number.isFinite(Number(options['promotion-threshold']))
+    ? Number(options['promotion-threshold'])
+    : 3;
 
   return {
     ragTool: String(options['rag-tool'] || options.tool || 'proxy-pointer-rag').trim() || 'proxy-pointer-rag',
@@ -49,10 +63,15 @@ function normalizeOptions(options = {}) {
     sectionIds,
     imagePointers,
     documentIds,
+    sourcePointers,
     candidateImages,
+    extractedEntities,
+    extractedRelations,
+    promotionThreshold,
     crossDocumentPolicy: String(options['cross-doc-policy'] || options['cross-document-policy'] || '').trim().toLowerCase(),
     visionFilter: normalizeBoolean(options['vision-filter']),
     visualClaims: normalizeBoolean(options['visual-claims']),
+    pointerFirst: normalizeBoolean(options['pointer-first']) || normalizeBoolean(options['proxy-pointer']),
   };
 }
 
@@ -72,6 +91,14 @@ function gateApplicability(template, options) {
   return false;
 }
 
+function hasExtractionSprawl(options) {
+  const extractedFacts = options.extractedEntities + options.extractedRelations;
+  if (extractedFacts === 0) return false;
+  if (options.pointerFirst) return true;
+  if (options.sourcePointers.length === 0) return true;
+  return extractedFacts > options.sourcePointers.length * Math.max(2, options.promotionThreshold);
+}
+
 function buildSignalSummary(options) {
   const signals = [];
   if (options.treePath || options.sectionIds.length > 0) {
@@ -110,6 +137,19 @@ function buildSignalSummary(options) {
       risk: 'answers that describe image content may need a vision-model sanity check',
     });
   }
+  if (hasExtractionSprawl(options)) {
+    signals.push({
+      id: 'entity_relation_sprawl',
+      label: 'Entity/relation extraction sprawl',
+      values: unique([
+        `${options.extractedEntities} extracted entities`,
+        `${options.extractedRelations} extracted relations`,
+        `${options.sourcePointers.length} source pointers`,
+        `promotion threshold ${options.promotionThreshold}`,
+      ]),
+      risk: 'eager graph extraction can create stale aliases, weak edges, and unauditable memory; keep source pointers first and promote relations only after repeated retrieval value',
+    });
+  }
   return signals;
 }
 
@@ -139,11 +179,12 @@ function buildProxyPointerRagGuardrailsPlan(rawOptions = {}, templatesPath) {
     templates: recommendedTemplates,
     nextActions: [
       'Preserve document hierarchy, section IDs, and image file paths during ingestion.',
+      'Store source pointers before extracting entities or relations; promote a relation only after repeated retrieval value and source verification.',
       'Pass section-tree and image-pointer metadata into the agent before it answers with visuals.',
       'Enable the recommended Document RAG Safety templates as pre-action gates.',
       'Use a vision filter only for high-impact answers that make claims about visual content.',
     ],
-    exampleCommand: 'npx thumbgate proxy-pointer-rag-guardrails --tree-path=.rag/tree.json --image-pointers=paper-1/figures/fig2.png --documents=paper-1 --visual-claims --json',
+    exampleCommand: 'npx thumbgate proxy-pointer-rag-guardrails --tree-path=.rag/tree.json --source-pointers=lesson/fb_123,tool/run_456 --extracted-entities=120 --extracted-relations=80 --pointer-first --json',
   };
 }
 

package/scripts/published-cli.js

@@ -37,14 +37,6 @@ function publishedCliShellCommand(pkgVersion, commandArgs = [], options = {}) {
   const escapedArgs = commandArgs.map(shellQuote).join(' ');
   const fastPath = `[ -x ${shellQuote(runtimeBin)} ] && exec ${shellQuote(runtimeBin)}${escapedArgs ? ` ${escapedArgs}` : ''}`;
   const installPath = `mkdir -p ${shellQuote(prefixDir)} && exec npm ${publishedCliArgs(pkgVersion, commandArgs, { prefixDir }).map(shellQuote).join(' ')}`;
-  if (options.preferInstalled === false) {
-    const packageSpec = `thumbgate@${pkgVersion}`;
-    return [
-      `mkdir -p ${shellQuote(prefixDir)}`,
-      `npm "install" "--prefix" ${shellQuote(prefixDir)} "--no-save" "--omit=dev" ${shellQuote(packageSpec)} >/dev/null 2>&1`,
-      `exec ${shellQuote(runtimeBin)}${escapedArgs ? ` ${escapedArgs}` : ''}`,
-    ].join(' && ');
-  }
   return `${fastPath} || ${installPath}`;
 }