thumbgate 1.27.18 → 1.27.19

package/scripts/rate-limiter.js

@@ -6,42 +6,78 @@ const path = require('path');
 const {
   PRO_MONTHLY_PAYMENT_LINK,
   PRO_PRICE_LABEL,
-  TEAM_PRICE_LABEL,
+  ENTERPRISE_PRICE_LABEL,
 } = require('./commercial-offer');
 
 const USAGE_FILE = path.join(process.env.HOME || '/tmp', '.thumbgate', 'usage-limits.json');
 
 // ──────────────────────────────────────────────────────────
-// Free tier: generous on captures (habit formation) and rules
-// (5 active gates), gated on Pro-only features (recall, search,
-// exports). Dashboard, exports, and unlimited rules drive Pro.
+// Free tier: tight enough to create upgrade pressure after
+// real usage. Captures and rules are capped so heavy users
+// hit the wall within the first week, not the first quarter.
 // ──────────────────────────────────────────────────────────
 const FREE_TIER_LIMITS = {
-  capture_feedback:   { daily: Infinity, lifetime: Infinity, label: 'feedback captures' },
-  prevention_rules:   { daily: Infinity, lifetime: Infinity, label: 'prevention rules generated' },
+  capture_feedback:   { daily: 2,        lifetime: 10,       label: 'feedback captures (2/day, 10 total on free)' },
+  prevention_rules:   { daily: 2,        lifetime: 3,        label: 'prevention rules generated (2/day on free)' },
   recall:             { daily: 0,        lifetime: 0,        label: 'recall queries (Pro only)' },
   search_lessons:     { daily: 0,        lifetime: 0,        label: 'lesson searches (Pro only)' },
   search_thumbgate:   { daily: 0,        lifetime: 0,        label: 'ThumbGate searches (Pro only)' },
   commerce_recall:    { daily: 0,        lifetime: 0,        label: 'commerce recalls (Pro only)' },
   export_dpo:         { daily: 0,        lifetime: 0,        label: 'DPO exports (Pro only)' },
   export_databricks:  { daily: 0,        lifetime: 0,        label: 'Databricks exports (Pro only)' },
-  construct_context_pack: { daily: Infinity, lifetime: Infinity, label: 'context packs' },
+  construct_context_pack: { daily: 3,    lifetime: Infinity,  label: 'context packs (3/day on free)' },
 };
 
-const FREE_TIER_MAX_GATES = 5; // 5 active prevention rules on free; Pro is unlimited
+const FREE_TIER_MAX_GATES = 3; // 3 active prevention rules on free; Pro is unlimited
+const FREE_TIER_DAILY_BLOCKS = 2; // 3 gate blocks/day on free; after limit, deny → warn + upgrade CTA
 
-const UPGRADE_MESSAGE = `Pro: ${PRO_PRICE_LABEL} — unlimited rules, recall, lesson search, dashboard, and exports: ${PRO_MONTHLY_PAYMENT_LINK}\n  Team: ${TEAM_PRICE_LABEL} after workflow qualification.`;
+const UPGRADE_MESSAGE = `Pro: ${PRO_PRICE_LABEL} — unlimited rules, recall, lesson search, dashboard, and exports: ${PRO_MONTHLY_PAYMENT_LINK}\n  Enterprise: ${ENTERPRISE_PRICE_LABEL} after workflow qualification.`;
 
 const PAYWALL_MESSAGES = {
-  prevention_rules: 'Free tier includes 5 active prevention rules. Promote more or unlock unlimited rules with Pro.',
+  capture_feedback: 'Free tier: 2 captures/day (10 total). Your feedback is stored locally — upgrade to capture unlimited.',
+  prevention_rules: 'Free tier includes 3 active prevention rules and 2 rule generations/day. Upgrade to Pro for unlimited rules.',
   recall: 'Recall is a Pro feature. Your past feedback is stored locally — upgrade to search and reuse it.',
   search_lessons: 'Lesson search is a Pro feature. Upgrade to find patterns in your agent\'s mistakes.',
+  construct_context_pack: 'Free tier: 3 context packs/day. Upgrade to Pro for unlimited.',
   default: 'This feature requires Pro. Start Pro — card required; billed today.',
 };
 
+const TRIAL_DAYS = 7;
+
+function getInstallAgeDays() {
+  try {
+    const { INSTALL_ID_PATH } = require('./cli-telemetry');
+    if (!fs.existsSync(INSTALL_ID_PATH)) return null;
+    // Use mtimeMs — birthtimeMs is unreliable on Linux (ext4 doesn't backdate creation time).
+    // The install-id file is written once at install, so mtime == creation time in practice.
+    const stat = fs.statSync(INSTALL_ID_PATH);
+    const created = stat.mtimeMs || stat.birthtimeMs;
+    if (!Number.isFinite(created) || created <= 0) return null;
+    return (Date.now() - created) / (1000 * 60 * 60 * 24);
+  } catch (_) {
+    return null;
+  }
+}
+
+function isInTrialPeriod() {
+  if (process.env.CI || process.env.GITHUB_ACTIONS) return false;
+  if (process.env.THUMBGATE_NO_TRIAL === '1') return false;
+  const age = getInstallAgeDays();
+  if (age === null) return false;
+  if (age < 0.0007) return false; // <1 minute old — just-created install, not a real trial
+  return age < TRIAL_DAYS;
+}
+
+function trialDaysRemaining() {
+  const age = getInstallAgeDays();
+  if (age === null) return 0;
+  return Math.max(0, Math.ceil(TRIAL_DAYS - age));
+}
+
 function isProTier(authContext) {
   if (authContext && authContext.tier === 'pro') return true;
-  if (process.env.THUMBGATE_API_KEY || process.env.THUMBGATE_PRO_MODE === '1' || process.env.THUMBGATE_NO_RATE_LIMIT === '1') return true;
+  if (process.env.THUMBGATE_API_KEY) return true;
+  if (process.env.THUMBGATE_NO_RATE_LIMIT === '1') return true;
   // Creator/dogfooding bypass: when the owner has the dev secret + bypass
   // configured (env or ~/.config/thumbgate/dev.json), treat the install as Pro
   // so marketing nudges and rate limits stop firing on the maintainer's own
@@ -57,6 +93,9 @@ function isProTier(authContext) {
     const { isProLicensed } = require('./license');
     if (isProLicensed()) return true;
   } catch (_) {}
+  // 7-day reverse trial: new installs get full Pro access, then hit a clear
+  // hosted-sync/unlimited-rules pay moment while the product is still fresh.
+  if (isInTrialPeriod()) return true;
   return false;
 }
 
@@ -114,12 +153,18 @@ function checkLimit(action, authContext) {
   const dailyCurrent = usage.counts[action] || 0;
   const lifetimeCurrent = usage.lifetime[action] || 0;
 
+  const isCapture = action === 'capture_feedback';
+  const monthlyLink = isCapture
+    ? 'https://buy.stripe.com/7sYfZhaiE1eSbO99uj3sI0d'
+    : PRO_MONTHLY_PAYMENT_LINK;
+  const upgradeMessage = `Pro: ${PRO_PRICE_LABEL} — unlimited rules, recall, lesson search, dashboard, and exports: ${monthlyLink}\n  Enterprise: ${ENTERPRISE_PRICE_LABEL} after workflow qualification.`;
+
   // Check lifetime limit first (the hard wall)
   if (lifetimeLimit !== Infinity && lifetimeCurrent >= lifetimeLimit) {
     const paywallMsg = PAYWALL_MESSAGES[action] || PAYWALL_MESSAGES.default;
     return {
       allowed: false,
-      message: `${paywallMsg}\n\n${UPGRADE_MESSAGE}`,
+      message: `${paywallMsg}\n\n${upgradeMessage}`,
       used: lifetimeCurrent,
       limit: lifetimeLimit,
       limitType: 'lifetime',
@@ -128,9 +173,10 @@ function checkLimit(action, authContext) {
 
   // Check daily limit
   if (dailyLimit !== Infinity && dailyCurrent >= dailyLimit) {
+    const paywallMsg = PAYWALL_MESSAGES[action] || PAYWALL_MESSAGES.default;
     return {
       allowed: false,
-      message: `Daily limit reached. ${UPGRADE_MESSAGE}`,
+      message: `Daily limit reached. ${paywallMsg}\n\n${upgradeMessage}`,
       used: dailyCurrent,
       limit: dailyLimit,
       limitType: 'daily',
@@ -179,12 +225,17 @@ function getUsage(action, authContext) {
 module.exports = {
   checkLimit,
   getUsage,
+  getInstallAgeDays,
   isProTier,
+  isInTrialPeriod,
+  trialDaysRemaining,
   loadUsage,
   saveUsage,
   todayKey,
   FREE_TIER_LIMITS,
   FREE_TIER_MAX_GATES,
+  FREE_TIER_DAILY_BLOCKS,
+  TRIAL_DAYS,
   UPGRADE_MESSAGE,
   PAYWALL_MESSAGES,
   USAGE_FILE,

package/scripts/secret-scanner.js

@@ -55,6 +55,11 @@ const BASH_SECRET_READ_PREFIXES = [
 ];
 
 const EDIT_LIKE_TOOLS = new Set(['Edit', 'Write', 'MultiEdit']);
+const SAFE_SECRET_STORAGE_DIRS = [
+  '.resume_secrets',
+  '.thumbgate/secrets',
+  '.config/thumbgate',
+];
 
 function redactText(text) {
   if (!text) return '';
@@ -172,6 +177,13 @@ function heuristicScanText(text, source = 'text') {
     pattern.regex.lastIndex = 0;
     let match = pattern.regex.exec(input);
     while (match) {
+      // Safe test key bypass
+      const matchedString = match[0].toLowerCase();
+      if (pattern.id === 'generic_assignment' && (matchedString.includes('sk_test_') || matchedString.includes('test_token'))) {
+        match = pattern.regex.exec(input);
+        continue;
+      }
+      
       findings.push({
         id: pattern.id,
         label: pattern.label,
@@ -295,6 +307,26 @@ function resolvePathToken(token, cwd) {
   return path.join(cwd || process.cwd(), normalized);
 }
 
+function normalizePathForPolicy(filePath) {
+  return path.resolve(String(filePath || '').replace(/^~(?=\/|$)/, os.homedir()));
+}
+
+function isSafeSecretStoragePath(filePath) {
+  if (!filePath) return false;
+  const normalized = normalizePathForPolicy(filePath);
+  const home = normalizePathForPolicy(os.homedir());
+  return SAFE_SECRET_STORAGE_DIRS.some((dir) => {
+    const allowedRoot = path.join(home, dir);
+    return normalized === allowedRoot || normalized.startsWith(`${allowedRoot}${path.sep}`);
+  });
+}
+
+function isSafeSecretStorageWrite(toolName, toolInput = {}, cwd = process.cwd()) {
+  if (!EDIT_LIKE_TOOLS.has(toolName)) return false;
+  const paths = getToolInputPaths(toolInput, cwd);
+  return paths.length > 0 && paths.every((filePath) => isSafeSecretStoragePath(filePath));
+}
+
 function scanBashCommand(command, options = {}) {
   const cwd = options.cwd || process.cwd();
   const findings = [];
@@ -347,6 +379,7 @@ function scanHookInput(input = {}, options = {}) {
   let provider = resolveProvider(options.provider);
   let commandHash = null;
   let fileHashes = [];
+  const safeSecretStorageWrite = isSafeSecretStorageWrite(toolName, toolInput, cwd);
 
   const contentFields = [
     toolInput.content,
@@ -376,11 +409,13 @@ function scanHookInput(input = {}, options = {}) {
     }
   }
 
-  for (const content of contentFields) {
-    const result = scanText(content, { provider, source: 'tool_input' });
-    if (result.detected) {
-      provider = result.provider;
-      findings.push(...result.findings);
+  if (!safeSecretStorageWrite) {
+    for (const content of contentFields) {
+      const result = scanText(content, { provider, source: 'tool_input' });
+      if (result.detected) {
+        provider = result.provider;
+        findings.push(...result.findings);
+      }
     }
   }
 
@@ -402,6 +437,8 @@ function buildSafeSummary(findings, prefix) {
 module.exports = {
   SECRET_PATTERNS,
   SECRET_FILE_PATTERNS,
+  SAFE_SECRET_STORAGE_DIRS,
+  EDIT_LIKE_TOOLS,
   redactText,
   resolveProvider,
   scanText,
@@ -409,6 +446,8 @@ module.exports = {
   scanBashCommand,
   scanHookInput,
   classifySecretPath,
+  isSafeSecretStoragePath,
+  isSafeSecretStorageWrite,
   buildSafeSummary,
   tokenizeCommand,
 };