thumbgate 1.27.18 → 1.27.19

package/scripts/thumbgate-bench.js

@@ -4,6 +4,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { expandFixturePlaceholders } = require('./secret-fixture-tokens');
 
 const ROOT = path.join(__dirname, '..');
 const DEFAULT_SUITE_PATH = path.join(ROOT, 'bench', 'thumbgate-bench.json');
@@ -180,6 +181,20 @@ function assertObject(value, label) {
   }
 }
 
+function expandScenarioFixturePlaceholders(value) {
+  if (typeof value === 'string') return expandFixturePlaceholders(value);
+  if (Array.isArray(value)) return value.map(expandScenarioFixturePlaceholders);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, nestedValue]) => [
+        key,
+        expandScenarioFixturePlaceholders(nestedValue),
+      ]),
+    );
+  }
+  return value;
+}
+
 function loadScenarioSuite(filePath = DEFAULT_SUITE_PATH) {
   const suite = readJson(filePath);
   assertObject(suite, 'Scenario suite');
@@ -202,7 +217,7 @@ function loadScenarioSuite(filePath = DEFAULT_SUITE_PATH) {
       throw new Error(`Scenario ${id} has invalid expectedDecision`);
     }
     return {
-      ...scenario,
+      ...expandScenarioFixturePlaceholders(scenario),
       id,
       unsafe: Boolean(scenario.unsafe),
       positivePattern: Boolean(scenario.positivePattern),

package/scripts/thumbgate-search.js

@@ -151,8 +151,67 @@ function sortResults(results) {
   });
 }
 
-function getFeedbackResults(query, limit, signal) {
-  const results = searchFeedbackLog(query, Math.max(limit * 3, limit));
+function extractFeedbackId(str) {
+  if (!str) return null;
+  const match = str.match(/fb[_-]\d+[_-][a-z0-9]+/i);
+  return match ? match[0].replace(/-/g, '_').toLowerCase() : null;
+}
+
+function deduplicateResults(results) {
+  const bestByFeedbackId = new Map();
+
+  for (const r of results) {
+    const feedId = extractFeedbackId(r.id || r.title || r.file || '');
+    if (feedId) {
+      const existing = bestByFeedbackId.get(feedId);
+      if (!existing) {
+        bestByFeedbackId.set(feedId, r);
+      } else {
+        const sourceOrder = { feedback: 4, contextfs: 3, prevention_rule: 2, document: 1 };
+        const existingOrder = sourceOrder[existing.source] || 0;
+        const currentOrder = sourceOrder[r.source] || 0;
+        if (currentOrder > existingOrder) {
+          bestByFeedbackId.set(feedId, r);
+        } else if (currentOrder === existingOrder && (r.score || 0) > (existing.score || 0)) {
+          bestByFeedbackId.set(feedId, r);
+        }
+      }
+    }
+  }
+
+  const finalResults = [];
+  const seenContent = new Set();
+  const seenIds = new Set();
+
+  for (const r of results) {
+    const feedId = extractFeedbackId(r.id || r.title || r.file || '');
+    let recordToUse = r;
+    if (feedId) {
+      recordToUse = bestByFeedbackId.get(feedId);
+      if (seenIds.has(recordToUse.id)) continue;
+    } else {
+      if (r.id && r.id !== 'null' && String(r.id).trim() !== '') {
+        if (seenIds.has(r.id)) continue;
+      }
+    }
+
+    const normTitle = String(recordToUse.title || '').trim().toLowerCase();
+    const normContext = String(recordToUse.context || '').trim().toLowerCase();
+    const contentKey = `${normTitle}|${normContext}`;
+    if (seenContent.has(contentKey)) continue;
+
+    if (recordToUse.id && recordToUse.id !== 'null' && String(recordToUse.id).trim() !== '') {
+      seenIds.add(recordToUse.id);
+    }
+    seenContent.add(contentKey);
+    finalResults.push(recordToUse);
+  }
+
+  return finalResults;
+}
+
+function getFeedbackResults(query, limit, signal, feedbackDir) {
+  const results = searchFeedbackLog(query, Math.max(limit * 3, limit), { feedbackDir });
   const normalizedSignal = normalizeSignal(signal);
   const filtered = normalizedSignal
     ? results.filter((record) => normalizeRecordSignal(record.signal) === normalizedSignal)
@@ -160,19 +219,19 @@ function getFeedbackResults(query, limit, signal) {
   return filtered.slice(0, limit).map(mapFeedbackResult);
 }
 
-function getContextResults(query, limit) {
-  return searchContextFs(query, limit).map(mapContextResult);
+function getContextResults(query, limit, feedbackDir) {
+  return searchContextFs(query, limit, { feedbackDir }).map(mapContextResult);
 }
 
-function getRuleResults(query, limit) {
-  return searchPreventionRulesSync(query, limit).map(mapRuleResult);
+function getRuleResults(query, limit, feedbackDir) {
+  return searchPreventionRulesSync(query, limit, { feedbackDir }).map(mapRuleResult);
 }
 
-function getDocumentResults(query, limit) {
-  return searchImportedDocuments({ query, limit }).map(mapDocumentResult);
+function getDocumentResults(query, limit, feedbackDir) {
+  return searchImportedDocuments({ query, limit, feedbackDir }).map(mapDocumentResult);
 }
 
-function searchThumbgate({ query, source = 'all', limit = 10, signal = null } = {}) {
+function searchThumbgate({ query, source = 'all', limit = 10, signal = null, feedbackDir = null } = {}) {
   const trimmedQuery = String(query || '').trim();
   if (!trimmedQuery) {
     throw new Error('query is required');
@@ -182,22 +241,29 @@ function searchThumbgate({ query, source = 'all', limit = 10, signal = null } =
   const normalizedSignal = normalizeSignal(signal);
   const normalizedLimit = normalizeLimit(limit);
 
+  const fetchLimit = Math.max(100, normalizedLimit * 5);
+
   let results = [];
   if (normalizedSource === 'feedback') {
-    results = getFeedbackResults(trimmedQuery, normalizedLimit, normalizedSignal);
+    const raw = getFeedbackResults(trimmedQuery, fetchLimit, normalizedSignal, feedbackDir);
+    results = deduplicateResults(raw).slice(0, normalizedLimit);
   } else if (normalizedSource === 'context') {
-    results = getContextResults(trimmedQuery, normalizedLimit);
+    const raw = getContextResults(trimmedQuery, fetchLimit, feedbackDir);
+    results = deduplicateResults(raw).slice(0, normalizedLimit);
   } else if (normalizedSource === 'rules') {
-    results = getRuleResults(trimmedQuery, normalizedLimit);
+    const raw = getRuleResults(trimmedQuery, fetchLimit, feedbackDir);
+    results = deduplicateResults(raw).slice(0, normalizedLimit);
   } else if (normalizedSource === 'documents') {
-    results = getDocumentResults(trimmedQuery, normalizedLimit);
+    const raw = getDocumentResults(trimmedQuery, fetchLimit, feedbackDir);
+    results = deduplicateResults(raw).slice(0, normalizedLimit);
   } else {
-    results = sortResults([
-      ...getFeedbackResults(trimmedQuery, normalizedLimit, normalizedSignal),
-      ...getContextResults(trimmedQuery, normalizedLimit),
-      ...getRuleResults(trimmedQuery, normalizedLimit),
-      ...getDocumentResults(trimmedQuery, normalizedLimit),
-    ]).slice(0, normalizedLimit);
+    const combined = [
+      ...getFeedbackResults(trimmedQuery, fetchLimit, normalizedSignal, feedbackDir),
+      ...getContextResults(trimmedQuery, fetchLimit, feedbackDir),
+      ...getRuleResults(trimmedQuery, fetchLimit, feedbackDir),
+      ...getDocumentResults(trimmedQuery, fetchLimit, feedbackDir),
+    ];
+    results = deduplicateResults(sortResults(combined)).slice(0, normalizedLimit);
   }
 
   return {

package/scripts/tool-registry.js

@@ -1,10 +1,23 @@
 #!/usr/bin/env node
 'use strict';
 
+// Human-readable display title from a snake_case tool name.
+// e.g. "capture_feedback" -> "Capture Feedback". The Claude Connectors Directory
+// requires every tool to carry BOTH a title and a readOnlyHint/destructiveHint.
+function humanizeTitle(name) {
+  return String(name || '')
+    .split(/[_-]+/)
+    .filter(Boolean)
+    .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+    .join(' ');
+}
+
 function readOnlyTool(tool) {
   return {
     ...tool,
+    title: tool.title || humanizeTitle(tool.name),
     annotations: {
+      title: tool.title || humanizeTitle(tool.name),
       readOnlyHint: true,
     },
   };
@@ -13,12 +26,40 @@ function readOnlyTool(tool) {
 function destructiveTool(tool) {
   return {
     ...tool,
+    title: tool.title || humanizeTitle(tool.name),
     annotations: {
+      title: tool.title || humanizeTitle(tool.name),
       destructiveHint: true,
     },
   };
 }
 
+const GOAL_CONTRACT_SCHEMA = {
+  type: 'object',
+  description: 'Optional agent handoff contract. Use this when a worker/orchestrator/reviewer loop needs explicit done criteria before a done/fixed/shipped claim is allowed.',
+  properties: {
+    goal: { type: 'string', description: 'The operator-visible goal this claim is trying to close.' },
+    doneWhen: {
+      type: 'array',
+      items: { type: 'string' },
+      description: 'Human-readable acceptance criteria for the task.',
+    },
+    proveBy: {
+      type: 'array',
+      items: { type: 'string' },
+      description: 'Tracked action ids required before the claim can pass, such as tests_passed, review_completed, ci_green, deploy_verified, or operator_approved.',
+    },
+    mustNotChange: {
+      type: 'array',
+      items: { type: 'string' },
+      description: 'Protected areas or constraints the agents must preserve while completing the goal.',
+    },
+    workerAgent: { type: 'string', description: 'Agent responsible for implementation.' },
+    reviewerAgent: { type: 'string', description: 'Agent responsible for independent verification.' },
+    orchestratorAgent: { type: 'string', description: 'Agent responsible for routing and deciding whether done can be claimed.' },
+  },
+};
+
 const TOOLS = [
   readOnlyTool({
     name: 'capture_feedback',
@@ -120,6 +161,19 @@ const TOOLS = [
       required: ['toolName'],
     },
   }),
+  readOnlyTool({
+    name: 'ai_component_inventory',
+    description: 'Scan a project for AI/ML provider SDKs, agent frameworks, vector databases, Vertex/Gemini/Dialogflow CX usage, and model artifacts. Returns evidence suitable for enterprise AI inventory and ML-BOM review.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        rootDir: { type: 'string', description: 'Project root to scan. Defaults to the current process working directory.' },
+        format: { type: 'string', enum: ['summary', 'json', 'cyclonedx'], description: 'Response format. summary is compact text; json returns ThumbGate inventory; cyclonedx returns ML-BOM JSON.' },
+        maxFiles: { type: 'number', description: 'Maximum files to scan (default 2500).' },
+        includeSnippets: { type: 'boolean', description: 'Include matched source snippets in evidence. Defaults true.' },
+      },
+    },
+  }),
   readOnlyTool({
     name: 'search_thumbgate',
     description: 'Search raw ThumbGate state across feedback logs, ContextFS memory, prevention rules, and imported policy documents.',
@@ -371,6 +425,24 @@ const TOOLS = [
       },
     },
   }),
+  readOnlyTool({
+    name: 'suggest_fix',
+    description: 'Suggest corrective actions for a described failure by searching the lesson DB and prevention rules. Returns up to 3 ranked suggestions with their source. Call this when something goes wrong and you need guidance on what to do next.',
+    inputSchema: {
+      type: 'object',
+      required: ['context'],
+      properties: {
+        context: {
+          type: 'string',
+          description: 'Description of what went wrong or what the agent is trying to fix.',
+        },
+        limit: {
+          type: 'number',
+          description: 'Maximum number of suggestions to return (default 3, max 5).',
+        },
+      },
+    },
+  }),
   readOnlyTool({
     name: 'infer_lesson_from_history',
     description: 'Perform autonomous inference on chat history to identify why a failure occurred and what rule should be recorded.',
@@ -417,6 +489,7 @@ const TOOLS = [
         bundleId: { type: 'string' },
         partnerProfile: { type: 'string' },
         delegationMode: { type: 'string', enum: ['off', 'auto', 'sequential'] },
+        enforcePlanQuality: { type: 'boolean' },
         approved: { type: 'boolean' },
         repoPath: { type: 'string' },
       },
@@ -758,6 +831,17 @@ const TOOLS = [
           items: { type: 'string' },
           description: 'Optional protected-file globs that require explicit approval before editing or publishing',
         },
+        workflowContract: {
+          type: 'object',
+          description: 'Optional deterministic workflow run contract. Supports workflowId, allowedBranches, blockedActions, requiredEvidence, and completionGate.',
+          properties: {
+            workflowId: { type: 'string' },
+            allowedBranches: { type: 'array', items: { type: 'string' } },
+            blockedActions: { type: 'array', items: { type: 'string' } },
+            requiredEvidence: { type: 'array', items: { type: 'string' } },
+            completionGate: { type: 'string' },
+          },
+        },
         repoPath: { type: 'string', description: 'Optional repo root used when evaluating git diff scope' },
         localOnly: { type: 'boolean', description: 'When true, also marks the task as local-only' },
         clear: { type: 'boolean', description: 'Clear the current task scope instead of setting one' },
@@ -835,6 +919,56 @@ const TOOLS = [
       },
     },
   }),
+  destructiveTool({
+    name: 'detect_noop',
+    title: 'Detect No-op Action',
+    description: 'Detect whether a tool call was a no-op (state unchanged) or identical to a prior attempt in the session — a cheap repeat-loop signal. Records the action attempt state for repeat detection.',
+    inputSchema: {
+      type: 'object',
+      required: ['actionId'],
+      properties: {
+        actionId: { type: 'string', description: 'Stable identifier for the action being checked (e.g. the file path or command being attempted)' },
+        kind: { type: 'string', enum: ['file', 'command'], description: 'Action kind: file edit/write or command execution' },
+        filePath: { type: 'string', description: 'Path of the file the action targets (file kind)' },
+        beforeContent: { type: 'string', description: 'File content before the action (file kind)' },
+        afterContent: { type: 'string', description: 'File content after the action (file kind)' },
+        exitCode: { type: 'number', description: 'Command exit code (command kind)' },
+        stdout: { type: 'string', description: 'Command stdout (command kind)' },
+        stderr: { type: 'string', description: 'Command stderr (command kind)' },
+        sessionId: { type: 'string', description: 'Optional session id used to scope repeat-attempt detection' },
+      },
+    },
+  }),
+  destructiveTool({
+    name: 'record_action_receipt',
+    title: 'Record Action Receipt',
+    description: 'Pair a tracked tool call with its outcome (diff, exit code, test result) so a promoted lesson encodes "this action -> this outcome", not just a thumbs signal. Appends to the action-receipts log.',
+    inputSchema: {
+      type: 'object',
+      required: ['actionId'],
+      properties: {
+        actionId: { type: 'string', description: 'Identifier of the tracked action this receipt pairs with' },
+        toolName: { type: 'string', description: 'Name of the tool that was invoked' },
+        toolInput: { type: 'object', description: 'Structured input the tool was called with' },
+        diff: { type: 'string', description: 'Optional unified diff or change summary produced by the action' },
+        exitCode: { type: 'number', description: 'Optional command exit code outcome' },
+        testOutcome: { type: 'string', description: 'Optional test outcome (e.g. passed, failed, 12/12)' },
+        stateHash: { type: 'string', description: 'Optional post-action state hash (from detect_noop)' },
+      },
+    },
+  }),
+  readOnlyTool({
+    name: 'get_action_receipts',
+    title: 'Get Action Receipts',
+    description: 'Read outcome-paired action receipts. Returns the receipt for a specific actionId, or the most recent receipts when no actionId is given.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        actionId: { type: 'string', description: 'Optional action id to fetch the matching receipt for' },
+        limit: { type: 'number', description: 'Max number of recent receipts to return when no actionId is given (default 20)' },
+      },
+    },
+  }),
   readOnlyTool({
     name: 'verify_claim',
     description: 'Check whether a claim has enough tracked evidence before the agent asserts it.',
@@ -843,6 +977,7 @@ const TOOLS = [
       required: ['claim'],
       properties: {
         claim: { type: 'string', description: 'The claim text to verify' },
+        goalContract: GOAL_CONTRACT_SCHEMA,
       },
     },
   }),
@@ -1291,6 +1426,7 @@ const TOOLS = [
         claim: { type: 'string', description: 'The completion claim text to verify (e.g. "Fix shipped", "Tests passing")' },
         mode: { type: 'string', enum: ['blocking', 'advisory'], description: 'blocking (default) returns blocking=true when evidence missing; advisory returns blocking=false' },
         sessionId: { type: 'string', description: 'Optional session id to associate with the gate decision' },
+        goalContract: GOAL_CONTRACT_SCHEMA,
       },
     },
   }),
@@ -1348,8 +1484,40 @@ const TOOLS = [
       },
     },
   }),
+  destructiveTool({
+    name: 'parallel_workflow',
+    description: 'Execute a parallel, multi-step subtask workflow to resolve an objective like a security audit, performance benchmark, or repository inspection.',
+    inputSchema: {
+      type: 'object',
+      required: ['objective'],
+      properties: {
+        objective: { type: 'string', description: 'The objective to plan and execute (e.g. security audit, performance benchmark)' },
+        concurrency: { type: 'number', description: 'Maximum parallel subtasks (default 3)' },
+        timeoutMs: { type: 'number', description: 'Timeout in milliseconds (default 60000)' },
+      },
+    },
+  }),
 ];
 
+// Normalize at export: guarantee EVERY tool carries a human-readable title and a
+// readOnlyHint/destructiveHint annotation (both required by the Connectors
+// Directory; the #1 rejection cause is missing annotations). Tools defined as
+// plain objects (not via readOnlyTool/destructiveTool) are backfilled here:
+// title from the name, and a conservative destructiveHint when no hint is set
+// (so an un-hinted tool is gated rather than silently treated as read-only).
+const NORMALIZED_TOOLS = TOOLS.map((tool) => {
+  const title = tool.title || humanizeTitle(tool.name);
+  const existing = tool.annotations || {};
+  const hasHint = existing.readOnlyHint === true || existing.destructiveHint === true;
+  const annotations = {
+    title,
+    ...existing,
+    ...(hasHint ? {} : { destructiveHint: true }),
+  };
+  return { ...tool, title, annotations };
+});
+
 module.exports = {
-  TOOLS,
+  TOOLS: NORMALIZED_TOOLS,
+  humanizeTitle,
 };

package/scripts/vector-store.js

@@ -172,6 +172,30 @@ async function embedWithGemini(text, options = {}) {
   return values.map(Number);
 }
 
+async function embedWithCoreAI(text, options = {}) {
+  if (process.platform !== 'darwin') {
+    throw new Error('Core AI is only supported on macOS');
+  }
+  const endpoint = process.env.THUMBGATE_COREAI_ENDPOINT || 'http://localhost:8088';
+  try {
+    const res = await fetch(`${endpoint}/embed`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ text, options }),
+      signal: AbortSignal.timeout(2000),
+    });
+    if (res.ok) {
+      const payload = await res.json();
+      if (Array.isArray(payload.embedding)) {
+        return payload.embedding.map(Number);
+      }
+    }
+  } catch (err) {
+    throw new Error(`Core AI local service unavailable: ${err.message}`);
+  }
+  throw new Error('Core AI local service did not return a valid embedding');
+}
+
 async function embed(text, options = {}) {
   if (process.env.THUMBGATE_VECTOR_STUB_EMBED === 'true') {
     // Deterministic 384-dim unit vector: first element = 1.0, rest = 0.0
@@ -180,6 +204,26 @@ async function embed(text, options = {}) {
     return stub;
   }
   const geminiConfig = resolveGeminiEmbeddingConfig();
+  if (geminiConfig.provider === 'coreai') {
+    try {
+      const vector = await embedWithCoreAI(text, options);
+      _lastEmbeddingProfile = {
+        generatedAt: new Date().toISOString(),
+        source: 'local-coreai',
+        activeProfile: {
+          id: 'coreai',
+          model: 'Core AI local model',
+          outputDimensionality: vector.length,
+          task: options.task || 'code retrieval',
+          rationale: 'Local Core AI Apple Silicon accelerated path.',
+        },
+        fallbackUsed: false,
+      };
+      return vector;
+    } catch (coreaiError) {
+      console.warn(`Core AI embedding failed, falling back to local: ${coreaiError.message}`);
+    }
+  }
   if (geminiConfig.enabled) {
     try {
       const vector = await embedWithGemini(text, options);
@@ -312,6 +356,7 @@ function setGeminiEmbedderForTests(loader) {
 module.exports = {
   upsertFeedback,
   searchSimilar,
+  embed,
   TABLE_NAME,
   getEmbeddingConfig,
   getLastEmbeddingProfile,