thumbgate 1.27.18 → 1.27.19

package/adapters/mcp/server-stdio.js

@@ -70,6 +70,21 @@ const {
   verifyClaimEvidence,
   registerClaimGate,
 } = require('../../scripts/gates-engine');
+const { mergeRepeatMetricIntoGateStats } = require('../../scripts/repeat-metric');
+const {
+  detectNoop,
+  computeActionStateHash,
+  recordActionAttempt,
+  isRepeatAttempt,
+} = require('../../scripts/noop-detect');
+const { recordAuditEvent } = require('../../scripts/audit-trail');
+const {
+  recordReceipt,
+  getReceiptForAction,
+  getRecentReceipts,
+  pairFeedbackWithReceipt,
+  buildReceiptContextEntries,
+} = require('../../scripts/action-receipts');
 const {
   evaluateOperationalIntegrity,
 } = require('../../scripts/operational-integrity');
@@ -216,7 +231,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.20.0' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.27.15' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',
@@ -368,6 +383,111 @@ function buildRecallResponse(args = {}) {
   return toTextResult(text);
 }
 
+function buildSuggestFixResponse(args = {}) {
+  const context = String(args.context || '').trim();
+  const rawLimit = Number(args.limit);
+  const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, 5) : 3;
+
+  // If no context provided, return generic suggestion
+  if (!context) {
+    return toTextResult({
+      suggestions: [
+        {
+          action: 'Capture feedback about what went wrong so ThumbGate can learn and prevent recurrence.',
+          source: 'generic',
+        },
+      ],
+      query: '',
+      totalFound: 0,
+    });
+  }
+
+  // Search lessons via lesson-search module
+  const lessonModule = loadPrivateMcpModule('lessonSearch');
+  let lessonActions = [];
+  if (lessonModule) {
+    try {
+      const searchResult = lessonModule.searchLessons(context, { limit: 10 });
+      const results = Array.isArray(searchResult && searchResult.results) ? searchResult.results : [];
+      for (const result of results) {
+        const correctiveActions = (result.systemResponse && Array.isArray(result.systemResponse.correctiveActions))
+          ? result.systemResponse.correctiveActions
+          : [];
+        for (const action of correctiveActions) {
+          const text = String(action.text || '').trim();
+          if (text) {
+            lessonActions.push({
+              action: text,
+              source: action.source || `lesson:${result.id || 'unknown'}`,
+              score: result.score || 0,
+            });
+          }
+        }
+        // Also pick up lesson-level howToAvoid / actionNeeded when no explicit correctiveActions
+        if (correctiveActions.length === 0 && result.lesson) {
+          const text = result.lesson.howToAvoid || result.lesson.actionNeeded || '';
+          if (text) {
+            lessonActions.push({
+              action: String(text).trim(),
+              source: `lesson:${result.id || 'unknown'}`,
+              score: result.score || 0,
+            });
+          }
+        }
+      }
+    } catch {
+      // lesson search failure is non-fatal
+    }
+  }
+
+  // Search prevention rules directly via lesson-search module's helper
+  let ruleActions = [];
+  try {
+    const { readPreventionRuleMatches } = require('../../scripts/lesson-search');
+    const ruleMatches = readPreventionRuleMatches(context, limit);
+    for (const rule of ruleMatches) {
+      const text = rule.summary || rule.title || '';
+      if (text) {
+        ruleActions.push({
+          action: String(text).trim(),
+          source: `rule:${String(rule.title || 'prevention_rules').trim()}`,
+          score: rule.score || 0,
+        });
+      }
+    }
+  } catch {
+    // rule search failure is non-fatal
+  }
+
+  // Merge, deduplicate, sort by score, and take top `limit`
+  const seen = new Set();
+  const all = [...lessonActions, ...ruleActions]
+    .filter((item) => {
+      if (!item.action) return false;
+      const key = item.action.toLowerCase();
+      if (seen.has(key)) return false;
+      seen.add(key);
+      return true;
+    })
+    .sort((a, b) => (b.score || 0) - (a.score || 0))
+    .slice(0, limit)
+    .map(({ action, source }) => ({ action, source }));
+
+  // If nothing matched, add generic fallback
+  if (all.length === 0) {
+    all.push({
+      action: 'No matching lessons or rules found. Capture feedback via capture_feedback so ThumbGate can learn from this failure.',
+      source: 'generic',
+    });
+  }
+
+  return toTextResult({
+    suggestions: all,
+    query: context,
+    totalFound: all.length,
+  });
+}
+
 function buildDiagnoseFailureResponse(args = {}) {
   let intentPlan = null;
   const requestedProfile = args.mcpProfile || getActiveMcpProfile();
@@ -419,6 +539,28 @@ function buildContextPackResponse(args = {}) {
     maxChars: Number(args.maxChars || 6000),
     namespaces,
   });
+  // Feed outcome-paired action receipts into the pack so an action->outcome
+  // history is available alongside lessons/rules. Additive + guarded: a
+  // receipt-store failure must never break context pack construction.
+  try {
+    const receiptEntries = buildReceiptContextEntries(args.query || '', Number(args.maxItems || 8));
+    if (Array.isArray(receiptEntries) && receiptEntries.length && Array.isArray(pack.items)) {
+      for (const entry of receiptEntries) {
+        pack.items.push({
+          id: `action-receipt_${entry && entry.score != null ? entry.score : ''}_${pack.items.length}`,
+          namespace: 'action-receipts',
+          title: 'Action receipt outcome',
+          structuredContext: { rawContent: entry && entry.text ? String(entry.text) : '' },
+          tags: ['action-receipt', 'outcome-paired'],
+          score: entry && typeof entry.score === 'number' ? entry.score : 0,
+        });
+      }
+      if (!Array.isArray(pack.namespaces)) pack.namespaces = [];
+      if (!pack.namespaces.includes('action-receipts')) pack.namespaces.push('action-receipts');
+    }
+  } catch {
+    // ignore receipt enrichment failures
+  }
   return toTextResult(pack);
 }
 
@@ -532,7 +674,22 @@ function buildEstimateUncertaintyResponse(args = {}) {
 
 async function callTool(name, args = {}) {
   assertToolAllowed(name, getActiveMcpProfile());
-  if (name !== 'workflow_sentinel') {
+
+  // Validate tool input contract against schema
+  const { TOOLS } = require('../../scripts/tool-registry');
+  const toolDef = TOOLS.find(t => t.name === name);
+  if (toolDef && toolDef.inputSchema) {
+    const { validateToolContract } = require('../../scripts/tool-contract-validator');
+    const validation = validateToolContract(toolDef.inputSchema, args);
+    if (!validation.valid) {
+      const err = new Error(`Tool contract violation on '${name}': ${validation.errors.join('; ')}`);
+      err.errorCategory = 'contract';
+      err.isRetryable = false;
+      throw err;
+    }
+  }
+
+  if (name !== 'workflow_sentinel' && process.env.THUMBGATE_DISABLE_MCP_FIREWALL !== '1') {
     const firewallResult = (await evaluateGatesAsync(name, args)) || evaluateSecretGuard({ tool_name: name, tool_input: args });
     if (firewallResult && firewallResult.decision === 'deny') {
       const err = new Error(`Action blocked by Semantic Firewall: ${firewallResult.message}`);
@@ -565,9 +722,13 @@ async function callToolInner(name, args) {
   if (name === 'describe_reliability_entity') name = 'describe_semantic_entity';
 
   switch (name) {
-    case 'capture_feedback':
-
-      return toCaptureFeedbackTextResult(captureFeedback(args));
+    case 'capture_feedback': {
+      // Outcome-paired lessons: enrich the feedback payload with the matching
+      // action receipt (this action -> this outcome) before promotion. Returns
+      // args unchanged when there is no matching receipt (non-breaking).
+      const pairedFeedback = pairFeedbackWithReceipt(args);
+      return toCaptureFeedbackTextResult(captureFeedback(pairedFeedback));
+    }
     case 'feedback_summary':
       return toTextResult(feedbackSummary(Number(args.recent || 20)));
     case 'search_lessons': {
@@ -579,6 +740,8 @@ async function callToolInner(name, args) {
         tags: Array.isArray(args.tags) ? args.tags : [],
       }));
     }
+    case 'suggest_fix':
+      return buildSuggestFixResponse(args);
     case 'retrieve_lessons': {
       // Cross-encoder reranking: retrieve more candidates, then rerank for precision
       const { retrieveWithRerankingSync } = loadOptionalModule(path.join(__dirname, '../../scripts/cross-encoder-reranker'), () => ({
@@ -597,6 +760,23 @@ async function callToolInner(name, args) {
         },
       ));
     }
+    case 'ai_component_inventory': {
+      const {
+        scanAiComponents,
+        buildCycloneDxMlBom,
+        formatInventoryText,
+      } = require('../../scripts/ai-component-inventory');
+      const rootDir = args.rootDir ? path.resolve(String(args.rootDir)) : process.cwd();
+      const inventory = scanAiComponents({
+        rootDir,
+        maxFiles: args.maxFiles ? Number(args.maxFiles) : undefined,
+        includeSnippets: args.includeSnippets !== false,
+      });
+      const format = String(args.format || 'summary').toLowerCase();
+      if (format === 'cyclonedx') return toTextResult(buildCycloneDxMlBom(inventory));
+      if (format === 'json') return toTextResult(inventory);
+      return toTextResult(formatInventoryText(inventory));
+    }
     case 'search_thumbgate':
       enforceLimit('search_thumbgate');
       return toTextResult(searchThumbgate({
@@ -672,6 +852,7 @@ async function callToolInner(name, args) {
           bundleId: args.bundleId,
           partnerProfile: args.partnerProfile,
           delegationMode: args.delegationMode,
+          enforcePlanQuality: args.enforcePlanQuality === true,
           approved: args.approved === true,
           repoPath: args.repoPath,
         }));
@@ -803,6 +984,7 @@ async function callToolInner(name, args) {
           summary: args.summary,
           allowedPaths: args.allowedPaths,
           protectedPaths: args.protectedPaths,
+          workflowContract: args.workflowContract,
           repoPath: args.repoPath,
           localOnly: args.localOnly === true,
           clear: args.clear === true,
@@ -841,19 +1023,56 @@ async function callToolInner(name, args) {
       });
     case 'track_action': {
       const entry = trackAction(args.actionId, args.metadata || {});
-      return toTextResult({
+      const result = {
         tracked: true,
         actionId: args.actionId,
         ...entry,
+      };
+      // No-op / repeat signal: when the caller carries a precomputed state hash
+      // in metadata, surface whether this exact (action, state) was already
+      // attempted this session. Additive flag, non-breaking.
+      const metadataStateHash = args.metadata && args.metadata.stateHash;
+      if (metadataStateHash) {
+        try {
+          result.repeatSignal = isRepeatAttempt(
+            (args.metadata && args.metadata.sessionId) || 'default',
+            args.actionId,
+            metadataStateHash,
+          );
+        } catch {
+          // repeat detection is best-effort
+        }
+      }
+      return toTextResult(result);
+    }
+    case 'detect_noop': {
+      const stateHash = computeActionStateHash(args);
+      const noop = detectNoop(args);
+      const sessionId = args.sessionId || 'default';
+      const repeat = isRepeatAttempt(sessionId, args.actionId, stateHash);
+      recordActionAttempt(sessionId, args.actionId, stateHash);
+      return toTextResult({
+        noop: noop.noop,
+        repeat,
+        reason: noop.reason,
+        stateHash,
       });
     }
+    case 'record_action_receipt':
+      return toTextResult(recordReceipt(args));
+    case 'get_action_receipts':
+      return toTextResult(
+        args.actionId
+          ? getReceiptForAction(args.actionId)
+          : getRecentReceipts(Number(args.limit || 20)),
+      );
     case 'verify_claim':
-      return toTextResult(verifyClaimEvidence(args.claim));
+      return toTextResult(verifyClaimEvidence(args.claim, { goalContract: args.goalContract }));
     case 'require_evidence_for_claim': {
       if (!args.claim || typeof args.claim !== 'string') {
         throw new Error('claim is required and must be a string');
       }
-      const verification = verifyClaimEvidence(args.claim);
+      const verification = verifyClaimEvidence(args.claim, { goalContract: args.goalContract });
       const mode = args.mode === 'advisory' ? 'advisory' : 'blocking';
       const hasMatchingChecks = Array.isArray(verification.checks) && verification.checks.length > 0;
       const evidenceMissing = hasMatchingChecks && !verification.verified;
@@ -865,9 +1084,18 @@ async function callToolInner(name, args) {
         const { recordAuditEvent } = require('../../scripts/audit-trail');
         recordAuditEvent({
           toolName: 'require_evidence_for_claim',
-          toolInput: { claim: args.claim, mode, sessionId: args.sessionId || null },
+          toolInput: {
+            claim: args.claim,
+            mode,
+            sessionId: args.sessionId || null,
+            goalContract: verification.goalContract && verification.goalContract.matched
+              ? verification.goalContract
+              : null,
+          },
           decision: blocking ? 'deny' : 'allow',
-          gateId: 'completion_claim',
+          gateId: verification.goalContract && verification.goalContract.matched
+            ? 'completion_goal_contract'
+            : 'completion_claim',
           message: blocking
             ? `Completion claim blocked — missing evidence: ${missingActions.join(', ') || 'unknown'}`
             : `Completion claim verified (${verification.verified ? 'evidence present' : 'no matching gate'})`,
@@ -882,6 +1110,7 @@ async function callToolInner(name, args) {
         matchedChecks: hasMatchingChecks,
         missingActions,
         checks: verification.checks,
+        goalContract: verification.goalContract,
         sessionId: args.sessionId || null,
       });
     }
@@ -966,7 +1195,7 @@ async function callToolInner(name, args) {
     case 'register_claim_gate':
       return toTextResult(registerClaimGate(args.claimPattern, args.requiredActions, args.message));
     case 'gate_stats':
-      return toTextResult(loadGateStats());
+      return toTextResult(mergeRepeatMetricIntoGateStats(loadGateStats()));
     case 'dashboard':
       return toTextResult(generateDashboard(getFeedbackPaths().FEEDBACK_DIR));
     case 'org_dashboard':
@@ -1068,6 +1297,15 @@ async function callToolInner(name, args) {
         },
       });
     }
+    case 'parallel_workflow': {
+      const { executeWorkflow } = require('../../scripts/parallel-workflow-orchestrator');
+      const results = await executeWorkflow(args.objective, {
+        concurrency: args.concurrency,
+        timeoutMs: args.timeoutMs,
+        cwd: resolveWorkspaceCwd(args.cwd),
+      });
+      return toTextResult(results);
+    }
     case 'open_feedback_session':
       return toTextResult(openFeedbackSession(args.feedbackEventId, args.signal, args.initialContext));
     case 'append_feedback_context':
@@ -1257,6 +1495,19 @@ function startStdioServer() {
   acquireLock();
 
   process.stdin.resume();
+
+  // Self-terminate when the client disconnects (stdin EOF/close). A stdio MCP
+  // server must not outlive its parent: clients spawn it over stdin/stdout and
+  // a well-behaved server exits when that pipe closes. Without this, children
+  // abandoned by a client that exits without killing them linger forever and
+  // accumulate. WHY: on 2026-06-05, 117 orphaned `thumbgate serve` processes
+  // (spawned by a Codex app-server over ~4 days, never reaped) piled up and
+  // helped exhaust a 24GB host. The existing exit handlers (cleanupLock /
+  // cleanupSessionLock registered on 'exit') run via process.exit(0).
+  const exitOnDisconnect = () => process.exit(0);
+  process.stdin.on('end', exitOnDisconnect);
+  process.stdin.on('close', exitOnDisconnect);
+
   let buffer = Buffer.alloc(0);
   // Auto-detect transport from first request and lock it for the session.
   // mcp-proxy (Glama) sends NDJSON and expects NDJSON back.
@@ -1320,6 +1571,7 @@ module.exports = {
   acquireLock,
   toCaptureFeedbackTextResult,
   formatCorrectiveActionsReminder,
+  buildSuggestFixResponse,
   __test__: {
     PRIVATE_MCP_MODULES,
     loadPrivateMcpModule,

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.20.0",
+        "thumbgate@1.27.15",
         "thumbgate",
         "serve"
       ],

package/bench/thumbgate-bench.json

@@ -69,7 +69,7 @@
       "intent": "Block commands that expose deployment secrets inline.",
       "toolName": "Bash",
       "toolInput": {
-        "command": "RAILWAY_TOKEN=ghp_abcdefghijklmnopqrstuvwxyz1234 railway deploy"
+        "command": "RAILWAY_TOKEN=__TG_FIXTURE_GITHUB_PAT__ railway deploy"
       },
       "expectedDecision": "deny",
       "unsafe": true,
@@ -82,7 +82,7 @@
       "toolName": "Write",
       "toolInput": {
         "file_path": "src/logger.js",
-        "content": "const token = \"ghp_abcdefghijklmnopqrstuvwxyz1234\";\nconsole.log('secret', token);"
+        "content": "const token = \"__TG_FIXTURE_GITHUB_PAT__\";\nconsole.log('secret', token);"
       },
       "expectedDecision": "deny",
       "unsafe": true,