thumbgate 1.27.18 → 1.27.20

package/scripts/audit.js

@@ -0,0 +1,65 @@
+'use strict';
+
+/**
+ * scripts/audit.js
+ *
+ * Heuristic-based AI bill auditor. Finds repeated mistakes in agent transcripts.
+ */
+
+const fs = require('fs');
+
+const PATTERNS = [
+  {
+    id: 'force-push-retry',
+    name: 'git push --force after correction',
+    regex: /git\s+push.*--force/gi,
+    tokenEstimate: 6000,
+    costPerRepeat: 0.44,
+    why: 'Full diff context reload on error.'
+  },
+  {
+    id: 'import-loop',
+    name: 'Hallucinated import retry',
+    regex: /(Cannot find module|Module not found|import .* from .*error)/gi,
+    tokenEstimate: 4000,
+    costPerRepeat: 0.12,
+    why: 'Re-indexing and path searching.'
+  },
+  {
+    id: 'apology-loop',
+    name: '"I apologize" retry cycle',
+    regex: /(I apologize|Let me try a different approach|I will now attempt)/gi,
+    tokenEstimate: 5000,
+    costPerRepeat: 0.15,
+    why: 'Reasoning chain reset.'
+  }
+];
+
+function runAudit(filePath) {
+  if (!fs.existsSync(filePath)) {
+    return { error: 'File not found: ' + filePath };
+  }
+
+  const content = fs.readFileSync(filePath, 'utf8');
+  const results = [];
+  let totalWaste = 0;
+
+  PATTERNS.forEach(p => {
+    const matches = (content.match(p.regex) || []).length;
+    if (matches > 1) { // It's only a "repeat" if it happens more than once
+      const repeats = matches - 1;
+      const waste = repeats * p.costPerRepeat;
+      totalWaste += waste;
+      results.push({
+        pattern: p.name,
+        occurrences: repeats,
+        waste: waste.toFixed(2),
+        why: p.why
+      });
+    }
+  });
+
+  return { results, totalWaste: totalWaste.toFixed(2) };
+}
+
+module.exports = { runAudit, PATTERNS };

package/scripts/auto-promote-gates.js

@@ -58,6 +58,47 @@ function readJSONL(filePath) {
   }).filter(Boolean);
 }
 
+// --- Self-Harness stage 3: regression-gated promotion -----------------------
+// Inspired by "Self-Harness: Harnesses That Improve Themselves" (arXiv 2606.09498).
+// Stages 1-2 (weakness mining -> rule extraction) already exist via lesson
+// inference + this promoter. Stage 3 — accept a harness change only after
+// regression-testing it does not degrade behavior — was missing: a noisy 3x
+// capture could hard-block an over-broad pattern with no check that it wouldn't
+// have wrongly blocked actions that were previously ALLOWED. This replays a
+// candidate BLOCK rule against the audit trail's prior `allow` decisions; if it
+// would have blocked safe actions, the caller quarantines it to `warn` instead.
+const REGRESSION_FALSE_BLOCK_LIMIT = 0; // any prior safe action it would block => quarantine
+
+function getAuditTrailPath() {
+  return path.join(path.dirname(getFeedbackLogPath()), 'audit-trail.jsonl');
+}
+
+// Returns { falseBlocks, allowSampleSize } or null when there is no history /
+// matcher available — in which case the caller promotes as usual (fail-open to
+// existing behavior, since regression gating is an enhancement, not a hard gate).
+function regressionCheck(gate, options = {}) {
+  const auditPath = options.auditTrailPath || getAuditTrailPath();
+  const entries = readJSONL(auditPath);
+  if (!entries.length) return null;
+  // Lazy-require to avoid the gates-engine <-> auto-promote-gates require cycle.
+  let matchesGate;
+  try { ({ matchesGate } = require('./gates-engine')); } catch { return null; }
+  if (typeof matchesGate !== 'function') return null;
+  const allowed = entries.filter((e) => e && e.decision === 'allow' && e.toolName);
+  if (!allowed.length) return null;
+  let falseBlocks = 0;
+  for (const e of allowed) {
+    try {
+      if (matchesGate(gate, e.toolName, e.toolInput || {})) falseBlocks += 1;
+    } catch { /* a bad pattern/entry never counts as a false block */ }
+  }
+  return { falseBlocks, allowSampleSize: allowed.length };
+}
+
+function safeRegressionCheck(gate, options) {
+  try { return regressionCheck(gate, options); } catch { return null; }
+}
+
 function loadAutoGates() {
   const autoGatesPath = getAutoGatesPath();
   if (!fs.existsSync(autoGatesPath)) {
@@ -193,9 +234,9 @@ function patternToGateId(key) {
   return 'auto-' + key.replace(/[^a-z0-9]+/gi, '-').replace(/^-|-$/g, '').slice(0, 50).toLowerCase();
 }
 
-function buildGateRule(group) {
-  const action = group.count === 'MANUAL' ? group.manualAction || 'block' : (group.count >= BLOCK_THRESHOLD ? 'block' : 'warn');
-  const severity = action === 'block' ? 'critical' : 'medium';
+function buildGateRule(group, actionOverride) {
+  const action = actionOverride || (group.count === 'MANUAL' ? group.manualAction || 'block' : (group.count >= BLOCK_THRESHOLD ? 'block' : 'warn'));
+  const severity = action === 'block' ? 'critical' : action === 'approve' ? 'high' : 'medium';
   const context = group.latestContext.slice(0, 120);
   const kind = group.key.startsWith('diagnosis:')
     ? 'repeated diagnosis'
@@ -332,7 +373,8 @@ function forcePromote(context, action = 'block') {
   return { gateId, action, totalGates: data.gates.length };
 }
 
-function promote(feedbackLogPath) {
+function promote(feedbackLogPath, options) {
+  const opts = options || {};
   const logPath = feedbackLogPath || getFeedbackLogPath();
   const entries = readJSONL(logPath);
   const groups = groupNegativeFeedback(entries, WINDOW_DAYS);
@@ -357,17 +399,38 @@ function promote(feedbackLogPath) {
       const existing = data.gates[existingIdx];
       const newAction = group.count >= BLOCK_THRESHOLD ? 'block' : 'warn';
       if (existing.action !== newAction && newAction === 'block') {
-        // Upgrade from warn to block
-        data.gates[existingIdx] = { ...existing, action: 'block', severity: 'critical', occurrences: group.count, upgradedAt: new Date().toISOString() };
-        promotions.push({ type: 'upgrade', gateId, from: existing.action, to: 'block', occurrences: group.count });
+        // Self-Harness stage 3: regression-test before upgrading warn -> block.
+        const regression = opts.skipRegression ? null : safeRegressionCheck(buildGateRule(group, 'block'), opts);
+        if (regression && regression.falseBlocks > REGRESSION_FALSE_BLOCK_LIMIT) {
+          // Would block prior safe actions — hold at warn instead of upgrading.
+          promotions.push({ type: 'upgrade-quarantined', gateId, from: existing.action, occurrences: group.count, falseBlocks: regression.falseBlocks });
+        } else {
+          // Upgrade from warn to block
+          data.gates[existingIdx] = { ...existing, action: 'block', severity: 'critical', occurrences: group.count, upgradedAt: new Date().toISOString() };
+          promotions.push({ type: 'upgrade', gateId, from: existing.action, to: 'block', occurrences: group.count });
+        }
       }
       // Update occurrence count even if no action change
       data.gates[existingIdx].occurrences = group.count;
       continue;
     }
 
-    // New gate
-    const gate = buildGateRule(group);
+    // New gate — respect explicit gateAction override (e.g. 'approve' for human-approval rules)
+    const gate = buildGateRule(group, opts.gateAction);
+
+    // Self-Harness stage 3: before a feedback rule goes live as a hard block,
+    // regression-test it against prior allowed actions. If it would have blocked
+    // safe actions, quarantine it to `warn` instead of `block`.
+    let regression = null;
+    if (gate.action === 'block' && !opts.gateAction && !opts.skipRegression) {
+      regression = safeRegressionCheck(gate, opts);
+      if (regression && regression.falseBlocks > REGRESSION_FALSE_BLOCK_LIMIT) {
+        gate.action = 'warn';
+        gate.severity = 'medium';
+        gate.quarantined = true;
+        gate.regression = regression;
+      }
+    }
 
     // Enforce max limit — rotate oldest
     if (data.gates.length >= MAX_AUTO_GATES) {
@@ -376,7 +439,13 @@ function promote(feedbackLogPath) {
     }
 
     data.gates.push(gate);
-    promotions.push({ type: 'new', gateId: gate.id, action: gate.action, occurrences: group.count });
+    promotions.push({
+      type: gate.quarantined ? 'new-quarantined' : 'new',
+      gateId: gate.id,
+      action: gate.action,
+      occurrences: group.count,
+      ...(gate.quarantined ? { falseBlocks: regression.falseBlocks, allowSampleSize: regression.allowSampleSize } : {}),
+    });
   }
 
   // Log promotions
@@ -437,6 +506,9 @@ module.exports = {
   groupNegativeFeedback,
   patternToGateId,
   buildGateRule,
+  regressionCheck,
+  getAuditTrailPath,
+  REGRESSION_FALSE_BLOCK_LIMIT,
   extractPatternKey,
   normalizeCommandSignature,
   isNegative,

package/scripts/auto-wire-hooks.js

@@ -27,6 +27,7 @@ const {
   statuslineCommand,
   userPromptHookCommand,
 } = require('./hook-runtime');
+const { installShim } = require('./install-shim');
 
 function getHome() {
   return process.env.HOME || process.env.USERPROFILE || '';
@@ -338,6 +339,19 @@ function wireClaudeHooks(options) {
     options.projectSettingsPath || claudeProjectSettingsPath(options.projectDir);
   const dryRun = options.dryRun || false;
   const projectDir = options.projectDir || process.cwd();
+
+  // --- Install stable shim before resolving hook commands ---
+  // The shim at ~/.thumbgate/bin/thumbgate-hook always resolves @latest,
+  // so hooks never go stale across version bumps (Volta-style pattern).
+  // Skip in source-checkout mode — developers use direct node commands.
+  if (!dryRun && !require('./mcp-config').isSourceCheckout(path.join(__dirname, '..'))) {
+    try {
+      installShim();
+    } catch {
+      // Non-fatal: fall back to version-pinned commands
+    }
+  }
+
   const desiredStatusLine = statuslineCommand();
 
   // --- Step 0: clean up stale hooks from BOTH settings locations ---

package/scripts/aws-blocks-guardrails.js

@@ -0,0 +1,272 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const AWS_BLOCKS_DEPENDENCY_PATTERN = /(^|\/)@aws-blocks\/(?:blocks|[^/\s"']+)/;
+const PRODUCTION_DEPLOY_PATTERNS = [
+  /\bcdk\s+deploy\b/i,
+  /\bnpm\s+run\s+deploy\b/i,
+  /\bpnpm\s+deploy\b/i,
+  /\byarn\s+deploy\b/i,
+  /\bsst\s+deploy\b/i,
+  /\bblocks?\s+deploy\b/i,
+];
+const DESTROY_PATTERNS = [
+  /\bcdk\s+destroy\b/i,
+  /\bnpm\s+run\s+destroy\b/i,
+  /\bpnpm\s+destroy\b/i,
+  /\byarn\s+destroy\b/i,
+  /\bsandbox\b.*--destroy\b/i,
+  /\b--destroy\b/i,
+  /\baws\s+cloudformation\s+delete-stack\b/i,
+];
+const DESTRUCTIVE_AWS_PATTERNS = [
+  /\baws\s+dynamodb\s+delete-table\b/i,
+  /\baws\s+rds\s+delete-db-instance\b/i,
+  /\baws\s+s3\s+rm\b[\s\S]*--recursive\b/i,
+  /\baws\s+lambda\s+delete-function\b/i,
+  /\baws\s+bedrock-agent\s+delete-/i,
+  /\baws\s+bedrock-agent-runtime\b/i,
+];
+
+function toList(value) {
+  if (Array.isArray(value)) return value.map(String).map((entry) => entry.trim()).filter(Boolean);
+  if (typeof value === 'string') return value.split(',').map((entry) => entry.trim()).filter(Boolean);
+  return [];
+}
+
+function normalizeText(value) {
+  if (value == null) return '';
+  if (typeof value === 'string') return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+
+function readPackageJson(projectDir) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(projectDir, 'package.json'), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function matchesAny(text, patterns) {
+  return patterns.some((pattern) => pattern.test(text));
+}
+
+function hasDestructiveSql(text) {
+  if (/\bdrop\s+(table|database|schema|index|column)\b/i.test(text)) return true;
+  if (/\btruncate\s+table\b/i.test(text)) return true;
+  if (/\bdelete\s+from\s+[\w".-]+(?:\s*;|\s*$)/i.test(text)) return true;
+  const updateMatch = /\bupdate\s+[\w".-]+\s+set\b/i.exec(text);
+  if (!updateMatch) return false;
+  const afterUpdate = text.slice(updateMatch.index, updateMatch.index + 180);
+  return !/\bwhere\b/i.test(afterUpdate);
+}
+
+function packageUsesAwsBlocks(pkg) {
+  if (!pkg || typeof pkg !== 'object') return false;
+  const dependencyText = JSON.stringify({
+    dependencies: pkg.dependencies || {},
+    devDependencies: pkg.devDependencies || {},
+    peerDependencies: pkg.peerDependencies || {},
+    optionalDependencies: pkg.optionalDependencies || {},
+  });
+  const scriptsText = JSON.stringify(pkg.scripts || {});
+  return AWS_BLOCKS_DEPENDENCY_PATTERN.test(dependencyText) || /aws-blocks|blocks-app|cdk|sandbox/i.test(scriptsText);
+}
+
+function detectAwsBlocksProject(projectDir = process.cwd()) {
+  const pkg = readPackageJson(projectDir);
+  if (packageUsesAwsBlocks(pkg)) return true;
+  return fs.existsSync(path.join(projectDir, 'aws-blocks', 'index.ts'))
+    || fs.existsSync(path.join(projectDir, 'aws-blocks', 'index.js'))
+    || fs.existsSync(path.join(projectDir, 'blocks.spec.json'));
+}
+
+function detectAction(input = {}) {
+  const command = normalizeText(input.command || input.args || input.shell || input.toolInput);
+  const toolName = normalizeText(input.toolName || input.tool || input.name);
+  const code = normalizeText(input.code || input.file || input.diff || input.body);
+  const combined = `${toolName}\n${command}\n${code}`;
+  const lower = combined.toLowerCase();
+
+  const signals = [];
+  const add = (id, label, severity = 'medium') => signals.push({ id, label, severity });
+
+  if (matchesAny(combined, PRODUCTION_DEPLOY_PATTERNS)) {
+    add('aws-blocks-production-deploy', 'production deploy from an AWS Blocks workflow', 'high');
+  }
+
+  if (matchesAny(combined, DESTROY_PATTERNS)) {
+    add('aws-blocks-destroy', 'destroy command can remove AWS resources created from local Blocks code', 'critical');
+  }
+
+  if (hasDestructiveSql(combined)) {
+    add('destructive-sql-or-ddl', 'destructive or unscoped SQL mutation', 'critical');
+  }
+
+  if (matchesAny(combined, DESTRUCTIVE_AWS_PATTERNS)) {
+    add('destructive-aws-cli', 'destructive AWS CLI or Bedrock agent action', 'critical');
+  }
+
+  if (/\b(gcloud|aws)\b[\s\S]{0,220}\b(add-iam-policy-binding|put-role-policy|attach-role-policy|create-policy-version)\b/i.test(combined)
+      || /\b(AdministratorAccess|roles\/owner|iam:PassRole|serviceAccountTokenCreator)\b/i.test(combined)) {
+    add('iam-escalation', 'agent session attempts to grant broad IAM authority', 'critical');
+  }
+
+  if (/\b(new\s+Agent\s*\(|@aws-blocks\/(?:agent|blocks)|\bAgent\b[\s\S]{0,120}\btools?\b)/.test(combined)) {
+    add('blocks-agent-tool-call', 'AWS Blocks Agent or Bedrock-style tool action needs a tool boundary', 'medium');
+  }
+
+  if (/\b(npm\s+run\s+dev|npm\s+start|pnpm\s+dev|yarn\s+dev|create-blocks-app)\b/i.test(combined)) {
+    add('local-dev', 'local AWS Blocks development loop', 'low');
+  }
+
+  return {
+    command,
+    toolName,
+    code,
+    signals,
+    highRisk: signals.some((signal) => ['high', 'critical'].includes(signal.severity)),
+    localOnly: signals.some((signal) => signal.id === 'local-dev') && signals.every((signal) => signal.severity === 'low'),
+    lower,
+  };
+}
+
+function evaluateAwsBlocksAction(input = {}) {
+  const projectDir = input.projectDir || input.cwd || process.cwd();
+  const projectUsesAwsBlocks = Boolean(
+    input.projectUsesAwsBlocks
+    || input.awsBlocks
+    || input.blocksProject
+    || detectAwsBlocksProject(projectDir)
+  );
+  const evidence = new Set(toList(input.evidence || input.proof || input.receipts));
+  const action = detectAction(input);
+  const requiredEvidence = [];
+
+  const requireEvidence = (id, label) => {
+    if (!evidence.has(id)) requiredEvidence.push({ id, label });
+  };
+
+  if (projectUsesAwsBlocks && action.signals.some((signal) => signal.id === 'aws-blocks-production-deploy')) {
+    requireEvidence('local-tests-pass', 'local AWS Blocks tests pass against local implementations');
+    requireEvidence('cdk-diff-reviewed', 'CDK diff or synthesized CloudFormation change set reviewed');
+    requireEvidence('cost-blast-radius-reviewed', 'AWS cost and resource blast radius reviewed');
+  }
+
+  if (action.signals.some((signal) => signal.id === 'aws-blocks-destroy')) {
+    requireEvidence('resource-inventory-exported', 'resource inventory exported before destroy');
+    requireEvidence('human-destroy-approval', 'named human approval for destroy');
+  }
+
+  if (action.signals.some((signal) => signal.id === 'destructive-sql-or-ddl')) {
+    requireEvidence('backup-or-rollback-ready', 'backup, rollback, or restore point exists');
+    requireEvidence('bounded-row-count-reviewed', 'row/table impact was previewed before mutation');
+  }
+
+  if (action.signals.some((signal) => signal.id === 'destructive-aws-cli')) {
+    requireEvidence('aws-account-and-region-confirmed', 'target AWS account and region confirmed');
+    requireEvidence('rollback-plan-attached', 'rollback or recovery plan attached');
+  }
+
+  if (action.signals.some((signal) => signal.id === 'iam-escalation')) {
+    requireEvidence('least-privilege-review', 'least-privilege review completed');
+    requireEvidence('security-owner-approval', 'security owner approval captured');
+  }
+
+  if (action.signals.some((signal) => signal.id === 'blocks-agent-tool-call')) {
+    requireEvidence('agent-tool-allowlist', 'agent tool allowlist and data boundary declared');
+  }
+
+  const shouldBlock = projectUsesAwsBlocks && requiredEvidence.length > 0;
+  let status = 'allowed';
+  if (shouldBlock) {
+    status = 'blocked';
+  } else if (action.highRisk) {
+    status = 'needs-review';
+  }
+
+  return {
+    name: 'thumbgate-aws-blocks-guardrails',
+    status,
+    projectUsesAwsBlocks,
+    signals: action.signals,
+    requiredEvidence,
+    enforcementBoundary: 'local AWS Blocks confidence must not automatically become production AWS authority',
+    gates: [
+      'allow local AWS Blocks dev loops without AWS credentials',
+      'require local test proof plus CDK diff before production deploy',
+      'block destroy and destructive data mutations until backup, blast-radius, and human approval evidence exists',
+      'block IAM escalation and Bedrock/Agent tool expansion until an owner approves the tool boundary',
+      'write a ThumbGate receipt for every allowed high-risk cloud action',
+    ],
+    nextActions: shouldBlock
+      ? requiredEvidence.map((item) => `Provide ${item.id}: ${item.label}`)
+      : ['Record an allow receipt when this action touches real AWS resources'],
+  };
+}
+
+function buildAwsBlocksHardeningOffer(input = {}) {
+  const workflow = String(input.workflow || input.name || 'AWS Blocks backend').trim();
+  const buyer = String(input.buyer || input.owner || 'platform owner').trim();
+  return {
+    name: 'thumbgate-aws-blocks-hardening-offer',
+    status: 'ready-for-positioning',
+    buyer,
+    workflow,
+    headline: 'AWS Blocks helps agents build the backend. ThumbGate stops them before unsafe cloud actions run.',
+    offer: 'AWS Blocks Agent Safety Review',
+    diagnosticPrice: '$499',
+    proofPlan: [
+      'map one AWS Blocks local-to-cloud workflow',
+      'install ThumbGate against the agent running that workflow',
+      'add gates for deploy, destroy, data mutation, IAM, Bedrock Agent, and cost-blast-radius actions',
+      'produce a receipt showing the first blocked repeat and the evidence required to allow it',
+    ],
+    cta: 'Send one AWS Blocks workflow that is about to deploy, mutate data, or call Bedrock tools.',
+  };
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const args = {};
+  for (const arg of argv) {
+    if (arg === '--json') args.json = true;
+    else if (arg === '--aws-blocks' || arg === '--project-uses-aws-blocks') args.projectUsesAwsBlocks = true;
+    else if (arg.startsWith('--command=')) args.command = arg.slice('--command='.length);
+    else if (arg.startsWith('--tool=')) args.toolName = arg.slice('--tool='.length);
+    else if (arg.startsWith('--code=')) args.code = arg.slice('--code='.length);
+    else if (arg.startsWith('--cwd=')) args.projectDir = arg.slice('--cwd='.length);
+    else if (arg.startsWith('--evidence=')) args.evidence = arg.slice('--evidence='.length);
+    else if (arg.startsWith('--workflow=')) args.workflow = arg.slice('--workflow='.length);
+    else if (arg.startsWith('--buyer=')) args.buyer = arg.slice('--buyer='.length);
+    else if (arg === 'offer') args.commandName = 'offer';
+  }
+  return args;
+}
+
+function runCli(args = parseArgs()) {
+  const report = args.commandName === 'offer'
+    ? buildAwsBlocksHardeningOffer(args)
+    : evaluateAwsBlocksAction(args);
+  if (args.json) console.log(JSON.stringify(report, null, 2));
+  else {
+    console.log(`${report.name}: ${report.status}`);
+    for (const action of report.nextActions || report.proofPlan || []) console.log(`- ${action}`);
+  }
+}
+
+if (require.main?.filename === __filename) runCli();
+
+module.exports = {
+  detectAwsBlocksProject,
+  detectAction,
+  evaluateAwsBlocksAction,
+  buildAwsBlocksHardeningOffer,
+};

package/scripts/billing.js

@@ -51,6 +51,7 @@ const {
 } = require('./analytics-window');
 const { ensureParentDir } = require('./fs-utils');
 const mailer = require('./mailer');
+const { recordCheckoutFunnelEvent } = require('./plausible-server-events');
 
 function loadWorkflowSprintIntakeModule() {
   const modulePath = path.resolve(__dirname, 'workflow-sprint-intake.js');
@@ -138,6 +139,10 @@ const IS_TEST = !!(
   process.env.NODE_ENV === 'test'
 );
 
+function allowUnsignedStripeWebhooks() {
+  return IS_TEST && process.env.THUMBGATE_ALLOW_UNSIGNED_STRIPE_WEBHOOKS === '1';
+}
+
 function shouldMergeLegacyBillingData() {
   return process.env._TEST_INCLUDE_LEGACY_BILLING_DATA === '1'
     || process.env.THUMBGATE_INCLUDE_LEGACY_BILLING_DATA === '1';
@@ -444,6 +449,57 @@ function buildCheckoutProductData({ name, description, appOrigin, planId }) {
   };
 }
 
+/**
+ * Verify an ACTIVE Stripe product exists for the given plan name before
+ * we let buildSubscriptionPriceData create inline price_data under it.
+ *
+ * Stripe matches product_data by `name`. If only an archived product
+ * matches, new prices created via that path inherit active=false and the
+ * generated checkout URL renders "Something went wrong / The page you
+ * were looking for could not be found." for the buyer. Stripe Dashboard
+ * shows the session as `open` with no email captured — looks like the
+ * buyer abandoned, but they were never given a working page.
+ *
+ * Failing here surfaces the misconfiguration at the first checkout
+ * attempt instead of silently breaking every buyer for days.
+ *
+ * Verified incident: ThumbGate#2188 (May 2026) — 20 sessions abandoned in
+ * 7 days, all because the only product named "ThumbGate Pro" matching the
+ * inline product_data was archived (prod_UXxOHAfbDsPyRb), while an active
+ * product with the same name existed (prod_UW82THPxfNvwKT) that should
+ * have been used instead.
+ */
+async function verifyActiveProductForPlan(stripe, planId) {
+  const expectedName = planId === 'team' ? 'ThumbGate Team' : 'ThumbGate Pro';
+  let products;
+  try {
+    products = await stripe.products.list({ limit: 100 });
+  } catch (err) {
+    // Network/transient failures shouldn't block checkout creation.
+    // The original session.create call will surface real Stripe errors.
+    return;
+  }
+  const matching = (products && products.data ? products.data : [])
+    .filter((p) => p && p.name === expectedName);
+  if (matching.length === 0) {
+    // No product with this name exists; Stripe will create a new one when
+    // session.create fires with inline product_data. Safe path.
+    return;
+  }
+  const active = matching.find((p) => p.active === true);
+  if (!active) {
+    const archived = matching[0];
+    throw new Error(
+      `Refusing to create checkout session: Stripe product named "${expectedName}" ` +
+      `exists only in archived state (id=${archived.id}, active=false). New prices ` +
+      `created via inline product_data would inherit active=false, rendering ` +
+      `"page not found" on Stripe checkout for every buyer. Fix: reactivate the ` +
+      `archived product in Stripe Dashboard, or rename the active product to ` +
+      `match "${expectedName}". See ThumbGate#2188 for the May 2026 incident.`
+    );
+  }
+}
+
 function buildSubscriptionPriceData(checkoutSelection, appOrigin) {
   const isTeam = checkoutSelection.planId === 'team';
   const annual = checkoutSelection.billingCycle === 'annual';
@@ -2525,6 +2581,18 @@ async function createCheckoutSession({ successUrl, cancelUrl, customerEmail, ins
   }
 
   const stripe = getStripeClient();
+
+  // Defensive guard against ThumbGate#2188:
+  // When buildSubscriptionPriceData passes inline `product_data` to Stripe,
+  // Stripe name-matches existing products. If the only existing product with
+  // that name is ARCHIVED (active=false), the new price inherits active=false
+  // and every Stripe checkout page renders "page not found" for the buyer.
+  // That bug burnt 20+ silent abandoned sessions in May 2026. Fail fast
+  // instead of letting the broken page ship.
+  if (!packId) {
+    await verifyActiveProductForPlan(stripe, checkoutSelection.planId);
+  }
+
   const sessionPayload = buildCheckoutSessionPayload({
     successUrl,
     cancelUrl,
@@ -2837,7 +2905,7 @@ function disableCustomerKeys(customerId) {
 }
 
 function verifyWebhookSignature(rawBody, signature) {
-  if (!CONFIG.STRIPE_WEBHOOK_SECRET) return true;
+  if (!CONFIG.STRIPE_WEBHOOK_SECRET) return allowUnsignedStripeWebhooks();
   if (!signature || !rawBody) return false;
 
   // Stripe signature format: t=<timestamp>,v1=<hmac>,...
@@ -2867,6 +2935,13 @@ function verifyWebhookSignature(rawBody, signature) {
 
 async function handleWebhook(rawBody, signature) {
   if (LOCAL_MODE()) return { handled: false, reason: 'local_mode' };
+  if (!CONFIG.STRIPE_WEBHOOK_SECRET && !allowUnsignedStripeWebhooks()) {
+    return {
+      handled: false,
+      reason: 'invalid_signature',
+      error: 'STRIPE_WEBHOOK_SECRET is required before Stripe webhooks can be processed.',
+    };
+  }
   let event;
   try {
     if (CONFIG.STRIPE_WEBHOOK_SECRET) {
@@ -2975,6 +3050,22 @@ async function handleWebhook(rawBody, signature) {
           attribution,
         });
       }
+      // Fire Plausible purchase event so the funnel poller can measure
+      // end-to-end conversion: visitor → CTA → checkout → email → Stripe → purchase.
+      // Fire-and-forget (never blocks the webhook response).
+      void recordCheckoutFunnelEvent('purchase', {
+        page: '/success',
+        props: {
+          sessionId: session.id,
+          customerId,
+          traceId: traceId || '',
+          packId: packId || '',
+          amount: session.amount_total != null ? String(session.amount_total) : '',
+          currency: session.currency || '',
+          ...attribution,
+        },
+      });
+
       return {
         handled: true,
         action: 'provisioned_api_key',
@@ -3127,6 +3218,7 @@ module.exports = {
   _buildTrialActivationEmail: buildTrialActivationEmail,
   _sendTrialActivationEmail: sendTrialActivationEmail,
   _resolveSubscriptionCheckoutSelection: resolveSubscriptionCheckoutSelection,
+  _verifyActiveProductForPlan: verifyActiveProductForPlan,
   _API_KEYS_PATH: () => CONFIG.API_KEYS_PATH,
   _FUNNEL_LEDGER_PATH: () => CONFIG.FUNNEL_LEDGER_PATH,
   _REVENUE_LEDGER_PATH: () => CONFIG.REVENUE_LEDGER_PATH,