thumbgate 1.27.18 → 1.27.20

package/scripts/context-manager.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 'use strict';
 
+const fs = require('fs');
+const path = require('path');
+
 /**
  * Context Manager — Unified Context-Augmented Generation (CAG) Orchestrator
  *
@@ -27,8 +30,9 @@ const {
   recordProvenance,
 } = require('./contextfs');
 const { loadOptionalModule } = require('./private-core-boundary');
-const { retrieveRelevantLessons } = loadOptionalModule('./lesson-retrieval', () => ({
+const { retrieveRelevantLessons, calculateRetrievalEntropy } = loadOptionalModule('./lesson-retrieval', () => ({
   retrieveRelevantLessons: () => [],
+  calculateRetrievalEntropy: () => 0,
 }));
 const { evaluatePretool } = require('./hybrid-feedback-context');
 const { loadProfile } = require('./user-profile');
@@ -93,13 +97,21 @@ function assembleSession() {
 
 function assembleLessons(query, agentProfile, options = {}) {
   try {
-    return retrieveRelevantLessons(
+    const lessons = retrieveRelevantLessons(
       options.toolName || '',
       query,
       { maxResults: agentProfile.maxLessons, feedbackDir: options.feedbackDir },
     );
+    
+    const entropy = calculateRetrievalEntropy(lessons);
+    
+    return { 
+      items: lessons, 
+      entropy, 
+      highConflict: entropy > 0.7 
+    };
   } catch {
-    return [];
+    return { items: [], entropy: 0, highConflict: false };
   }
 }
 
@@ -111,13 +123,41 @@ function assembleGuards(toolName, toolInput) {
   }
 }
 
-function assembleContextPack(query, agentProfile) {
+function assembleContextPack(query, agentProfile, options = {}) {
+  const { guards } = options;
   try {
     ensureContextFs();
+
+    // 1. Proactive Governance: Filter what the agent sees based on prevention rules
+    let structuredQuery = query;
+    if (guards && guards.mode === 'block') {
+      structuredQuery = `${query} (Active Block Policy: ${guards.reason})`;
+    }
+
+    // 2. Elevate Thompson Sampling to Architecture Level
+    let strategy = null;
+    try {
+      const ts = require('./thompson-sampling');
+      const model = ts.loadModel();
+      const bestCategory = ts.argmaxPosteriors(model);
+      
+      // Route between context-building strategies based on TS posterior mean
+      if (bestCategory === 'architecture' || bestCategory === 'infra') {
+        strategy = 'hierarchical';
+      } else if (bestCategory === 'observability' || bestCategory === 'debugging') {
+        strategy = 'summarize-then-expand';
+      } else {
+        strategy = 'semantic';
+      }
+    } catch (e) {
+      // Fallback to default routing
+    }
+
     return constructContextPack({
-      query,
+      query: structuredQuery,
       maxItems: Math.min(8, Math.ceil(agentProfile.contextBudget / 1000)),
       maxChars: agentProfile.contextBudget,
+      strategy
     });
   } catch {
     return null;
@@ -196,7 +236,8 @@ function assembleUnifiedContext(params = {}) {
   // Assemble all components — each is fault-tolerant
   const session = assembleSession();
   const userProfile = assembleUserProfile();
-  const lessons = assembleLessons(query, agentProfile, { toolName, feedbackDir });
+  const lessonData = assembleLessons(query, agentProfile, { toolName, feedbackDir });
+  const lessons = lessonData.items;
   const guards = assembleGuards(toolName, toolInput);
   const contextPack = assembleContextPack(query, agentProfile);
   const codeGraph = assembleCodeGraph(query, repoPath, agentProfile);
@@ -204,9 +245,24 @@ function assembleUnifiedContext(params = {}) {
   const components = { session, userProfile, lessons, guards, contextPack, codeGraph };
   const tier = classifyTier(components);
 
+  // v4.2: Entropy-Aware Reliability Directive
+  let reliabilityDirective = null;
+  if (lessonData.highConflict) {
+    reliabilityDirective = 'CAUTION: Conflicting past patterns detected for this action. Prioritize absolute ground truth verification over rapid completion.';
+  }
+
+  // v1.26.0: CodeRabbit Planning Directive
+  const planPath = path.join(repoPath || process.cwd(), 'PLAN.md');
+  if (!fs.existsSync(planPath) && ['Bash', 'Write', 'Edit', 'Deploy'].includes(toolName)) {
+    const planReminder = 'ORCHESTRATION: High-risk action detected without a PLAN.md. Please document your intent, assumptions, and verification steps before proceeding.';
+    reliabilityDirective = reliabilityDirective ? `${reliabilityDirective}\n\n${planReminder}` : planReminder;
+  }
+
   const result = {
     tier,
     agentType: agentType || 'default',
+    reliabilityDirective,
+    entropy: lessonData.entropy,
     agentProfile: {
       maxLessons: agentProfile.maxLessons,
       contextBudget: agentProfile.contextBudget,
@@ -228,6 +284,12 @@ function assembleUnifiedContext(params = {}) {
       })),
       visibility: contextPack.visibility || null,
       cached: !!(contextPack.cache && contextPack.cache.hit),
+      layers: {
+        localState: session || null,
+        graphState: codeGraph || null,
+        policyState: guards || null,
+        sessionState: contextPack.items ? contextPack.items.filter(i => i.namespace === 'session') : []
+      }
     } : null,
     codeGraph: codeGraph || null,
     assembledAt: new Date().toISOString(),
@@ -306,6 +368,12 @@ function formatUnifiedContext(ctx) {
 
   // Context pack
   if (ctx.contextPack) {
+    lines.push(`### Context Architecture Layers`);
+    lines.push(`- Local State: ${ctx.contextPack.layers.localState ? 'Active' : 'Empty'}`);
+    lines.push(`- Graph State: ${ctx.contextPack.layers.graphState ? 'Active' : 'Empty'}`);
+    lines.push(`- Policy State: ${ctx.contextPack.layers.policyState ? ctx.contextPack.layers.policyState.mode : 'Empty'}`);
+    lines.push(`- Session State: ${ctx.contextPack.layers.sessionState.length} items`);
+    lines.push('');
     lines.push(`### Context Pack (${ctx.contextPack.itemCount} items)`);
     ctx.contextPack.items.forEach((item) => {
       lines.push(`- [${item.namespace}] ${item.title} (score: ${item.score})`);

package/scripts/dashboard-chat.js

@@ -0,0 +1,332 @@
+'use strict';
+
+// scripts/dashboard-chat.js
+// -----------------------------------------------------------------------------
+// "Chat with your data" — the dashboard chat backend. Local-first RAG over
+// this install's ThumbGate data (lessons, raw feedback memories via LanceDB
+// vectors, receipts, gate stats). Retrieval is local (lesson search + optional
+// vector-store.searchSimilar). Generation uses your configured LLM: a local
+// OpenAI-compatible endpoint first, then Gemini or Perplexity when explicitly
+// configured.
+//
+// Dialogflow/Google is not the dashboard chatbot brain. It remains an optional
+// guard-adapter path for buyers who already run their own Google agent tenancy.
+// -----------------------------------------------------------------------------
+
+const path = require('path');
+
+const GEMINI_ENDPOINT = 'https://generativelanguage.googleapis.com/v1beta/models';
+const PERPLEXITY_ENDPOINT = 'https://api.perplexity.ai/chat/completions';
+const DEFAULT_MODEL = 'gemini-2.5-flash';
+const MAX_QUESTION_CHARS = 2000;
+const MAX_CONTEXT_LESSONS = 8;
+
+// Allowlist the model so a user-supplied `model` cannot route the call to an
+// arbitrary / unexpected (or more expensive) endpoint. Anything not on the list
+// falls back to the default.
+const ALLOWED_MODELS = new Set([
+  'gemini-2.5-flash', 'gemini-2.5-flash-lite', 'gemini-2.5-pro',
+  'gemini-2.0-flash', 'gemini-2.0-flash-lite',
+  'gemini-flash-latest', 'gemini-flash-lite-latest', 'gemini-pro-latest',
+]);
+
+function resolveModel(requested) {
+  const r = String(requested || '').trim();
+  if (r && ALLOWED_MODELS.has(r)) return r;
+  const envModel = String(process.env.THUMBGATE_GEMINI_MODEL || '').trim();
+  if (envModel && ALLOWED_MODELS.has(envModel)) return envModel;
+  return DEFAULT_MODEL;
+}
+
+function resolveApiKey(opts = {}) {
+  let key = '';
+  if (Object.hasOwn(opts, 'apiKey')) {
+    key = opts.apiKey || '';
+  } else {
+    key = opts.apiKey || process.env.GEMINI_API_KEY || process.env.THUMBGATE_GEMINI_API_KEY || process.env.GOOGLE_API_KEY || process.env.PERPLEXITY_API_KEY || process.env.THUMBGATE_PERPLEXITY_API_KEY || '';
+  }
+  if (!key) return '';
+  return key.trim().replace(/^["']|["']$/g, '');
+}
+
+function debugChatFallback(label, err) {
+  if (process.env.THUMBGATE_DEBUG_CHAT !== '1') return;
+  const detail = err?.message ? err.message : String(err);
+  console.warn(`[dashboard-chat] ${label}: ${detail}`);
+}
+
+function loadLessonSearcher() {
+  try {
+    return require(path.join(__dirname, 'lesson-search')).searchLessons;
+  } catch (err) {
+    debugChatFallback('lesson search unavailable', err);
+    return null;
+  }
+}
+
+function lessonToContextItem(lesson) {
+  return {
+    id: lesson.id,
+    signal: lesson.signal || lesson.feedback || '',
+    title: (lesson.title || '').replace(/^(?:MISTAKE|SUCCESS):\s*/i, '').slice(0, 160),
+    content: String(lesson.content || lesson.context || '').replace(/\s+/g, ' ').trim().slice(0, 600),
+    tags: lesson.tags || [],
+    source: 'lessons',
+  };
+}
+
+function vectorMatchToContextItem(match, index) {
+  return {
+    id: match.id || `vec-${index}`,
+    signal: match.signal || '',
+    title: String(match.context || match.text || '').slice(0, 100),
+    content: match.text || match.context || '',
+    tags: match.tags ? String(match.tags).split(',').filter(Boolean) : [],
+    source: 'lancedb-vector',
+  };
+}
+
+function dedupeContextItems(items, limit = MAX_CONTEXT_LESSONS + 3) {
+  const seen = new Set();
+  return items.filter((item) => {
+    if (!(item.content || item.title)) return false;
+    const key = item.id || item.content.slice(0, 80);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  }).slice(0, limit);
+}
+
+function retrieveLessonContext(question, opts = {}) {
+  const searchLessons = loadLessonSearcher();
+  if (!searchLessons) return [];
+  try {
+    const res = searchLessons(String(question || ''), {
+      limit: MAX_CONTEXT_LESSONS,
+      feedbackDir: opts.feedbackDir,
+    });
+    const rows = res?.results || res?.lessons || [];
+    return rows.slice(0, MAX_CONTEXT_LESSONS).map(lessonToContextItem);
+  } catch (err) {
+    debugChatFallback('lesson retrieval failed', err);
+    return [];
+  }
+}
+
+async function retrieveVectorContext(question, opts = {}) {
+  if (opts.useVectorSearch === false) return [];
+  try {
+    const vectorStore = require(path.join(__dirname, 'vector-store'));
+    const vecResults = vectorStore.searchSimilar
+      ? await vectorStore.searchSimilar(String(question || ''), opts.vectorLimit || 4)
+      : [];
+    return vecResults
+      .filter((match) => match?.text)
+      .map(vectorMatchToContextItem);
+  } catch (err) {
+    debugChatFallback('vector retrieval failed', err);
+    return [];
+  }
+}
+
+// Live numeric snapshot from gate-stats + feedback analyzer. Always injected
+// (~120 tokens) so the LLM can answer count/quantity questions like
+// "how many were blocked today" without hallucinating.
+function retrieveMetricsContext() {
+  const snapshot = {};
+  try {
+    const gs = require(path.join(__dirname, 'gate-stats'));
+    const s = gs.calculateStats();
+    snapshot.gates = {
+      total: s.totalGates,
+      blockRules: s.blockGates,
+      warnRules: s.warnGates,
+      totalBlockedEvents: s.totalBlocked,
+      totalWarnedEvents: s.totalWarned,
+      estimatedHoursSaved: s.estimatedHoursSaved,
+      topBlockedTrigger: s.topBlocked?.trigger || null,
+      topBlockedOccurrences: s.topBlocked?.occurrences || 0,
+    };
+  } catch (err) {
+    debugChatFallback('gate-stats unavailable', err);
+  }
+  try {
+    const fl = require(path.join(__dirname, 'feedback-loop'));
+    const a = fl.analyzeFeedback();
+    snapshot.feedback = {
+      total: a.total,
+      positive: a.totalPositive,
+      negative: a.totalNegative,
+      approvalRate: a.approvalRate,
+      last7d: a.windows?.['7d'],
+      last30d: a.windows?.['30d'],
+      trend: a.trend,
+    };
+  } catch (err) {
+    debugChatFallback('feedback-loop analyze unavailable', err);
+  }
+  return snapshot;
+}
+
+// Retrieve relevant stored lessons and optional raw feedback vector matches.
+async function retrieveContext(question, opts = {}) {
+  const lessons = retrieveLessonContext(question, opts);
+  const vectors = await retrieveVectorContext(question, opts);
+  return dedupeContextItems([...lessons, ...vectors]);
+}
+
+// Build a grounded RAG prompt. Pure function (testable).
+function buildChatPrompt(question, lessons, metrics) {
+  const q = String(question || '').slice(0, MAX_QUESTION_CHARS).trim();
+  const context = (lessons || []).map((l, i) => {
+    const mark = /pos|up/i.test(l.signal) ? 'WORKED' : (/neg|down/i.test(l.signal) ? 'MISTAKE' : 'NOTE');
+    const tags = (l.tags || []).length ? ` [tags: ${l.tags.join(', ')}]` : '';
+    return `(${i + 1}) [${mark}] ${l.title || ''}${tags}\n    ${l.content}`;
+  }).join('\n');
+
+  const metricsBlock = metrics && Object.keys(metrics).length
+    ? `\n=== Live numeric snapshot (your data, current) ===\n${JSON.stringify(metrics, null, 2)}\n`
+    : '';
+
+  const system = [
+    'You are ThumbGate\'s "chat with your data" assistant. Answer the user\'s question',
+    'using ONLY the captured lessons and the live numeric snapshot below (this team\'s real data).',
+    'For count/quantity questions ("how many X", "what\'s our rate"), use the numeric snapshot.',
+    'For pattern/why questions, cite the lesson numbers like [1], [3].',
+    'If neither source contains the answer, say so plainly — do not invent facts.',
+  ].join(' ');
+
+  return `${system}\n\n=== Captured lessons (your data) ===\n${context || '(no relevant lessons found)'}\n${metricsBlock}\n=== Question ===\n${q}`;
+}
+
+// Parse the Gemini generateContent response into plain text. Pure (testable).
+function parseGeminiAnswer(body) {
+  const parts = body?.candidates?.[0]?.content?.parts;
+  if (!Array.isArray(parts)) return '';
+  return parts.map((p) => (p && typeof p.text === 'string' ? p.text : '')).join('').trim();
+}
+
+function buildOpenAiChatPayload(prompt, model) {
+  return JSON.stringify({
+    model,
+    messages: [{ role: 'user', content: prompt }],
+    temperature: 0.2,
+    max_tokens: 1024,
+  });
+}
+
+function parseOpenAiChatAnswer(json) {
+  return json?.choices?.[0]?.message?.content || '';
+}
+
+function parseModelError(json, status) {
+  return json?.error?.message ? String(json.error.message).split('\n')[0] : `HTTP ${status}`;
+}
+
+function trimTrailingSlashes(value) {
+  let text = String(value || '');
+  while (text.endsWith('/')) {
+    text = text.slice(0, -1);
+  }
+  return text;
+}
+
+async function callLocalOpenAiEndpoint({ endpoint, apiKey, model, prompt, fetchImpl, sources }) {
+  const url = endpoint.includes('/chat/completions')
+    ? endpoint
+    : `${trimTrailingSlashes(endpoint)}/chat/completions`;
+  const res = await fetchImpl(url, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'Authorization': `Bearer ${apiKey || 'local'}`
+    },
+    body: buildOpenAiChatPayload(prompt, model),
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    return { ok: false, error: 'local_llm_error', status: res.status, message: parseModelError(json, res.status), sources };
+  }
+  const answer = parseOpenAiChatAnswer(json);
+  return { ok: true, answer: answer.trim() || '(no answer returned)', sources, model: json.model || model };
+}
+
+async function callPerplexityEndpoint({ apiKey, prompt, fetchImpl, sources }) {
+  const res = await fetchImpl(PERPLEXITY_ENDPOINT, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'Authorization': `Bearer ${apiKey}` },
+    body: buildOpenAiChatPayload(prompt, 'sonar'),
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    return { ok: false, error: 'perplexity_error', status: res.status, message: parseModelError(json, res.status), sources };
+  }
+  const answer = parseOpenAiChatAnswer(json);
+  return { ok: true, answer: answer.trim() || '(no answer returned)', sources, model: json.model || 'perplexity-hybrid' };
+}
+
+async function callGeminiEndpoint({ apiKey, model, prompt, fetchImpl, sources }) {
+  const res = await fetchImpl(`${GEMINI_ENDPOINT}/${encodeURIComponent(model)}:generateContent`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-goog-api-key': apiKey },
+    body: JSON.stringify({
+      contents: [{ role: 'user', parts: [{ text: prompt }] }],
+      generationConfig: { temperature: 0.2, maxOutputTokens: 1024 },
+    }),
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    return { ok: false, error: 'gemini_error', status: res.status, message: parseModelError(json, res.status), sources };
+  }
+  const answer = parseGeminiAnswer(json);
+  return { ok: true, answer: answer || '(no answer returned)', sources, model: json.modelVersion || model };
+}
+
+// Answer a question grounded in this install's lessons. Returns
+// { ok, answer, sources, model } or { ok:false, error, ... }.
+async function answerDataQuestion(question, opts = {}) {
+  const q = String(question || '').trim();
+  if (!q) return { ok: false, error: 'empty_question', message: 'Ask a question about your data.' };
+  if (q.length > MAX_QUESTION_CHARS) {
+    return { ok: false, error: 'question_too_long', message: `Question exceeds ${MAX_QUESTION_CHARS} characters.` };
+  }
+
+  const localEndpoint = opts.localEndpoint || process.env.THUMBGATE_LOCAL_LLM_ENDPOINT || '';
+  const localModel = opts.localModel || process.env.THUMBGATE_LOCAL_LLM_MODEL || 'llama3';
+  const apiKey = resolveApiKey(opts);
+  const lessons = await retrieveContext(q, opts);
+  const sources = lessons.map((l) => ({ id: l.id, title: l.title, signal: l.signal }));
+
+  if (!apiKey && !localEndpoint) {
+    return {
+      ok: false,
+      error: 'no_api_key',
+      message: 'Chat is not configured. Set a valid GEMINI_API_KEY, PERPLEXITY_API_KEY, or THUMBGATE_LOCAL_LLM_ENDPOINT in the project .env.',
+      sources,
+    };
+  }
+
+  const model = resolveModel(opts.model);
+  const metrics = retrieveMetricsContext();
+  const prompt = buildChatPrompt(q, lessons, metrics);
+  const fetchImpl = opts.fetch || globalThis.fetch;
+  const isPerplexity = apiKey && (apiKey.startsWith('pplx-') || apiKey.includes('perplexity'));
+
+  try {
+    if (localEndpoint) return await callLocalOpenAiEndpoint({ endpoint: localEndpoint, apiKey, model: localModel, prompt, fetchImpl, sources });
+    if (isPerplexity) return await callPerplexityEndpoint({ apiKey, prompt, fetchImpl, sources });
+    return await callGeminiEndpoint({ apiKey, model, prompt, fetchImpl, sources });
+  } catch (err) {
+    const safeMessage = (err && err.message) ? String(err.message).split('\n')[0].slice(0, 100) : 'An unexpected error occurred.';
+    return { ok: false, error: 'network', message: safeMessage, sources };
+  }
+}
+
+module.exports = {
+  answerDataQuestion,
+  buildChatPrompt,
+  parseGeminiAnswer,
+  retrieveContext,
+  DEFAULT_MODEL,
+  MAX_QUESTION_CHARS,
+};

package/scripts/dashboard.js

@@ -17,6 +17,7 @@ const { filterEntriesForWindow, resolveAnalyticsWindow } = require('./analytics-
 const { resolveHostedBillingConfig } = require('./hosted-config');
 const { generateAgentReadinessReport } = require('./agent-readiness');
 const { summarizeGateTemplates } = require('./gate-templates');
+const { mergeRepeatMetricIntoGateStats } = require('./repeat-metric');
 const { buildPredictiveInsights } = loadOptionalModule('./predictive-insights', () => ({
   buildPredictiveInsights: () => ({
     upgradePropensity: {
@@ -48,6 +49,10 @@ const {
   readDecisionLog,
 } = require('./decision-journal');
 const { analyzeFeedback } = require('./feedback-loop');
+const {
+  collectAggregateLogEntries,
+  shouldAggregateFeedback,
+} = require('./feedback-aggregate');
 
 const PROJECT_ROOT = path.join(__dirname, '..');
 const DEFAULT_GATES_PATH = path.join(PROJECT_ROOT, 'config', 'gates', 'default.json');
@@ -967,6 +972,20 @@ function computeAnalyticsSummary(feedbackDir, options = {}) {
   return {
     window: telemetry.window || analyticsWindow,
     telemetry,
+    firstPartyTrafficQuality: telemetry.trafficQuality || {
+      rawEvents: telemetry.totalEvents || 0,
+      externalEvents: 0,
+      excludedEvents: 0,
+      exclusionRate: 0,
+      byAudience: {},
+      byExclusionReason: {},
+      external: {
+        uniqueVisitors: 0,
+        pageViews: 0,
+        checkoutStarts: 0,
+      },
+      verdict: 'missing',
+    },
     funnel: {
       visitors: uniqueVisitors,
       sessions: telemetry.visitors ? telemetry.visitors.uniqueSessions || 0 : 0,
@@ -1149,16 +1168,42 @@ function computeInstrumentationReadiness(analytics, billing) {
   const coverage = billing && billing.coverage ? billing.coverage : {};
   const telemetry = analytics.telemetry || {};
   const visitors = telemetry.visitors || {};
+  const quality = telemetry.trafficQuality || analytics.firstPartyTrafficQuality || {};
+  const external = quality.external || {};
   const cli = telemetry.cli || {};
+  const plausibleExportConfigured = Boolean(
+    process.env.PLAUSIBLE_API_KEY && (process.env.PLAUSIBLE_SITE_ID || process.env.PLAUSIBLE_DOMAIN)
+  );
+  const posthogExportConfigured = Boolean(
+    (process.env.POSTHOG_PERSONAL_API_KEY || process.env.POSTHOG_API_KEY) && process.env.POSTHOG_PROJECT_ID
+  );
+  const ga4ExportConfigured = Boolean(
+    process.env.GA4_PROPERTY_ID && (process.env.GOOGLE_APPLICATION_CREDENTIALS || process.env.GOOGLE_CLIENT_EMAIL)
+  );
+  const dashboardGradeExportReady = plausibleExportConfigured || posthogExportConfigured || ga4ExportConfigured;
 
   return {
-    plausibleConfigured: /plausible\.io\/js\/script\.js|\/js\/analytics\.js/.test(landingPage),
+    plausibleConfigured: /plausible\.io\/js\/script(?:\.tagged-events)?\.js|\/js\/analytics\.js/.test(landingPage),
     ga4Configured: Boolean(runtimeConfig.gaMeasurementId),
     googleSearchConsoleConfigured: Boolean(runtimeConfig.googleSiteVerification),
     softwareApplicationSchemaPresent: /"@type": "SoftwareApplication"/.test(landingPage),
     faqSchemaPresent: /"@type": "FAQPage"/.test(landingPage),
     telemetryEventsPresent: (telemetry.totalEvents || 0) > 0,
     uniqueVisitorsTracked: visitors.uniqueVisitors || 0,
+    rawTelemetryEvents: quality.rawEvents || telemetry.totalEvents || 0,
+    externalTelemetryEvents: quality.externalEvents || 0,
+    excludedTelemetryEvents: quality.excludedEvents || 0,
+    externalVisitorsTracked: external.uniqueVisitors || 0,
+    externalPageViewsTracked: external.pageViews || 0,
+    externalCheckoutStartsTracked: external.checkoutStarts || 0,
+    externalVisitorPathsTracked: Array.isArray(external.visitorPaths) ? external.visitorPaths.length : 0,
+    internalTestPollutionRate: quality.exclusionRate || 0,
+    trafficQualityVerdict: quality.verdict || 'missing',
+    topExcludedTrafficReason: quality.topExclusionReason || null,
+    plausibleExportConfigured,
+    posthogExportConfigured,
+    ga4ExportConfigured,
+    dashboardGradeExportReady,
     cliInstallsTracked: cli.uniqueInstalls || 0,
     funnelEventsPresent: (analytics.reconciliation.telemetryCheckoutStarts || 0) > 0,
     seoSignalsPresent: (analytics.seo.landingViews || 0) > 0,
@@ -1504,6 +1549,10 @@ function resolveTeamWindowHours(analyticsWindow) {
 // ---------------------------------------------------------------------------
 
 function collectAllFeedbackEntries(feedbackDir) {
+  if (shouldAggregateFeedback()) {
+    return collectAggregateLogEntries('feedback-log.jsonl', { feedbackDir }).entries;
+  }
+
   const entries = [];
   const seen = new Set();
 
@@ -1573,7 +1622,11 @@ function generateDashboard(feedbackDir, options = {}) {
   const billingSummary = options.billingSummary || getBillingSummary(analyticsWindow);
 
   const approval = computeApprovalStats(entries);
-  const gateStats = computeGateStats();
+  // Surface the "repeat-attempts blocked before execution" metric on the
+  // dashboard JSON and the /v1/dashboard HTTP route. Use the non-mutating
+  // helper (mirrors server-stdio.js) instead of mutating computeGateStats()'s
+  // return value. (mergeRepeatMetricIntoGateStats is imported at top of file.)
+  const gateStats = mergeRepeatMetricIntoGateStats(computeGateStats());
   const prevention = computePreventionImpact(feedbackDir, gateStats);
   const trend = computeSessionTrend(entries, 10);
   const health = computeSystemHealth(feedbackDir, gateStats);
@@ -1865,8 +1918,10 @@ function printDashboard(data) {
   console.log('');
   console.log('\uD83D\uDCBC Growth Analytics');
   console.log(`  Unique Visitors  : ${analytics.trafficMetrics.visitors}`);
+  console.log(`  External Visitors: ${instrumentation.externalVisitorsTracked}`);
   console.log(`  Sessions         : ${analytics.trafficMetrics.sessions}`);
   console.log(`  Page Views       : ${analytics.trafficMetrics.pageViews}`);
+  console.log(`  External Views   : ${instrumentation.externalPageViewsTracked}`);
   console.log(`  CTA Clicks       : ${analytics.trafficMetrics.ctaClicks}`);
   console.log(`  Leads            : ${analytics.funnel.acquisitionLeads}`);
   console.log(`  Sprint Leads     : ${analytics.pipeline.workflowSprintLeads.total}`);
@@ -1877,6 +1932,7 @@ function printDashboard(data) {
   console.log(`  Booked Revenue   : $${(analytics.revenue.bookedRevenueCents / 100).toFixed(2)}`);
   console.log(`  Matched Journeys : ${analytics.reconciliation.matchedPaidOrders}/${analytics.reconciliation.telemetryCheckoutStarts}`);
   console.log(`  Buyer Loss       : ${analytics.buyerLoss.totalSignals}`);
+  console.log(`  Data Quality     : ${analytics.firstPartyTrafficQuality.verdict} (${instrumentation.excludedTelemetryEvents}/${instrumentation.rawTelemetryEvents} excluded)`);
   if (analytics.telemetry.visitors.topSource) {
     console.log(`  Top Source       : ${analytics.telemetry.visitors.topSource.key} (${analytics.telemetry.visitors.topSource.count}\u00D7)`);
   }
@@ -1896,6 +1952,15 @@ function printDashboard(data) {
   console.log(`  GA4              : ${instrumentation.ga4Configured ? 'configured' : 'missing'}`);
   console.log(`  Search Console   : ${instrumentation.googleSearchConsoleConfigured ? 'configured' : 'missing'}`);
   console.log(`  Telemetry Events : ${instrumentation.telemetryEventsPresent ? instrumentation.uniqueVisitorsTracked : 0} visitors`);
+  console.log(`  Clean Visitors   : ${instrumentation.externalVisitorsTracked} external (${Math.round((instrumentation.internalTestPollutionRate || 0) * 100)}% internal/test/bot events)`);
+  console.log(`  Clean Paths      : ${instrumentation.externalVisitorPathsTracked} first-party paths`);
+  if (instrumentation.topExcludedTrafficReason) {
+    console.log(`  Top Exclusion    : ${instrumentation.topExcludedTrafficReason.key} (${instrumentation.topExcludedTrafficReason.count}\u00D7)`);
+  }
+  console.log(`  Plausible Export : ${instrumentation.plausibleExportConfigured ? 'configured' : 'missing API credentials'}`);
+  console.log(`  PostHog Export   : ${instrumentation.posthogExportConfigured ? 'configured' : 'missing API credentials'}`);
+  console.log(`  GA4 Export       : ${instrumentation.ga4ExportConfigured ? 'configured' : 'missing API credentials'}`);
+  console.log(`  Visitor Paths    : ${instrumentation.dashboardGradeExportReady ? 'export-ready' : 'not dashboard-grade in repo'}`);
   console.log(`  SEO Signals      : ${instrumentation.seoSignalsPresent ? analytics.seo.landingViews : 0}`);
   console.log(`  Buyer Loss       : ${instrumentation.buyerLossSignalsPresent ? analytics.buyerLoss.totalSignals : 0}`);
   console.log(`  Attribution      : ${Math.round((instrumentation.trafficAttributionCoverage || 0) * 100)}% page-view coverage`);
@@ -2025,6 +2090,7 @@ module.exports = {
   computeObservabilityStats,
   readJSONL,
   readJsonFile,
+  collectAllFeedbackEntries,
 };
 
 if (require.main === module) {

package/scripts/export-databricks-bundle.js

@@ -6,6 +6,7 @@ const path = require('path');
 
 const { getFeedbackPaths } = require('./feedback-loop');
 const { ensureDir } = require('./fs-utils');
+const { redactSecretsDeep } = require('./secret-redaction');
 
 const PROJECT_ROOT = path.join(__dirname, '..');
 const DEFAULT_PROOF_DIR = process.env.THUMBGATE_PROOF_DIR
@@ -47,7 +48,10 @@ function readJSON(filePath) {
 }
 
 function writeJSONL(filePath, rows) {
-  const content = rows.map((row) => JSON.stringify(row)).join('\n');
+  // Redact secrets from every bundle row — this is the single choke point for all bundle tables
+  // (feedback_events, memory_records, sequences, attributions, proof_reports). A shared/published
+  // dataset must never ship a captured credential. See scripts/secret-redaction.js.
+  const content = rows.map((row) => JSON.stringify(redactSecretsDeep(row))).join('\n');
   fs.writeFileSync(filePath, content ? `${content}\n` : '');
 }
 

package/scripts/export-dpo-pairs.js

@@ -9,6 +9,7 @@ const fs = require('fs');
 const path = require('path');
 const { traceForDpoPair, aggregateTraces } = require('./code-reasoning');
 const { resolveFeedbackDir } = require('./feedback-paths');
+const { redactSecretsDeep } = require('./secret-redaction');
 
 const DEFAULT_LOCAL_MEMORY_LOG = path.join(resolveFeedbackDir(), 'memory-log.jsonl');
 
@@ -201,14 +202,18 @@ function exportDpoFromMemories(memories) {
     },
   }));
 
+  // Redact secrets before the pairs leave this module — they are derived from memory content and
+  // are shipped to disk here AND consumed by export-hf-dataset.js. See scripts/secret-redaction.js.
+  const redactedPairs = pairsWithTraces.map((pair) => redactSecretsDeep(pair));
+
   return {
-    pairs: pairsWithTraces,
+    pairs: redactedPairs,
     unpairedErrors: result.unpairedErrors,
     unpairedLearnings: result.unpairedLearnings,
     errors,
     learnings,
     reasoning,
-    jsonl: toJSONL(pairsWithTraces),
+    jsonl: toJSONL(redactedPairs),
   };
 }