thumbgate 1.27.18 → 1.27.20

package/scripts/install-shim.js

@@ -0,0 +1,87 @@
+'use strict';
+
+/**
+ * install-shim.js — Install a stable shim at ~/.thumbgate/bin/thumbgate-hook
+ *
+ * The shim is a tiny shell script that resolves the cached ThumbGate runtime
+ * first, so hook commands in settings.local.json stay stable across projects
+ * and agent restarts.
+ *
+ * The shim checks for a cached runtime binary first (fast path), and falls
+ * back to `npx --yes thumbgate@latest` (slow path, first-time self-install).
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const SHIM_DIR = path.join(os.homedir(), '.thumbgate', 'bin');
+const SHIM_PATH = path.join(SHIM_DIR, 'thumbgate-hook');
+const RUNTIME_BIN = path.join(os.homedir(), '.thumbgate', 'runtime', 'node_modules', '.bin', 'thumbgate');
+
+/**
+ * The shim script. Key design choices:
+ * - Uses `exec` to replace the shell process (no zombie processes)
+ * - Fast path: if cached runtime binary exists, exec it directly
+ * - Slow path: npx --yes thumbgate@latest (first-time auto-installs)
+ * - No default self-mutation: background upgrades are opt-in via
+ *   THUMBGATE_SHIM_AUTO_UPDATE=1 so source checkouts, enterprise pins, and
+ *   dogfood runtimes cannot be overwritten by a hook side effect.
+ */
+function shimContent() {
+  const escapedRuntimeBin = JSON.stringify(RUNTIME_BIN);
+  const escapedRuntimeDir = JSON.stringify(path.join(os.homedir(), '.thumbgate', 'runtime'));
+
+  return `#!/usr/bin/env bash
+# ThumbGate hook shim — DO NOT EDIT
+# Installed by: thumbgate init
+# Purpose: stable hook entry point that runs the cached ThumbGate runtime
+# Pattern: Volta-style stable shim (see https://volta.sh)
+
+set -euo pipefail
+
+RUNTIME_BIN=${escapedRuntimeBin}
+RUNTIME_DIR=${escapedRuntimeDir}
+
+# Fast path: cached runtime binary exists and is executable
+if [ -x "$RUNTIME_BIN" ]; then
+  # Optional background upgrade. Disabled by default so hooks never mutate a
+  # source checkout, enterprise pin, or dogfood runtime behind the operator's back.
+  if [ "\${THUMBGATE_SHIM_AUTO_UPDATE:-0}" = "1" ]; then
+    ( nohup npm install --prefix "$RUNTIME_DIR" --no-save --omit=dev thumbgate@latest >/dev/null 2>&1 & ) 2>/dev/null || true
+  fi
+  exec "$RUNTIME_BIN" "$@"
+fi
+
+# Slow path: no cached binary — install + exec via npx
+mkdir -p "$RUNTIME_DIR"
+exec npx --yes --package thumbgate@latest -- thumbgate "$@"
+`;
+}
+
+function installShim() {
+  fs.mkdirSync(SHIM_DIR, { recursive: true });
+  fs.writeFileSync(SHIM_PATH, shimContent(), { mode: 0o755 });
+  return SHIM_PATH;
+}
+
+function shimInstalled() {
+  try {
+    return fs.existsSync(SHIM_PATH) && (fs.statSync(SHIM_PATH).mode & 0o111) !== 0;
+  } catch {
+    return false;
+  }
+}
+
+function shimPath() {
+  return SHIM_PATH;
+}
+
+module.exports = {
+  installShim,
+  shimInstalled,
+  shimPath,
+  shimContent,
+  SHIM_DIR,
+  SHIM_PATH,
+};

package/scripts/lesson-inference.js

@@ -18,6 +18,7 @@ const fs = require('fs');
 const path = require('path');
 const { resolveFeedbackDir } = require('./feedback-paths');
 const { ensureParentDir, readJsonl } = require('./fs-utils');
+const { redactSecretsDeep } = require('./secret-redaction');
 const {
   buildStableId,
   extractFilePaths,
@@ -137,15 +138,19 @@ function createLesson({ feedbackId, signal, inferredLesson, triggerMessage, prio
   // Stable link: dashboard deep-link to this lesson
   lesson.link = `${getLessonBaseUrl()}/lessons#${lesson.id}`;
 
+  // Redact secrets before persisting — lesson text is derived from conversation content that may
+  // have captured a pasted credential. See scripts/secret-redaction.js.
+  const redactedLesson = redactSecretsDeep(lesson);
+
   const lessonsPath = getLessonsPath();
   ensureParentDir(lessonsPath);
-  fs.appendFileSync(lessonsPath, JSON.stringify(lesson) + '\n');
+  fs.appendFileSync(lessonsPath, JSON.stringify(redactedLesson) + '\n');
 
   // Update recent lesson for statusbar
   const recentPath = getRecentLessonPath();
-  fs.writeFileSync(recentPath, JSON.stringify(lesson, null, 2) + '\n');
+  fs.writeFileSync(recentPath, JSON.stringify(redactedLesson, null, 2) + '\n');
 
-  return lesson;
+  return redactedLesson;
 }
 
 /**

package/scripts/lesson-search.js

@@ -2,6 +2,7 @@
 
 const path = require('node:path');
 const { readJSONL, getFeedbackPaths } = require('./feedback-loop');
+const { buildMemoryLifecycleView, scoreHybridMemoryMatch } = require('./agent-memory-lifecycle');
 const { loadOptionalModule } = require('./private-core-boundary');
 
 const HIGH_RISK_TAGS = new Set([
@@ -411,7 +412,8 @@ function scoreLesson(queryText, memory, parsed, sourceFeedback) {
   const score = jaccardSimilarity(queryTokens, lessonTokens)
     + substringBoost(queryText, lessonText)
     + recencyScore(memory.timestamp)
-    + (memory.category === 'error' ? 0.05 : 0);
+    + (memory.category === 'error' ? 0.05 : 0)
+    + Math.min(0.2, scoreHybridMemoryMatch(queryText, memory).score * 0.1);
 
   return {
     score,
@@ -427,6 +429,7 @@ function buildLessonResult(memory, sourceFeedback, options = {}) {
   const { score, matchedTokens } = scoreLesson(options.query || '', memory, parsed, sourceFeedback);
   const harnessRecommendations = buildHarnessRecommendations(memory, parsed, sourceFeedback, ruleMatches, gateMatches);
   const lifecycle = buildLifecycle(memory, parsed, sourceFeedback, ruleMatches, gateMatches, harnessRecommendations);
+  const memoryLifecycle = buildMemoryLifecycleView(memory, { query: options.query || '' });
 
   return {
     id: memory.id,
@@ -452,6 +455,7 @@ function buildLessonResult(memory, sourceFeedback, options = {}) {
     systemResponse: {
       promotedToMemory: true,
       lifecycle,
+      memoryLifecycle,
       diagnosis: memory.diagnosis || null,
       sourceFeedback: sourceFeedback
         ? {
@@ -589,6 +593,14 @@ function tryFts5Search(query, options) {
         tags: row.tags,
         importance: row.importance,
         timestamp: row.timestamp,
+        memoryLifecycle: buildMemoryLifecycleView({
+          title: row.context,
+          content: [row.whatWentWrong, row.whatToChange, row.whatWorked].filter(Boolean).join('\n'),
+          domain: row.domain,
+          tags: row.tags,
+          importance: row.importance,
+          timestamp: row.timestamp,
+        }, { query: query || '' }),
       })),
       backend: 'sqlite-fts5',
     };
@@ -618,6 +630,10 @@ function formatLessonSearchResults(payload) {
   payload.results.forEach((result, index) => {
     lines.push(`${index + 1}. ${result.title}`);
     lines.push(`   Category: ${result.category} | Tags: ${result.tags.join(', ') || 'none'} | Score: ${result.score}`);
+    if (result.systemResponse.memoryLifecycle) {
+      const memoryLifecycle = result.systemResponse.memoryLifecycle;
+      lines.push(`   Memory: scope=${memoryLifecycle.scope} | decay=${memoryLifecycle.decay.state} | hybrid=${memoryLifecycle.retrievalHints.hybridScore}`);
+    }
     if (result.lesson.summary) {
       lines.push(`   Lesson: ${result.lesson.summary}`);
     }

package/scripts/license.js

@@ -23,15 +23,17 @@ function isValidKey(key) {
 }
 
 function verifyLicense(options = {}) {
-  const envKey = [
-    process.env.THUMBGATE_API_KEY,
-    process.env.THUMBGATE_PRO_KEY,
+  // Only ThumbGate's own env vars are license candidates — scanning foreign
+  // *_API_KEY / *_PRO_KEY vars would treat another vendor's secret as a
+  // license key. The result object never carries the raw key value.
+  const envEntry = [
+    ['THUMBGATE_API_KEY', process.env.THUMBGATE_API_KEY],
+    ['THUMBGATE_PRO_KEY', process.env.THUMBGATE_PRO_KEY],
     ...Object.entries(process.env)
-      .filter(([name]) => /(?:_API_KEY|_PRO_KEY)$/.test(name))
-      .map(([, value]) => value),
-  ].find((value) => isValidKey(value));
-  if (isValidKey(envKey)) {
-    return { valid: true, source: 'env', key: envKey };
+      .filter(([name]) => name.startsWith('THUMBGATE_') && /(?:_API_KEY|_PRO_KEY)$/.test(name)),
+  ].find(([, value]) => isValidKey(value));
+  if (envEntry) {
+    return { valid: true, source: 'env', envVar: envEntry[0] };
   }
 
   const licensePath = getLicensePath(options.homeDir);
@@ -42,7 +44,6 @@ function verifyLicense(options = {}) {
         return {
           valid: true,
           source: 'file',
-          key: data.key,
           activatedAt: data.activatedAt,
           path: licensePath,
         };
@@ -80,7 +81,6 @@ module.exports = {
   verifyLicense,
   isProLicensed,
   activateLicense,
-  generateLicenseKey,
   isValidKey,
   VALID_PREFIXES,
   LICENSE_PATH,

package/scripts/llm-client.js

@@ -11,20 +11,23 @@ const MODELS = {
 const DEFAULT_MODEL = MODELS.FAST;
 const DEFAULT_MAX_TOKENS = 1024;
 const DEFAULT_CACHE_TTL = '5m';
+const DEFAULT_ZAI_BASE_URL = 'https://api.z.ai/api/paas/v4';
+const DEFAULT_ZAI_MODEL = 'glm-5.2-flash';
 
-let _client = null;
+let _anthropicClient = null;
+let _geminiClient = null;
 
 function isAvailable() {
   return Boolean(process.env.ANTHROPIC_API_KEY);
 }
 
 function getClient() {
-  if (_client) return _client;
+  if (_anthropicClient) return _anthropicClient;
   if (!isAvailable()) return null;
   try {
     const Anthropic = require('@anthropic-ai/sdk');
-    _client = new Anthropic();
-    return _client;
+    _anthropicClient = new Anthropic();
+    return _anthropicClient;
   } catch {
     return null;
   }
@@ -138,7 +141,144 @@ function parseClaudeJson(text) {
   }
 }
 
+function getZaiApiKey(env = process.env) {
+  return env.ZAI_API_KEY || env.THUMBGATE_ZAI_API_KEY || '';
+}
+
+function getZaiBaseUrl(env = process.env) {
+  return env.ZAI_BASE_URL || env.THUMBGATE_ZAI_BASE_URL || DEFAULT_ZAI_BASE_URL;
+}
+
+function getZaiModel(env = process.env) {
+  return env.ZAI_API_MODEL || env.THUMBGATE_ZAI_MODEL || DEFAULT_ZAI_MODEL;
+}
+
+async function callZaiInternal(options = {}, env = process.env) {
+  const apiKey = getZaiApiKey(env);
+  if (!apiKey || typeof fetch !== 'function') return null;
+
+  const messages = Array.isArray(options.messages) && options.messages.length > 0
+    ? options.messages
+    : [
+      ...(options.systemPrompt ? [{ role: 'system', content: options.systemPrompt }] : []),
+      { role: 'user', content: options.userPrompt || '' },
+    ];
+
+  try {
+    const response = await fetch(`${getZaiBaseUrl(env).replace(/\/$/, '')}/chat/completions`, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        model: options.model || getZaiModel(env),
+        messages,
+        max_tokens: options.maxTokens || DEFAULT_MAX_TOKENS,
+        temperature: Number.isFinite(options.temperature) ? options.temperature : 0,
+      }),
+    });
+
+    if (!response.ok) return null;
+    const json = await response.json();
+    return {
+      text: stripCodeFences(json?.choices?.[0]?.message?.content || ''),
+      usage: json?.usage || null,
+      stopReason: json?.choices?.[0]?.finish_reason || null,
+      id: json?.id || null,
+      model: json?.model || options.model || getZaiModel(env),
+    };
+  } catch {
+    return null;
+  }
+}
+
+async function callGeminiInternal(options = {}) {
+  const env = process.env;
+  const { detectInferenceBackend } = require('./local-model-profile');
+  const providerMode = detectInferenceBackend(env).providerMode;
+
+  try {
+    const { GoogleGenAI } = require('@google/genai');
+    if (!_geminiClient) {
+      if (providerMode === 'vertex') {
+        _geminiClient = new GoogleGenAI({
+          enterprise: true,
+          project: env.VERTEX_PROJECT_ID || 'ai-revenue28-webhook',
+          location: env.VERTEX_LOCATION || 'us-central1',
+        });
+      } else {
+        _geminiClient = new GoogleGenAI({
+          apiKey: env.GEMINI_API_KEY,
+        });
+      }
+    }
+
+    const contents = convertMessagesToGemini(options.messages, options.userPrompt);
+    const config = {};
+    if (options.systemPrompt) {
+      config.systemInstruction = options.systemPrompt;
+    }
+    if (Number.isFinite(options.temperature)) {
+      config.temperature = options.temperature;
+    }
+    if (options.maxTokens) {
+      config.maxOutputTokens = options.maxTokens;
+    }
+
+    const response = await runStep('llm.callGemini', {
+      retries: 2,
+      logger: (msg) => console.warn(msg),
+    }, async () => _geminiClient.models.generateContent({
+      model: options.model,
+      contents,
+      config,
+    }));
+
+    return {
+      text: response.text || '',
+      usage: response.usageMetadata ? {
+        input_tokens: response.usageMetadata.promptTokenCount,
+        output_tokens: response.usageMetadata.candidatesTokenCount,
+      } : null,
+      stopReason: response.candidates?.[0]?.finishReason || null,
+      id: null,
+      model: options.model,
+    };
+  } catch (err) {
+    console.error('Gemini/Vertex AI execution error:', err);
+    return null;
+  }
+}
+
+function convertMessagesToGemini(messages, userPrompt) {
+  const list = Array.isArray(messages) && messages.length > 0
+    ? messages
+    : [{ role: 'user', content: userPrompt }];
+
+  return list.map((msg) => {
+    const role = msg.role === 'assistant' ? 'model' : 'user';
+    let text = '';
+    if (typeof msg.content === 'string') {
+      text = msg.content;
+    } else if (Array.isArray(msg.content)) {
+      text = msg.content.map((c) => c.text || '').join('');
+    } else if (msg.content && typeof msg.content === 'object') {
+      text = msg.content.text || JSON.stringify(msg.content);
+    }
+    return {
+      role,
+      parts: [{ text }],
+    };
+  });
+}
+
 async function callClaudeInternal(options = {}) {
+  const modelName = options.model || '';
+  if (modelName.startsWith('gemini') || modelName.startsWith('vertex')) {
+    return callGeminiInternal(options);
+  }
+
   const client = getClient();
   if (!client) return null;
 
@@ -193,10 +333,35 @@ async function callClaudeJson(options = {}) {
   return parsed;
 }
 
+async function callZaiJson(options = {}) {
+  const result = await callZaiInternal(options);
+  if (!result) return null;
+
+  const parsed = parseClaudeJson(result.text);
+  if (parsed === null) return null;
+
+  if (options.returnMetadata) {
+    return {
+      parsed,
+      text: result.text,
+      usage: result.usage,
+      stopReason: result.stopReason,
+      id: result.id,
+      model: result.model,
+    };
+  }
+
+  return parsed;
+}
+
 module.exports = {
   isAvailable,
   callClaude,
   callClaudeJson,
+  callZaiJson,
+  getZaiApiKey,
+  getZaiBaseUrl,
+  getZaiModel,
   stripCodeFences,
   parseClaudeJson,
   normalizeCacheOptions,

package/scripts/local-model-profile.js

@@ -111,7 +111,8 @@ function isSparseAttentionFamily(modelFamily) {
 
 function resolveProviderMode(env = process.env) {
   const explicit = normalizeSlug(env.THUMBGATE_PROVIDER_MODE || env.THUMBGATE_MODEL_PROVIDER_MODE);
-  if (explicit === 'local' || explicit === 'managed') return explicit;
+  if (explicit === 'local' || explicit === 'managed' || explicit === 'vertex') return explicit;
+  if (env.VERTEX_PROJECT_ID || env.VERTEX_API_ENDPOINT) return 'vertex';
   if (env.THUMBGATE_LOCAL_MODEL_FAMILY || env.THUMBGATE_LOCAL_MODEL_SERVER) return 'local';
   return 'managed';
 }
@@ -133,6 +134,7 @@ function resolveModelFamily(env = process.env) {
 }
 
 function buildBackendLabel(providerMode, modelFamily) {
+  if (providerMode === 'vertex') return 'Vertex AI secure cloud backend';
   if (providerMode === 'managed') return 'Managed API backend';
   if (modelFamily.startsWith('deepseek')) return 'Local DeepSeek sparse backend';
   if (modelFamily.startsWith('glm')) return 'Local GLM sparse backend';
@@ -148,14 +150,18 @@ function detectInferenceBackend(env = process.env) {
     && supportsSparseAttention
     && INDEXCACHE_SERVER_ENGINES.has(serverEngine);
   const indexCacheEnabled = indexCacheEligible && parseBoolean(env.THUMBGATE_INDEXCACHE_ENABLED, false);
-  const id = providerMode === 'managed'
-    ? 'managed-api'
-    : supportsSparseAttention
-      ? `local-${modelFamily}-sparse`
-      : 'local-dense';
+  const id = providerMode === 'vertex'
+    ? 'vertex-api'
+    : providerMode === 'managed'
+      ? 'managed-api'
+      : supportsSparseAttention
+        ? `local-${modelFamily}-sparse`
+        : 'local-dense';
 
   let rationale = 'Baseline backend with no sparse-attention acceleration.';
-  if (providerMode === 'managed') {
+  if (providerMode === 'vertex') {
+    rationale = 'Vertex AI secure cloud backend providing compliant enterprise Gemini models inside VPC boundary.';
+  } else if (providerMode === 'managed') {
     rationale = 'Managed API path does not expose sparse-attention kernel controls like IndexCache.';
   } else if (indexCacheEnabled) {
     rationale = `Local ${modelFamily} backend is sparse-attention capable and IndexCache-ready on ${serverEngine}.`;
@@ -336,7 +342,8 @@ function resolveModelRole(role, env) {
   const envKey = `THUMBGATE_MODEL_ROLE_${normalized.toUpperCase()}`;
   const modelFamily = resolveModelFamily(e);
   const isLocalGlm = modelFamily.startsWith('glm');
-  const provider = isLocalGlm ? 'local' : 'gemini';
+  const providerMode = resolveProviderMode(e);
+  const provider = isLocalGlm ? 'local' : (providerMode === 'vertex' ? 'vertex' : 'gemini');
   const defaultModel = isLocalGlm ? (GLM_MODEL_ROLES[normalized] || MODEL_ROLES[normalized]) : MODEL_ROLES[normalized];
   const model = (e[envKey] && String(e[envKey]).trim()) || defaultModel;
   return { role: normalized, model, provider, envKey };

package/scripts/mcp-config.js

@@ -107,9 +107,15 @@ function portableMcpEntry(pkgVersion) {
 }
 
 function codexAutoUpdateCliEntry(commandArgs = []) {
+  // Fast-start from the installed runtime binary; only resolve @latest via npx
+  // when the runtime is absent (e.g. first launch). This matches the hook
+  // commands and must never block MCP server startup on a per-launch reinstall
+  // (a blocking `npm install thumbgate@latest` on every launch caused
+  // capture/serve timeouts on slow or offline networks — a failed install left
+  // the chained `exec` unreached, so the server never started).
   return {
     command: 'sh',
-    args: ['-lc', publishedCliShellCommand('latest', commandArgs, { preferInstalled: false })],
+    args: ['-lc', publishedCliShellCommand('latest', commandArgs)],
   };
 }