thumbgate 1.27.19 → 1.27.20

package/scripts/verify-marketing-pages-deployed.js

@@ -0,0 +1,212 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * verify-marketing-pages-deployed.js — post-deploy probe for top-level
+ * marketing pages.
+ *
+ * Reads `config/post-deploy-marketing-pages.json` and curls every entry
+ * against the live production URL (default
+ * https://thumbgate-production.up.railway.app, overridable via
+ * THUMBGATE_PROD_URL env or --prod-url=…). Each response body must
+ * contain the configured sentinel string and must not contain any configured
+ * `mustNotContain` strings. Any mismatch fails the run and the route is
+ * included in the failure summary.
+ *
+ * Intended to run as a workflow step in .github/workflows/deploy-verify.yml
+ * after the version sentinel check, so the marketing surface is verified
+ * in the same gate as /health and /dashboard. Adding a new marketing
+ * page? Add it to the JSON manifest — no workflow edit required.
+ *
+ * Modes:
+ *   --json    machine-readable report on stdout, suitable for piping
+ *             into the GitHub Actions PR comment step.
+ *   --quiet   suppress per-route lines; only print the final summary.
+ *
+ * Exit code is 0 when every page passes, 1 if any sentinel is missing
+ * or any route returns non-200.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const DEFAULT_PROD_URL = 'https://thumbgate-production.up.railway.app';
+const DEFAULT_TIMEOUT_MS = 12000;
+const DEFAULT_MANIFEST_PATH = path.resolve(__dirname, '..', 'config', 'post-deploy-marketing-pages.json');
+
+function parseArgs(argv = []) {
+  const out = {
+    prodUrl: process.env.THUMBGATE_PROD_URL || DEFAULT_PROD_URL,
+    manifestPath: DEFAULT_MANIFEST_PATH,
+    json: false,
+    quiet: false,
+    timeoutMs: DEFAULT_TIMEOUT_MS,
+  };
+  for (const arg of argv) {
+    if (arg === '--json') out.json = true;
+    else if (arg === '--quiet') out.quiet = true;
+    else if (arg.startsWith('--prod-url=')) out.prodUrl = arg.slice('--prod-url='.length);
+    else if (arg.startsWith('--manifest=')) out.manifestPath = arg.slice('--manifest='.length);
+    else if (arg.startsWith('--timeout-ms=')) {
+      const n = Number(arg.slice('--timeout-ms='.length));
+      if (Number.isFinite(n) && n > 0) out.timeoutMs = n;
+    }
+  }
+  return out;
+}
+
+function loadManifest(manifestPath) {
+  const raw = fs.readFileSync(manifestPath, 'utf-8');
+  const parsed = JSON.parse(raw);
+  if (!Array.isArray(parsed.pages) || parsed.pages.length === 0) {
+    throw new Error(`Manifest has no pages: ${manifestPath}`);
+  }
+  for (const entry of parsed.pages) {
+    if (typeof entry.route !== 'string' || !entry.route.startsWith('/')) {
+      throw new Error(`Invalid route in manifest: ${JSON.stringify(entry)}`);
+    }
+    if (typeof entry.sentinel !== 'string' || entry.sentinel.length === 0) {
+      throw new Error(`Invalid sentinel for route ${entry.route}`);
+    }
+    if (entry.mustNotContain != null) {
+      if (!Array.isArray(entry.mustNotContain) || entry.mustNotContain.some((value) => typeof value !== 'string' || value.length === 0)) {
+        throw new Error(`Invalid mustNotContain for route ${entry.route}`);
+      }
+    }
+    if (entry.userAgent != null && (typeof entry.userAgent !== 'string' || entry.userAgent.length === 0)) {
+      throw new Error(`Invalid userAgent for route ${entry.route}`);
+    }
+  }
+  return parsed;
+}
+
+async function probePage({ prodUrl, route, sentinel, mustNotContain = [], userAgent, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS }) {
+  if (typeof fetchImpl !== 'function') {
+    return { route, ok: false, error: 'fetch_unavailable' };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const url = `${prodUrl.replace(/\/$/, '')}${route}`;
+    const res = await fetchImpl(url, {
+      signal: controller.signal,
+      headers: {
+        // A real browser-shaped UA so bot-deflection interstitials do not
+        // trigger; this probe is meant to verify the buyer-facing surface.
+        'User-Agent': userAgent || 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36',
+        Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+      },
+    });
+    const body = await res.text().catch(() => '');
+    const sentinelPresent = body.includes(sentinel);
+    const forbiddenPresent = Array.isArray(mustNotContain)
+      ? mustNotContain.filter((value) => body.includes(value))
+      : [];
+    return {
+      route,
+      url,
+      status: res.status,
+      ok: res.ok && sentinelPresent && forbiddenPresent.length === 0,
+      sentinelPresent,
+      forbiddenPresent,
+      bytes: body.length,
+    };
+  } catch (error) {
+    return {
+      route,
+      ok: false,
+      error: error?.name === 'AbortError' ? `timeout_after_${timeoutMs}ms` : (error?.message || String(error)),
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function runVerification({ prodUrl, manifestPath, fetchImpl = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  const manifest = loadManifest(manifestPath);
+  const results = [];
+  // Sequential is fine — manifest has <20 entries; parallelism would
+  // be over-engineered and would risk masking a per-route rate-limit signal.
+  for (const entry of manifest.pages) {
+    // eslint-disable-next-line no-await-in-loop
+    const result = await probePage({
+      prodUrl,
+      route: entry.route,
+      sentinel: entry.sentinel,
+      mustNotContain: entry.mustNotContain,
+      userAgent: entry.userAgent,
+      fetchImpl,
+      timeoutMs,
+    });
+    results.push({ ...result, sentinel: entry.sentinel, description: entry.description });
+  }
+  const passed = results.filter((r) => r.ok);
+  const failed = results.filter((r) => !r.ok);
+  return {
+    generatedAt: new Date().toISOString(),
+    prodUrl,
+    manifestVersion: manifest.version,
+    totalRoutes: results.length,
+    passedCount: passed.length,
+    failedCount: failed.length,
+    verdict: failed.length === 0 ? 'pass' : 'fail',
+    results,
+  };
+}
+
+function renderHuman(report, { quiet = false } = {}) {
+  const lines = [];
+  if (!quiet) {
+    for (const r of report.results) {
+      if (r.ok) {
+        lines.push(`✅ ${r.route.padEnd(20)}  HTTP ${r.status}  bytes=${r.bytes}  sentinel-OK`);
+      } else if (r.error) {
+        lines.push(`❌ ${r.route.padEnd(20)}  ERROR ${r.error}`);
+      } else if (!r.sentinelPresent) {
+        lines.push(`❌ ${r.route.padEnd(20)}  HTTP ${r.status}  sentinel MISSING (expected: ${JSON.stringify(r.sentinel)})`);
+      } else if (Array.isArray(r.forbiddenPresent) && r.forbiddenPresent.length > 0) {
+        lines.push(`❌ ${r.route.padEnd(20)}  HTTP ${r.status}  forbidden content PRESENT (${r.forbiddenPresent.map((value) => JSON.stringify(value)).join(', ')})`);
+      } else {
+        lines.push(`❌ ${r.route.padEnd(20)}  HTTP ${r.status}`);
+      }
+    }
+  }
+  lines.push(`\nSummary: ${report.passedCount}/${report.totalRoutes} pages passed against ${report.prodUrl} (verdict: ${report.verdict.toUpperCase()})`);
+  return lines.join('\n');
+}
+
+async function main(argv) {
+  const args = parseArgs(argv);
+  let report;
+  try {
+    report = await runVerification({
+      prodUrl: args.prodUrl,
+      manifestPath: args.manifestPath,
+      timeoutMs: args.timeoutMs,
+    });
+  } catch (error) {
+    process.stderr.write(`verify-marketing-pages-deployed FAILED: ${error.message}\n`);
+    process.exit(2);
+  }
+  if (args.json) {
+    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  } else {
+    process.stdout.write(`${renderHuman(report, { quiet: args.quiet })}\n`);
+  }
+  process.exitCode = report.verdict === 'pass' ? 0 : 1;
+}
+
+module.exports = {
+  DEFAULT_PROD_URL,
+  DEFAULT_TIMEOUT_MS,
+  DEFAULT_MANIFEST_PATH,
+  parseArgs,
+  loadManifest,
+  probePage,
+  runVerification,
+  renderHuman,
+};
+
+if (path.resolve(process.argv[1] || '') === path.resolve(__filename)) {
+  main(process.argv.slice(2));
+}

package/scripts/visitor-journey.js

@@ -0,0 +1,172 @@
+'use strict';
+
+const STAGE_ORDER = [
+  'landing',
+  'pricing',
+  'checkout_viewed',
+  'email_submitted',
+  'stripe_redirect',
+  'purchase',
+];
+
+function parseTimestamp(row) {
+  const raw = row && (row.timestamp || row.receivedAt || row.ts);
+  const ms = raw ? Date.parse(raw) : NaN;
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function pickText(...values) {
+  for (const value of values) {
+    const text = String(value || '').trim();
+    if (text) return text;
+  }
+  return '';
+}
+
+function extractSessionId(row) {
+  return pickText(
+    row.sessionId,
+    row.visitorSessionId,
+    row.visitor_session_id,
+    row.attribution && row.attribution.sessionId,
+    row.metadata && row.metadata.sessionId,
+    row.stripeSessionId,
+    row.traceId,
+    row.acquisitionId,
+  );
+}
+
+function extractVisitorId(row) {
+  return pickText(
+    row.visitorId,
+    row.visitor_id,
+    row.installId,
+    row.attribution && row.attribution.visitorId,
+    row.metadata && row.metadata.visitorId,
+  );
+}
+
+function extractPath(row) {
+  return pickText(
+    row.path,
+    row.page,
+    row.landingPath,
+    row.landing_path,
+    row.attribution && row.attribution.landingPath,
+  );
+}
+
+function classifyStage(row) {
+  const event = String(row.eventType || row.event || '').toLowerCase();
+  const stage = String(row.stage || '').toLowerCase();
+  const path = extractPath(row).toLowerCase();
+  const cta = String(row.ctaId || row.cta_id || '').toLowerCase();
+
+  if (/purchase|paid|checkout\.session\.completed/.test(event) || stage === 'purchase') return 'purchase';
+  if (/stripe_redirect|stripe redirect|redirect started/.test(event) || stage === 'stripe_redirect') return 'stripe_redirect';
+  if (/email_submitted|email submitted|checkout_interstitial_cta_clicked/.test(event)) return 'email_submitted';
+  if (/checkout/.test(path) || /checkout.*view|checkout pro viewed/.test(event)) return 'checkout_viewed';
+  if (/pricing/.test(path) || /pricing/.test(cta) || /pricing_cta/.test(event)) return 'pricing';
+  if (/landing|page_view|landing_page_view|discovery/.test(event) || stage === 'discovery') return 'landing';
+  return null;
+}
+
+function stageRank(stage) {
+  const index = STAGE_ORDER.indexOf(stage);
+  return index === -1 ? -1 : index;
+}
+
+function nextMissingStage(maxStage) {
+  const index = stageRank(maxStage);
+  if (index < 0) return 'unknown';
+  if (maxStage === 'purchase') return 'converted';
+  return STAGE_ORDER[index + 1] || 'unknown';
+}
+
+function buildVisitorJourneySummary({ telemetryRows = [], funnelRows = [], limit = 100 } = {}) {
+  const sessions = new Map();
+  const stageCounts = Object.fromEntries(STAGE_ORDER.map((stage) => [stage, 0]));
+
+  function ingest(row, source) {
+    const ts = parseTimestamp(row);
+    if (ts == null) return;
+    const sessionId = extractSessionId(row) || `anonymous:${extractVisitorId(row) || ts}`;
+    const visitorId = extractVisitorId(row) || null;
+    const stage = classifyStage(row);
+    const path = extractPath(row);
+    const existing = sessions.get(sessionId) || {
+      sessionId,
+      visitorId,
+      firstSeen: new Date(ts).toISOString(),
+      lastSeen: new Date(ts).toISOString(),
+      maxStage: null,
+      dropoffStage: 'unknown',
+      events: [],
+      paths: [],
+      ctas: [],
+      sources: [],
+      visitorType: row.visitorType || null,
+      utm: {},
+      referrerHost: pickText(row.referrerHost, row.referrer_host, row.referrer),
+    };
+
+    existing.visitorId = existing.visitorId || visitorId;
+    existing.firstSeen = new Date(Math.min(Date.parse(existing.firstSeen), ts)).toISOString();
+    existing.lastSeen = new Date(Math.max(Date.parse(existing.lastSeen), ts)).toISOString();
+    existing.sources.push(source);
+    if (stage) {
+      stageCounts[stage] += 1;
+      if (stageRank(stage) > stageRank(existing.maxStage)) existing.maxStage = stage;
+    }
+    if (path && !existing.paths.includes(path)) existing.paths.push(path);
+    const cta = pickText(row.ctaId, row.cta_id);
+    if (cta && !existing.ctas.includes(cta)) existing.ctas.push(cta);
+    for (const key of ['utm_source', 'utm_medium', 'utm_campaign', 'utm_content', 'utm_term']) {
+      const value = pickText(row[key], row.attribution && row.attribution[key]);
+      if (value && !existing.utm[key]) existing.utm[key] = value;
+    }
+    existing.events.push({
+      timestamp: new Date(ts).toISOString(),
+      source,
+      eventType: pickText(row.eventType, row.event, row.stage, 'unknown'),
+      stage,
+      path: path || null,
+      ctaId: cta || null,
+    });
+    sessions.set(sessionId, existing);
+  }
+
+  for (const row of telemetryRows) ingest(row, 'telemetry');
+  for (const row of funnelRows) ingest(row, 'funnel');
+
+  const journeys = [...sessions.values()].map((session) => {
+    session.sources = [...new Set(session.sources)];
+    session.events.sort((a, b) => Date.parse(a.timestamp) - Date.parse(b.timestamp));
+    session.maxStage = session.maxStage || 'unknown';
+    session.dropoffStage = nextMissingStage(session.maxStage);
+    session.eventCount = session.events.length;
+    return session;
+  }).sort((a, b) => Date.parse(b.lastSeen) - Date.parse(a.lastSeen));
+
+  const dropoffCounts = {};
+  for (const journey of journeys) {
+    dropoffCounts[journey.dropoffStage] = (dropoffCounts[journey.dropoffStage] || 0) + 1;
+  }
+
+  return {
+    generatedAt: new Date().toISOString(),
+    sessionCount: journeys.length,
+    stageCounts,
+    dropoffCounts,
+    journeys: journeys.slice(0, Math.max(1, Math.min(Number(limit) || 100, 500))),
+    truncated: journeys.length > Math.max(1, Math.min(Number(limit) || 100, 500)),
+  };
+}
+
+module.exports = {
+  STAGE_ORDER,
+  buildVisitorJourneySummary,
+  classifyStage,
+  extractSessionId,
+  extractVisitorId,
+};

package/.claude-plugin/marketplace.json

@@ -1,85 +0,0 @@
-{
-  "name": "thumbgate-marketplace",
-  "version": "1.27.15",
-  "owner": {
-    "name": "Igor Ganapolsky",
-    "email": "ig5973700@gmail.com"
-  },
-  "plugins": [
-    {
-      "name": "thumbgate",
-      "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-      "longDescription": "ThumbGate is a tripwire, not a memory layer. When you thumbs-down an agent action — a force-push that overwrote a teammate's commit, a destructive SQL drop, a refactor you already rejected — ThumbGate captures the pattern, distills a one-sentence lesson, and installs it as a PreToolUse block. The next time the agent reaches for the same tool call shape, the hook fires before execution and Claude sees your own words back as the reason.\n\nThe enforcement lives in the hook, not in the model's context, so the agent cannot bypass it by forgetting, by being prompted around it, or by switching sessions. Same rule works in Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, and OpenCode.\n\n33 pre-action checks shipped (force-push, destructive SQL, mass-delete, npm publish from wrong branch, deploy without verification). Budget enforcement (action count + time limits) prevents runaway agent sessions. NIST / SOC2 / OWASP / CWE compliance tags on every rule for enterprise teams. DPO training-pair export for teams running their own fine-tunes.\n\nFree tier: 2 feedback captures/day, 10 total captures, 3 active auto-promoted prevention rules, fully offline. Pro ($19/mo): hosted sync across machines and agent runtimes, dashboard, audit export.",
-      "source": {
-        "source": "npm",
-        "package": "thumbgate"
-      },
-      "version": "1.27.15",
-      "author": {
-        "name": "Igor Ganapolsky",
-        "email": "ig5973700@gmail.com",
-        "url": "https://thumbgate.ai"
-      },
-      "homepage": "https://thumbgate.ai",
-      "repository": "https://github.com/IgorGanapolsky/ThumbGate",
-      "license": "MIT",
-      "category": "developer-tools",
-      "tags": [
-        "guardrails",
-        "pretooluse",
-        "hooks",
-        "feedback",
-        "rlhf",
-        "dpo",
-        "agent-safety",
-        "workflow-hardening"
-      ],
-      "keywords": [
-        "guardrails",
-        "pretooluse",
-        "hooks",
-        "feedback",
-        "rlhf",
-        "dpo",
-        "agent-safety",
-        "workflow-hardening",
-        "claude-desktop",
-        "desktop-extension",
-        "pre-action-checks",
-        "ai-agent-safety",
-        "mcp",
-        "memory"
-      ],
-      "capabilities": {
-        "skills": 2,
-        "commands": 5,
-        "agents": 1,
-        "hooks": 3,
-        "mcpServer": "thumbgate serve"
-      },
-      "installCommand": "/plugin install thumbgate@claude-plugins-official",
-      "metadata": {
-        "author": "Igor Ganapolsky",
-        "homepage": "https://thumbgate.ai",
-        "license": "MIT",
-        "keywords": [
-          "guardrails",
-          "pretooluse",
-          "hooks",
-          "feedback",
-          "rlhf",
-          "dpo",
-          "agent-safety",
-          "workflow-hardening",
-          "claude-desktop",
-          "desktop-extension",
-          "pre-action-checks",
-          "ai-agent-safety",
-          "mcp",
-          "memory"
-        ],
-        "category": "developer-tools"
-      }
-    }
-  ]
-}