thumbgate 1.27.19 → 1.28.0

package/scripts/feedback-aggregate.js

@@ -0,0 +1,281 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const {
+  getFallbackFeedbackDir,
+  getGlobalFeedbackDir,
+  getHomeDir,
+  getLegacyFeedbackDir,
+  getThumbgateFeedbackDir,
+  resolveFeedbackDir,
+  resolveProjectDir,
+} = require('./feedback-paths');
+const { readJsonl } = require('./fs-utils');
+
+const FEEDBACK_LOG = 'feedback-log.jsonl';
+const MEMORY_LOG = 'memory-log.jsonl';
+const STATUSLINE_CACHE = 'statusline_cache.json';
+
+function truthyDisabled(value) {
+  return value === '0' || value === 'false' || value === 'local';
+}
+
+function shouldAggregateFeedback(options = {}) {
+  const env = options.env || process.env;
+  return !truthyDisabled(String(env.THUMBGATE_STATUSLINE_AGGREGATE || env.THUMBGATE_AGGREGATE_FEEDBACK || '1').toLowerCase());
+}
+
+function normalizePath(candidate) {
+  if (!candidate) return null;
+  try {
+    return path.resolve(String(candidate));
+  } catch {
+    return null;
+  }
+}
+
+function uniquePaths(values = []) {
+  const seen = new Set();
+  const out = [];
+  for (const value of values) {
+    const resolved = normalizePath(value);
+    if (!resolved || seen.has(resolved)) continue;
+    seen.add(resolved);
+    out.push(resolved);
+  }
+  return out;
+}
+
+function safeExists(candidate) {
+  try {
+    return Boolean(candidate && fs.existsSync(candidate));
+  } catch {
+    return false;
+  }
+}
+
+function immediateChildDirs(parentDir) {
+  try {
+    return fs.readdirSync(parentDir, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => path.join(parentDir, entry.name));
+  } catch {
+    return [];
+  }
+}
+
+function ancestorProjectFeedbackDirs(projectDir, options = {}) {
+  const home = normalizePath(getHomeDir(options));
+  const start = normalizePath(projectDir);
+  if (!start) return [];
+
+  const dirs = [];
+  let cursor = start;
+  while (cursor && cursor !== path.dirname(cursor)) {
+    dirs.push(
+      path.join(cursor, '.thumbgate'),
+      path.join(cursor, '.thumbgate-compat'),
+      path.join(cursor, '.claude', 'memory', 'feedback')
+    );
+    if (home && cursor === home) break;
+    const next = path.dirname(cursor);
+    if (next === cursor) break;
+    cursor = next;
+  }
+  return dirs;
+}
+
+function listFeedbackStoreDirs(options = {}) {
+  const env = options.env || process.env;
+  const projectDir = resolveProjectDir({ cwd: options.cwd, env, projectDir: options.projectDir });
+  const home = getHomeDir({ env });
+  const homeThumbgate = path.join(home, '.thumbgate');
+  const projectsDir = path.join(homeThumbgate, 'projects');
+  const explicitRoots = String(env.THUMBGATE_AGGREGATE_ROOTS || '')
+    .split(path.delimiter)
+    .map((value) => value.trim())
+    .filter(Boolean);
+  const explicitFeedbackDir = options.feedbackDir || env.THUMBGATE_FEEDBACK_DIR;
+  const normalizedExplicitFeedbackDir = normalizePath(explicitFeedbackDir);
+
+  if (
+    normalizedExplicitFeedbackDir &&
+    normalizedExplicitFeedbackDir.startsWith(normalizePath(os.tmpdir()) + path.sep) &&
+    explicitRoots.length === 0
+  ) {
+    return uniquePaths([explicitFeedbackDir])
+      .filter((dir) => safeExists(path.join(dir, FEEDBACK_LOG)) || safeExists(path.join(dir, MEMORY_LOG)) || safeExists(path.join(dir, STATUSLINE_CACHE)));
+  }
+
+  return uniquePaths([
+    explicitFeedbackDir,
+    resolveFeedbackDir({ projectDir, env }),
+    getThumbgateFeedbackDir({ projectDir, env }),
+    getFallbackFeedbackDir({ projectDir, env }),
+    getLegacyFeedbackDir({ projectDir, env }),
+    getGlobalFeedbackDir({ projectDir, env }),
+    homeThumbgate,
+    ...immediateChildDirs(projectsDir),
+    ...ancestorProjectFeedbackDirs(projectDir, { env }),
+    ...explicitRoots,
+  ]).filter((dir) => safeExists(path.join(dir, FEEDBACK_LOG)) || safeExists(path.join(dir, MEMORY_LOG)) || safeExists(path.join(dir, STATUSLINE_CACHE)));
+}
+
+function normalizeSignal(signal) {
+  const raw = String(signal || '').toLowerCase();
+  if (raw === 'positive' || raw === 'up' || raw === 'thumbs_up') return 'positive';
+  if (raw === 'negative' || raw === 'down' || raw === 'thumbs_down') return 'negative';
+  return raw || null;
+}
+
+function stableEntryKey(entry = {}, source = {}) {
+  const id = entry.id || entry.feedbackId || entry.sourceFeedbackId;
+  if (id) return `id:${id}`;
+  const material = JSON.stringify({
+    sourcePath: source.logPath || '',
+    sourceIndex: Number.isFinite(source.index) ? source.index : -1,
+    entry,
+  });
+  return `sha:${crypto.createHash('sha256').update(material).digest('hex')}`;
+}
+
+function sortByTimestamp(entries) {
+  return entries.sort((a, b) => {
+    const at = a.timestamp ? Date.parse(a.timestamp) : 0;
+    const bt = b.timestamp ? Date.parse(b.timestamp) : 0;
+    return (Number.isFinite(at) ? at : 0) - (Number.isFinite(bt) ? bt : 0);
+  });
+}
+
+function collectAggregateLogEntries(fileName, options = {}) {
+  const stores = listFeedbackStoreDirs(options);
+  const seen = new Set();
+  const entries = [];
+
+  for (const dir of stores) {
+    const logPath = path.join(dir, fileName);
+    if (!safeExists(logPath)) continue;
+    const rows = readJsonl(logPath, { maxLines: 0 }) || [];
+    for (let index = 0; index < rows.length; index += 1) {
+      const rawEntry = rows[index];
+      const entry = { ...rawEntry };
+      if (entry.signal || entry.feedback) entry.signal = normalizeSignal(entry.signal || entry.feedback);
+      const key = stableEntryKey(entry, { logPath, index });
+      if (seen.has(key)) continue;
+      seen.add(key);
+      entries.push({ ...entry, sourceFeedbackDir: dir });
+    }
+  }
+
+  return {
+    entries: sortByTimestamp(entries),
+    stores,
+  };
+}
+
+function summarizeFeedbackEntries(entries) {
+  let totalPositive = 0;
+  let totalNegative = 0;
+  let rubricSamples = 0;
+
+  for (const entry of entries) {
+    if (entry.signal === 'positive') totalPositive += 1;
+    if (entry.signal === 'negative') totalNegative += 1;
+    if (entry.rubric && entry.rubric.weightedScore != null) rubricSamples += 1;
+  }
+
+  return { totalPositive, totalNegative, rubricSamples };
+}
+
+function createRateWindows(total, totalPositive, approvalRate) {
+  return {
+    '7d': { total: 0, positive: 0, rate: 0 },
+    '30d': { total: 0, positive: 0, rate: 0 },
+    lifetime: { total, positive: totalPositive, rate: approvalRate },
+  };
+}
+
+function applyEntryToRateWindow(window, entry) {
+  window.total += 1;
+  if (entry.signal === 'positive') window.positive += 1;
+}
+
+function updateRateWindows(windows, entries, now = Date.now()) {
+  const sevenDays = 7 * 24 * 60 * 60 * 1000;
+  const thirtyDays = 30 * 24 * 60 * 60 * 1000;
+
+  for (const entry of entries) {
+    const ts = entry.timestamp ? Date.parse(entry.timestamp) : Number.NaN;
+    if (!Number.isFinite(ts)) continue;
+    const age = now - ts;
+    if (age <= sevenDays) applyEntryToRateWindow(windows['7d'], entry);
+    if (age <= thirtyDays) applyEntryToRateWindow(windows['30d'], entry);
+  }
+}
+
+function finalizeRateWindows(windows) {
+  for (const key of ['7d', '30d']) {
+    const window = windows[key];
+    window.rate = 0;
+    if (window.total > 0) {
+      window.rate = Math.round((window.positive / window.total) * 1000) / 1000;
+    }
+  }
+}
+
+function trendFromRateWindows(windows) {
+  const hasTrendData = windows['7d'].total > 0 && windows['30d'].total > 0;
+  if (hasTrendData) {
+    if (windows['7d'].rate > windows['30d'].rate + 0.05) return 'improving';
+    if (windows['7d'].rate < windows['30d'].rate - 0.05) return 'degrading';
+  }
+  return 'stable';
+}
+
+function computeAggregateFeedbackStats(options = {}) {
+  const { entries, stores } = collectAggregateLogEntries(FEEDBACK_LOG, options);
+  const memory = collectAggregateLogEntries(MEMORY_LOG, options);
+  const { totalPositive, totalNegative, rubricSamples } = summarizeFeedbackEntries(entries);
+  const total = totalPositive + totalNegative;
+  const approvalRate = total > 0 ? Math.round((totalPositive / total) * 1000) / 1000 : 0;
+  const windows = createRateWindows(total, totalPositive, approvalRate);
+  updateRateWindows(windows, entries);
+  finalizeRateWindows(windows);
+  const trend = trendFromRateWindows(windows);
+
+  return {
+    total,
+    totalPositive,
+    totalNegative,
+    approvalRate,
+    recentRate: windows['7d'].rate || approvalRate,
+    trend,
+    windows,
+    rubric: { samples: rubricSamples || memory.entries.length, blockedPromotions: 0, failingCriteria: {} },
+    aggregate: {
+      enabled: true,
+      stores: stores.length,
+      feedbackLogPaths: stores.map((dir) => path.join(dir, FEEDBACK_LOG)),
+      memoryStores: memory.stores.length,
+    },
+  };
+}
+
+function getAggregateStatuslineCachePath(options = {}) {
+  const env = options.env || process.env;
+  if (env.THUMBGATE_STATUSLINE_CACHE) return path.resolve(env.THUMBGATE_STATUSLINE_CACHE);
+  return path.join(getHomeDir({ env }), '.thumbgate', STATUSLINE_CACHE);
+}
+
+module.exports = {
+  collectAggregateLogEntries,
+  computeAggregateFeedbackStats,
+  getAggregateStatuslineCachePath,
+  listFeedbackStoreDirs,
+  normalizeSignal,
+  shouldAggregateFeedback,
+};

package/scripts/feedback-sanitizer.js

@@ -0,0 +1,105 @@
+'use strict';
+
+const crypto = require('crypto');
+
+const TRANSPORT_KEYS = new Set([
+  'hookeventname',
+  'hook_event_name',
+  'sessionid',
+  'session_id',
+  'transcriptpath',
+  'transcript_path',
+  'timestamp',
+  'createdat',
+  'created_at',
+  'updatedat',
+  'updated_at',
+  'cwd',
+  'pid',
+  'processid',
+  'process_id',
+  'promptid',
+  'prompt_id',
+  'traceid',
+  'trace_id',
+  'requestid',
+  'request_id',
+  'installid',
+  'install_id',
+  'visitorsessionid',
+  'visitor_session_id',
+  'toolinput',
+  'tool_input',
+]);
+
+const TRANSPORT_WORDS = new Set([
+  ...TRANSPORT_KEYS,
+  'hook',
+  'event',
+  'userpromptsubmit',
+  'user_prompt_submit',
+  'pretooluse',
+  'pre_tool_use',
+  'posttooluse',
+  'post_tool_use',
+  'claude',
+  'codex',
+  'projects',
+  'redacted',
+  'tmp',
+  'private',
+  'folders',
+  'json',
+]);
+
+function stripEphemeralText(text) {
+  if (!text || typeof text !== 'string') return '';
+  return String(text)
+    .replace(/["']?(?:hook_?event_?name|session_?id|transcript_?path|timestamp|created_?at|updated_?at|cwd|pid|process_?id|prompt_?id|trace_?id|request_?id|install_?id|visitor_?session_?id)["']?\s*[:=]\s*["']?[^"',}\]\s]+["']?/gi, ' ')
+    .replace(/\/(?:private\/)?tmp\/[^\s"',}\]]+/gi, ' ')
+    .replace(/\/var\/folders\/[^\s"',}\]]+/gi, ' ')
+    .replace(/\/Users\/[^/\s]+\/\.(?:claude|codex|thumbgate)\/[^\s"',}\]]+/gi, ' ')
+    .replace(/\/Users\/[^/\s]+\/\.config\/thumbgate\/[^\s"',}\]]+/gi, ' ')
+    .replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, ' ')
+    .replace(/\b[0-9a-f]{24,}\b/gi, ' ')
+    .replace(/\b\d{4}-\d{2}-\d{2}t\d{2}:\d{2}:\d{2}(?:\.\d+)?z?\b/gi, ' ')
+    .replace(/\b\d{10,13}\b/g, ' ')
+    .replace(/:\d{4,5}\b/g, ':PORT');
+}
+
+function transportWordsOnly(text) {
+  const tokens = String(text || '')
+    .toLowerCase()
+    .replace(/[^a-z0-9_ -]/g, ' ')
+    .split(/\s+/)
+    .filter((token) => token.length >= 3);
+  if (tokens.length === 0) return true;
+  return tokens.every((token) => TRANSPORT_WORDS.has(token));
+}
+
+function sanitizeFeedbackText(text) {
+  const stripped = stripEphemeralText(text)
+    .replace(/\/Users\/[^\s/]+/g, '/Users/redacted')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (transportWordsOnly(stripped)) return '';
+  return stripped;
+}
+
+function actionFingerprint(parts) {
+  const raw = Array.isArray(parts) ? parts.join(' ') : String(parts || '');
+  const stable = sanitizeFeedbackText(raw)
+    .toLowerCase()
+    .replace(/[^a-z0-9._:/ -]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+  if (!stable || transportWordsOnly(stable)) return null;
+  return crypto.createHash('sha256').update(stable).digest('hex').slice(0, 16);
+}
+
+module.exports = {
+  TRANSPORT_WORDS,
+  sanitizeFeedbackText,
+  actionFingerprint,
+  transportWordsOnly,
+};

package/scripts/gates-engine.js

@@ -151,10 +151,22 @@ const DESTRUCTIVE_OR_PRIVILEGE_BOUNDARY_PATTERN = /\b(?:rm\s+-rf|chmod\s+(?:\+x|
 // far better than any single regex). Secret exfiltration and the security-vulnerability
 // scan hard-deny on their OWN paths before this runs, so irreversible data-leak / supply
 // chain risks stay blocked regardless of posture.
+// Self-protective gates guard ThumbGate's own guardrails (kill/env/config/hooks). See the
+// self-protect-binds-regardless-of-posture changeset for the full rationale.
+function isSelfProtectGate(gateId) {
+  return typeof gateId === 'string' && gateId.startsWith('self-protect');
+}
+
 function applyEnforcementPosture(result) {
   if (!result || (result.decision !== 'deny' && result.decision !== 'approve')) return result;
   // Full hard enforcement opt-in: keep every deny.
   if (process.env.THUMBGATE_STRICT_ENFORCEMENT === '1') return result;
+  // Self-protection binds regardless of posture: a warning is worthless once the guardrail is
+  // gone. Owner escape: THUMBGATE_SELF_PROTECT_OVERRIDE=1 (break-glass covers .claude/settings*
+  // but not this surface, so it needs its own escape — self-lockout, 2026-07-07).
+  if (isSelfProtectGate(result.gate) && process.env.THUMBGATE_SELF_PROTECT_OVERRIDE !== '1') {
+    return result;
+  }
   // Honor the explicit strict-knowledge-conflict opt-in for that gate.
   if (process.env.THUMBGATE_STRICT_KNOWLEDGE_CONFLICT === '1' && result.gate === 'knowledge-conflict-gate') return result;
   // Warn-by-default: the gate still fired and is recorded; the action is allowed through
@@ -2672,12 +2684,12 @@ function buildBlockActionProCta() {
     if (totalBlocks < 5) return null; // Too early — let them experience the product
 
     if (totalBlocks < 25) {
-      return '\n\n💡 Pro: keep this rule synced across laptops, CI, containers, and agent runtimes → thumbgate.ai/go/pro';
+      return '\n\n💡 Pro: keep this rule searchable, exportable, and visible → thumbgate.ai/go/pro';
     }
     if (totalBlocks < 100) {
-      return `\n\n💡 ${totalBlocks} actions blocked. Pro keeps these lessons/rules synced everywhere → thumbgate.ai/go/pro ($19/mo)`;
+      return `\n\n💡 ${totalBlocks} actions blocked. Pro adds recall, dashboard proof, and exports → thumbgate.ai/go/pro ($19/mo)`;
     }
-    return `\n\n💡 ${totalBlocks} mistakes caught. Your team could use shared hosted enforcement → thumbgate.ai/go/pro`;
+    return `\n\n💡 ${totalBlocks} mistakes caught. Your team could use Enterprise shared hosted enforcement → thumbgate.ai/go/pro`;
   } catch (_) {
     return null;
   }