thumbgate 1.27.19 → 1.28.0

package/scripts/parallel-workflow-orchestrator.js

@@ -0,0 +1,293 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { getFeedbackPaths } = require('./feedback-loop');
+const { ensureDir } = require('./fs-utils');
+const { loadOptionalModule } = require('./private-core-boundary');
+
+const launcher = loadOptionalModule(path.join(__dirname, 'hosted-job-launcher'), () => ({
+  launchManagedJob: () => {
+    throw new Error('Managed jobs require ThumbGate-Core.');
+  },
+  resumeHostedJob: () => {
+    throw new Error('Resuming hosted jobs requires ThumbGate-Core.');
+  },
+}));
+
+const runner = loadOptionalModule(path.join(__dirname, 'async-job-runner'), () => ({
+  readJobState: () => null,
+  listJobStates: () => [],
+}));
+
+const { launchManagedJob, resumeHostedJob } = launcher;
+const { readJobState, listJobStates } = runner;
+
+const DEFAULT_CONCURRENCY = 3;
+const POLL_INTERVAL_MS = 200;
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+/**
+ * Dynamically decompose a high-level objective into parallel, specialized subtasks.
+ * Supports rule-based fallback and can be extended to use LLM planning.
+ */
+function planWorkflow(objective) {
+  const obj = (objective || '').toLowerCase().trim();
+  const subtasks = [];
+
+  if (obj.includes('security') || obj.includes('audit') || obj.includes('leak') || obj.includes('secret')) {
+    subtasks.push({
+      name: 'scan_secrets',
+      tags: ['security', 'secret-scanner'],
+      stages: [
+        {
+          name: 'secret_scan',
+          command: 'node scripts/secret-scanner.js --json || true',
+        }
+      ]
+    });
+    subtasks.push({
+      name: 'audit_dependencies',
+      tags: ['security', 'dependencies'],
+      stages: [
+        {
+          name: 'npm_audit',
+          command: 'npm audit --json || true',
+        }
+      ]
+    });
+    subtasks.push({
+      name: 'check_permissions',
+      tags: ['security', 'credentials'],
+      stages: [
+        {
+          name: 'credential_gate_check',
+          command: 'node scripts/single-use-credential-gate.js plan || true',
+        }
+      ]
+    });
+  } else if (obj.includes('performance') || obj.includes('benchmark') || obj.includes('bench')) {
+    subtasks.push({
+      name: 'benchmark_candidates',
+      tags: ['performance', 'bench'],
+      stages: [
+        {
+          name: 'run_bench',
+          command: 'npx thumbgate bench --json --min-score=90 || true',
+        }
+      ]
+    });
+    subtasks.push({
+      name: 'check_budget',
+      tags: ['performance', 'budget'],
+      stages: [
+        {
+          name: 'budget_status',
+          command: 'node scripts/budget-guard.js --status || true',
+        }
+      ]
+    });
+  } else {
+    // Default general-purpose fallback workflow: code search and check integrity
+    subtasks.push({
+      name: 'code_search',
+      tags: ['exploration'],
+      stages: [
+        {
+          name: 'search_fs',
+          command: 'node scripts/filesystem-search.js --query="pretool" --limit=5 || true',
+        }
+      ]
+    });
+    subtasks.push({
+      name: 'check_integrity',
+      tags: ['integrity'],
+      stages: [
+        {
+          name: 'ops_integrity',
+          command: 'node scripts/operational-integrity.js --ci || true',
+        }
+      ]
+    });
+  }
+
+  return {
+    objective,
+    plannedAt: nowIso(),
+    subtasks: subtasks.map((task, idx) => ({
+      ...task,
+      id: `subtask_${Date.now()}_${idx}_${Math.random().toString(36).slice(2, 6)}`,
+      autoImprove: false,
+      verificationMode: 'none',
+      recordFeedback: false,
+    })),
+  };
+}
+
+/**
+ * Execute a list of planned subtasks in parallel, respecting a concurrency limit.
+ * Polls active jobs until all complete, then consolidates the results.
+ */
+async function executeWorkflow(objective, options = {}) {
+  const plan = planWorkflow(objective);
+  const concurrency = Number(options.concurrency) || DEFAULT_CONCURRENCY;
+  const timeoutMs = Number(options.timeoutMs) || 60000; // 60s timeout safety
+
+  const { FEEDBACK_DIR } = getFeedbackPaths();
+  const workflowId = `wf_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  const workflowDir = path.join(FEEDBACK_DIR, 'workflows', workflowId);
+  ensureDir(workflowDir);
+
+  const activeJobs = new Map();
+  const queue = [...plan.subtasks];
+  const results = [];
+  const start = Date.now();
+
+  const runNext = () => {
+    while (activeJobs.size < concurrency && queue.length > 0) {
+      const task = queue.shift();
+      const launched = launchManagedJob(task, { cwd: options.cwd });
+      activeJobs.set(task.id, {
+        jobId: launched.jobId,
+        taskName: task.name,
+        launchedAt: Date.now(),
+      });
+    }
+  };
+
+  runNext();
+
+  // Polling loop
+  await new Promise((resolve) => {
+    const interval = setInterval(() => {
+      let allDone = true;
+
+      for (const [taskId, info] of activeJobs.entries()) {
+        const jobState = readJobState(info.jobId);
+        if (!jobState) {
+          allDone = false;
+          continue;
+        }
+
+        const isTerminal = ['completed', 'failed', 'cancelled'].includes(jobState.status);
+        if (isTerminal) {
+          results.push({
+            taskId,
+            taskName: info.taskName,
+            jobId: info.jobId,
+            status: jobState.status,
+            context: jobState.currentContext,
+            stageHistory: jobState.stageHistory,
+            lastError: jobState.lastError,
+          });
+          activeJobs.delete(taskId);
+          runNext();
+        } else {
+          allDone = false;
+        }
+      }
+
+      const elapsed = Date.now() - start;
+      if (allDone && queue.length === 0) {
+        clearInterval(interval);
+        resolve();
+      } else if (elapsed >= timeoutMs) {
+        clearInterval(interval);
+        // Timeout remaining active tasks
+        for (const [taskId, info] of activeJobs.entries()) {
+          results.push({
+            taskId,
+            taskName: info.taskName,
+            jobId: info.jobId,
+            status: 'timeout',
+            lastError: { message: `Subtask timed out after ${timeoutMs}ms`, code: 'TIMEOUT' },
+          });
+        }
+        resolve();
+      }
+    }, POLL_INTERVAL_MS);
+  });
+
+  const durationMs = Date.now() - start;
+
+  // Compile final markdown report
+  const reportPath = path.join(workflowDir, 'report.md');
+  const reportContent = compileWorkflowReport(plan, results, durationMs, workflowId);
+  fs.writeFileSync(reportPath, reportContent, 'utf8');
+
+  // Also save the raw execution results JSON
+  const resultsJsonPath = path.join(workflowDir, 'results.json');
+  fs.writeFileSync(resultsJsonPath, JSON.stringify({
+    workflowId,
+    objective,
+    durationMs,
+    plan,
+    results,
+  }, null, 2) + '\n', 'utf8');
+
+  return {
+    workflowId,
+    objective,
+    durationMs,
+    reportPath,
+    results,
+  };
+}
+
+function compileWorkflowReport(plan, results, durationMs, workflowId) {
+  const timestamp = nowIso();
+  const totalSubtasks = plan.subtasks.length;
+  const completed = results.filter((r) => r.status === 'completed').length;
+  const failed = results.filter((r) => r.status === 'failed' || r.status === 'timeout').length;
+
+  let report = `# Dynamic Workflow Execution Report: ${workflowId}\n\n`;
+  report += `**Objective:** ${plan.objective}\n`;
+  report += `**Executed At:** ${timestamp}\n`;
+  report += `**Duration:** ${(durationMs / 1000).toFixed(2)}s\n`;
+  report += `**Status:** ${completed === totalSubtasks ? '✅ SUCCESS' : '⚠️ COMPLETED WITH FAILURES'}\n\n`;
+
+  report += `## Summary\n`;
+  report += `- Total planned subtasks: ${totalSubtasks}\n`;
+  report += `- Completed successfully: ${completed}\n`;
+  report += `- Failed/Timed out: ${failed}\n\n`;
+
+  report += `## Subtask Breakdown\n\n`;
+
+  for (const res of results) {
+    const taskPlan = plan.subtasks.find((t) => t.id === res.taskId) || {};
+    const commandUsed = taskPlan.stages && taskPlan.stages[0] ? taskPlan.stages[0].command : 'N/A';
+    
+    report += `### ✦ Subtask: \`${res.taskName}\`\n`;
+    report += `- **Job ID:** \`${res.jobId}\`\n`;
+    report += `- **Status:** ${res.status === 'completed' ? '✅ COMPLETED' : '❌ ' + res.status.toUpperCase()}\n`;
+    report += `- **Command Run:** \`${commandUsed}\`\n`;
+    
+    if (res.lastError) {
+      report += `- **Error:** \`${res.lastError.message}\` (Code: \`${res.lastError.code}\`)\n`;
+    }
+    
+    if (res.context) {
+      report += `\n**Output Context Preview:**\n\`\`\`json\n`;
+      try {
+        // Try parsing output context as JSON for clean formatting
+        const parsed = JSON.parse(res.context);
+        report += JSON.stringify(parsed, null, 2);
+      } catch {
+        report += res.context.slice(0, 1000) + (res.context.length > 1000 ? '\n... (truncated)' : '');
+      }
+      report += `\n\`\`\`\n`;
+    }
+    report += `\n---\n\n`;
+  }
+
+  return report;
+}
+
+module.exports = {
+  planWorkflow,
+  executeWorkflow,
+  compileWorkflowReport,
+};

package/scripts/plan-gate.js

@@ -0,0 +1,243 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Plan Gate — implementing the CodeRabbit "Planning-First" pattern.
+ *
+ * 1. (Static) Validates structured 'PLAN.md' / 'PRD' content (used in loop-closure).
+ * 2. (Dynamic) Intercepts high-risk tool calls during agent execution.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const RISK_TOOLS = ['Bash', 'Write', 'Edit', 'Deploy'];
+
+// ---------------------------------------------------------------------------
+// Gate validators (Legacy / Loop Closure)
+// ---------------------------------------------------------------------------
+
+function countTableRows(content, sectionHeading) {
+  const sectionRegex = new RegExp(
+    `#+\\s*${sectionHeading}[^\\n]*\\n([\\s\\S]*?)(?=\\n#+\\s|$)`,
+  );
+  const match = content.match(sectionRegex);
+  if (!match) return 0;
+
+  const lines = match[1].split('\n').filter((l) => l.trim().startsWith('|'));
+  // Subtract header row and separator row
+  const dataRows = lines.filter(
+    (l) => !/^\|\s*-+/.test(l.trim()) && !/^\|\s*:?-+/.test(l.trim()),
+  );
+  // First row is the header
+  return Math.max(0, dataRows.length - 1);
+}
+
+function countContracts(content) {
+  const sectionRegex = /#+\s*Contracts[^\n]*\n([\s\S]*?)(?=\n#+\s|$)/;
+  const match = content.match(sectionRegex);
+  if (!match) return 0;
+
+  const section = match[1];
+  // Find code blocks and look for interface/type keywords inside them
+  const codeBlockRegex = /```[\s\S]*?```/g;
+  let count = 0;
+  let blockMatch;
+  while ((blockMatch = codeBlockRegex.exec(section)) !== null) {
+    const block = blockMatch[0];
+    const interfaceMatches = block.match(/\b(interface|type)\s+\w+/g);
+    if (interfaceMatches) count += interfaceMatches.length;
+  }
+  return count;
+}
+
+function countValidationScenarios(content) {
+  const sectionRegex =
+    /#+\s*Validation\s+Checklist[^\n]*\n([\s\S]*?)(?=\n#+\s|$)/;
+  const match = content.match(sectionRegex);
+  if (!match) return 0;
+
+  const lines = match[1].split('\n');
+  return lines.filter((l) => /^\s*-\s*\[\s*\]/.test(l)).length;
+}
+
+function getStatus(content) {
+  const match = content.match(/#+\s*Status[^\n]*\n\s*(\S+)/);
+  return match ? match[1].trim() : null;
+}
+
+function validatePlan(content) {
+  const questionCount = countTableRows(content, 'Clarifying Questions Resolved');
+  const contractCount = countContracts(content);
+  const scenarioCount = countValidationScenarios(content);
+  const status = getStatus(content);
+
+  const gates = [
+    {
+      name: 'Clarifying Questions',
+      pass: questionCount >= 3,
+      detail: `${questionCount} questions resolved`,
+    },
+    {
+      name: 'Contracts Defined',
+      pass: contractCount >= 1,
+      detail: `${contractCount} interface${contractCount !== 1 ? 's' : ''} found`,
+    },
+    {
+      name: 'Validation Checklist',
+      pass: scenarioCount >= 2,
+      detail: `${scenarioCount} scenarios defined`,
+    },
+    {
+      name: 'Status',
+      pass: status !== 'COMPLETE',
+      detail:
+        status === 'COMPLETE'
+          ? 'COMPLETE (already finished — cannot re-approve)'
+          : `${status || 'UNKNOWN'} (not COMPLETE)`,
+    },
+  ];
+
+  const allPass = gates.every((g) => g.pass);
+  return { gates, allPass };
+}
+
+function formatReport(result) {
+  const lines = result.gates.map(
+    (g) => `${g.pass ? '✅' : '❌'} ${g.name}: ${g.detail}`,
+  );
+  lines.push('');
+  lines.push(
+    result.allPass
+      ? 'RESULT: PASS — all gates satisfied'
+      : 'RESULT: BLOCKED — resolve issues above before spawning agents',
+  );
+  return lines.join('\n');
+}
+
+// ---------------------------------------------------------------------------
+// Dynamic Gating (CodeRabbit Orchestration Pattern)
+// ---------------------------------------------------------------------------
+
+/**
+ * Evaluates the planning state for the current tool call.
+ */
+function evaluatePlanGate(toolName, toolInput, options = {}) {
+  if (!RISK_TOOLS.includes(toolName)) return null;
+
+  const projectRoot = options.projectRoot || process.cwd();
+  const planPath = path.join(projectRoot, 'PLAN.md');
+
+  // Tier 1: Existence Check
+  if (!fs.existsSync(planPath)) {
+    return {
+      decision: 'warn',
+      gate: 'plan-gate-missing',
+      message: '⚠️ THUMBGATE: High-risk tool call without a PLAN.md. Please create a plan documenting your intent and assumptions.',
+      severity: 'high'
+    };
+  }
+
+  // Tier 2: Alignment Check (Simple)
+  const planContent = fs.readFileSync(planPath, 'utf8');
+  const action = toolName === 'Bash' ? toolInput.command : toolInput.filePath;
+  
+  if (action && !planContent.toLowerCase().includes(path.basename(action).toLowerCase())) {
+    return {
+      decision: 'warn',
+      gate: 'plan-gate-drift',
+      message: `⚠️ THUMBGATE: Strategic Drift detected. The action "${action}" is not mentioned in your PLAN.md.`,
+      severity: 'medium'
+    };
+  }
+
+  // Tier 3: Implicit Assumption Extraction
+  const assumptions = extractAssumptions(planContent);
+  if (assumptions.length > 0) {
+    return {
+      decision: 'warn',
+      gate: 'plan-gate-assumptions',
+      message: '🔍 THUMBGATE: Explicitly verify these implicit assumptions before proceeding:\n- ' + assumptions.join('\n- '),
+      severity: 'medium'
+    };
+  }
+
+  // Tier 4: Self-Critique / Risk Mitigation Check (Tip #8)
+  const hasCritique = /(?:critique|self-critique|risk|mitigation|alternative|flaw|weakness|pitfall)/i.test(planContent);
+  if (!hasCritique) {
+    return {
+      decision: 'warn',
+      gate: 'plan-gate-critique-missing',
+      message: '🧐 THUMBGATE: No Self-Critique/Risk Analysis detected in your PLAN.md. Please add a "Critique", "Risks", or "Mitigations" section to evaluate potential flaws in this plan before executing high-risk tools.',
+      severity: 'medium'
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Scans plan content for "Assumes" or "Implicit" keywords.
+ */
+function extractAssumptions(content) {
+  const lines = content.split('\n');
+  const assumptions = [];
+  const regex = /(?:assume|assumption|implicit|pre-requisite|depends on)s?[:\-]?\s*(.*)/i;
+  
+  for (const line of lines) {
+    const match = line.match(regex);
+    if (match && match[1].trim()) {
+      assumptions.push(match[1].trim());
+    }
+  }
+  return assumptions.slice(0, 5);
+}
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+function run() {
+  const args = process.argv.slice(2);
+  const jsonFlag = args.includes('--json');
+  const filePath = args.find((a) => a !== '--json');
+
+  if (!filePath) {
+    console.error('Usage: node scripts/plan-gate.js <plan-file.md> [--json]');
+    process.exit(1);
+  }
+
+  const resolved = path.resolve(filePath);
+  if (!fs.existsSync(resolved)) {
+    console.error(`File not found: ${resolved}`);
+    process.exit(1);
+  }
+
+  const content = fs.readFileSync(resolved, 'utf-8');
+  const result = validatePlan(content);
+
+  if (jsonFlag) {
+    console.log(JSON.stringify(result, null, 2));
+  } else {
+    console.log(formatReport(result));
+  }
+
+  process.exit(result.allPass ? 0 : 1);
+}
+
+// Export for testing
+module.exports = {
+  validatePlan,
+  formatReport,
+  countTableRows,
+  countContracts,
+  countValidationScenarios,
+  getStatus,
+  evaluatePlanGate,
+  extractAssumptions,
+};
+
+// Run only when executed directly
+if (require.main === module) {
+  run();
+}

package/scripts/plausible-domain-config.js

@@ -0,0 +1,99 @@
+'use strict';
+
+const PRIMARY_PLAUSIBLE_DOMAIN = 'thumbgate.ai';
+const FALLBACK_REGISTERED_PLAUSIBLE_DOMAIN = 'thumbgate-production.up.railway.app';
+
+function splitDomains(value) {
+  return String(value || '')
+    .split(/[\s,]+/)
+    .map((domain) => domain.trim().toLowerCase())
+    .filter(Boolean);
+}
+
+function normalizeDomain(value) {
+  const input = String(value || '').trim();
+  if (!input) return '';
+  try {
+    return new URL(input.includes('://') ? input : `https://${input}`).hostname.toLowerCase();
+  } catch {
+    const withoutProtocol = input.replace(/^https?:\/\//i, '');
+    const hostnameAndPort = withoutProtocol.split('/')[0];
+    return hostnameAndPort.toLowerCase().split(':')[0];
+  }
+}
+
+function getConfiguredRegisteredDomains(env = process.env) {
+  const configured = [
+    ...splitDomains(env.PLAUSIBLE_SITE_ID),
+    ...splitDomains(env.PLAUSIBLE_SITE_IDS),
+    ...splitDomains(env.THUMBGATE_PLAUSIBLE_REGISTERED_DOMAINS),
+    ...splitDomains(env.PLAUSIBLE_REGISTERED_DOMAINS),
+  ].map(normalizeDomain).filter(Boolean);
+
+  return [...new Set([
+    FALLBACK_REGISTERED_PLAUSIBLE_DOMAIN,
+    ...configured,
+  ])];
+}
+
+function isPlausibleDomainRegistered(domain, env = process.env) {
+  const normalized = normalizeDomain(domain);
+  if (!normalized) return false;
+  return getConfiguredRegisteredDomains(env).includes(normalized);
+}
+
+function resolvePlausibleDataDomain({ host = '', env = process.env } = {}) {
+  const explicit = normalizeDomain(env.THUMBGATE_PLAUSIBLE_DOMAIN);
+  if (explicit) return explicit;
+
+  const normalizedHost = normalizeDomain(host);
+  if (isPlausibleDomainRegistered(normalizedHost, env)) {
+    return normalizedHost;
+  }
+
+  // Prevent local/loopback traffic from mapping to the production Plausible site domain
+  const isLocal = normalizedHost === 'localhost' ||
+                  normalizedHost === '127.0.0.1' ||
+                  normalizedHost === '::1' ||
+                  normalizedHost.endsWith('.local') ||
+                  normalizedHost.startsWith('192.168.') ||
+                  normalizedHost.startsWith('10.');
+  if (isLocal) {
+    return 'localhost';
+  }
+
+  return FALLBACK_REGISTERED_PLAUSIBLE_DOMAIN;
+}
+
+function analyzePlausibleDomainCoverage({
+  emittedDomains = [],
+  registeredDomains = [],
+  primaryDomain = PRIMARY_PLAUSIBLE_DOMAIN,
+} = {}) {
+  const emitted = [...new Set(emittedDomains.map(normalizeDomain).filter(Boolean))];
+  const registered = [...new Set(registeredDomains.map(normalizeDomain).filter(Boolean))];
+  const registeredSet = new Set(registered);
+  const missingEmittedDomains = emitted.filter((domain) => !registeredSet.has(domain));
+  const primaryRegistered = registeredSet.has(normalizeDomain(primaryDomain));
+
+  return {
+    ok: missingEmittedDomains.length === 0 && primaryRegistered,
+    emittedDomains: emitted,
+    registeredDomains: registered,
+    missingEmittedDomains,
+    primaryDomain: normalizeDomain(primaryDomain),
+    primaryRegistered,
+    severity: missingEmittedDomains.length > 0 || !primaryRegistered ? 'critical' : 'ok',
+  };
+}
+
+module.exports = {
+  PRIMARY_PLAUSIBLE_DOMAIN,
+  FALLBACK_REGISTERED_PLAUSIBLE_DOMAIN,
+  splitDomains,
+  normalizeDomain,
+  getConfiguredRegisteredDomains,
+  isPlausibleDomainRegistered,
+  resolvePlausibleDataDomain,
+  analyzePlausibleDomainCoverage,
+};