thumbgate 1.27.19 → 1.28.0

package/scripts/pr-manager.js

@@ -1,11 +1,4 @@
 #!/usr/bin/env node
-/**
- * PR Manager — High-Throughput Merge & Blocker Diagnosis
- * 
- * Inspired by the 2026 GitHub 'Quick Access' update. Centralizes merge status 
- * detection and triggers autonomous self-healing for common blockers.
- */
-
 'use strict';
 
 const fs = require('node:fs');
@@ -34,6 +27,8 @@ const PASSING_BUCKETS = new Set((MERGE_QUALITY_CHECKS.passingBuckets || []).map(
 const PENDING_BUCKETS = new Set((MERGE_QUALITY_CHECKS.pendingBuckets || []).map((value) => String(value || '').toLowerCase()));
 const FAILING_BUCKETS = new Set((MERGE_QUALITY_CHECKS.failingBuckets || []).map((value) => String(value || '').toLowerCase()));
 
+const SELF_REFERENTIAL_CHECKS = new Set(MERGE_QUALITY_CHECKS.selfReferentialChecks || []);
+
 function assertSafeGhArgs(args) {
   if (!Array.isArray(args) || args.length === 0) {
     throw new Error('GH CLI args must be a non-empty array.');
@@ -119,9 +114,6 @@ function isMissingCurrentBranchPr(result, prNumber) {
     || /could not determine current branch:.*not on any branch/i.test(formatGhError(result));
 }
 
-/**
- * Fetch granular PR status using GH CLI
- */
 function getPrStatus(prNumber = '', runner = runGh) {
   const normalizedPrNumber = normalizePrNumber(prNumber);
   const args = ['pr', 'view'];
@@ -182,6 +174,9 @@ function summarizeChecks(checks = []) {
 
   for (const check of checks) {
     const name = check.name || 'unknown-check';
+
+    if (SELF_REFERENTIAL_CHECKS.has(name)) continue;
+
     const bucket = String(check.bucket || '').toLowerCase();
     if (bucket) {
       if (FAILING_BUCKETS.has(bucket)) {
@@ -225,9 +220,6 @@ function sleep(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
 
-/**
- * Diagnose and resolve blockers autonomously
- */
 async function resolveBlockers(pr, runner = runGh) {
   const title = pr.title || 'Untitled PR';
   const mergeState = pr.mergeStateStatus || 'UNKNOWN';
@@ -241,7 +233,6 @@ async function resolveBlockers(pr, runner = runGh) {
     return { status: 'skipped', reason: 'draft' };
   }
 
-  // 1. Handle Outdated Branch (BEHIND)
   if (pr.mergeStateStatus === 'BEHIND') {
     console.log('[PR Manager] PR is behind main. Triggering auto-update...');
     const update = runner(['pr', 'update-branch', pr.number.toString()]);
@@ -250,13 +241,11 @@ async function resolveBlockers(pr, runner = runGh) {
     }
   }
 
-  // 2. Handle Merge Conflicts (DIRTY)
   if (pr.mergeStateStatus === 'DIRTY' || pr.mergeable === 'CONFLICTING') {
     console.log('[PR Manager] CRITICAL: Merge conflicts detected. Manual intervention or advanced rebase required.');
     return { status: 'blocked', reason: 'conflicts' };
   }
 
-  // 3. Handle CI Failures
   let checks = pr.statusCheckRollup || [];
   let checkSource = 'statusCheckRollup';
 
@@ -282,7 +271,6 @@ async function resolveBlockers(pr, runner = runGh) {
     return { status: 'blocked', reason: 'ci_pending', checks: checkSummary.pending, checkSource };
   }
 
-  // 4. Handle Review Blockers
   if (pr.reviewDecision === 'CHANGES_REQUESTED') {
     console.log('[PR Manager] BLOCKED: Changes requested by reviewer.');
     return { status: 'blocked', reason: 'changes_requested' };
@@ -293,8 +281,10 @@ async function resolveBlockers(pr, runner = runGh) {
     return { status: 'blocked', reason: 'review_required' };
   }
 
-  // 5. Ready to Merge
-  if (pr.mergeStateStatus === 'CLEAN' && pr.mergeable === 'MERGEABLE') {
+  if (
+    (pr.mergeStateStatus === 'CLEAN' || pr.mergeStateStatus === 'UNSTABLE')
+    && pr.mergeable === 'MERGEABLE'
+  ) {
     console.log('[PR Manager] SUCCESS: PR is ready for protected autonomous merge.');
     return { status: 'ready' };
   }
@@ -368,9 +358,6 @@ function submitTrunkMergeRequest(prNumber, runner = runGh) {
   };
 }
 
-/**
- * Perform autonomous merge
- */
 function performMerge(prInput, runner = runGh, options = {}) {
   const pr = (prInput && typeof prInput === 'object')
     ? prInput

package/scripts/pro-local-dashboard.js

@@ -1,10 +1,12 @@
 'use strict';
 
 const fs = require('fs');
+const crypto = require('crypto');
 const os = require('os');
 const path = require('path');
 
 const DEFAULT_PRO_API = 'https://thumbgate-production.up.railway.app';
+const DEFAULT_PRO_ACTIVATION_ALERT_EMAIL = 'igor.ganapolsky@gmail.com';
 const CREATOR_BYPASS_VALUE = process.env.THUMBGATE_DEV_SECRET || '';
 const CREATOR_BYPASS_ENV = 'THUMBGATE_DEV_BYPASS';
 const CREATOR_SYNTHETIC_KEY = process.env.THUMBGATE_DEV_KEY || '';
@@ -55,6 +57,195 @@ function getLicensePath(homeDir = process.env.HOME || process.env.USERPROFILE ||
   return path.join(getLicenseDir(homeDir), 'license.json');
 }
 
+function isTruthyEnv(value) {
+  return /^(1|true|yes|on)$/i.test(String(value || '').trim());
+}
+
+function normalizeText(value) {
+  return String(value || '').trim();
+}
+
+function escapeHtml(value) {
+  return String(value || '')
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+function fingerprintProKey(key) {
+  const normalized = normalizeText(key);
+  if (!normalized) return '';
+  return `sha256:${crypto.createHash('sha256').update(normalized).digest('hex').slice(0, 12)}`;
+}
+
+function resolveProActivationAlertRecipient(env = process.env) {
+  return normalizeText(
+    env.THUMBGATE_PRO_ACTIVATION_ALERT_EMAIL ||
+    env.THUMBGATE_OPERATOR_ALERT_EMAIL ||
+    env.THUMBGATE_SUPPORT_EMAIL ||
+    DEFAULT_PRO_ACTIVATION_ALERT_EMAIL
+  );
+}
+
+function canSendProActivationAlert({ env = process.env, sendEmailImpl } = {}) {
+  if (isTruthyEnv(env.THUMBGATE_DISABLE_PRO_ACTIVATION_ALERTS)) return false;
+  if (!resolveProActivationAlertRecipient(env)) return false;
+  if (sendEmailImpl) return true;
+  return Boolean(normalizeText(env.RESEND_API_KEY || env.THUMBGATE_RESEND_API_KEY));
+}
+
+function renderProActivationAlertBodies({
+  keyFingerprint,
+  source,
+  version,
+  activatedAt,
+  hostname,
+  platform,
+  arch,
+  nodeVersion,
+  customerId,
+  installId,
+  usageCount,
+} = {}) {
+  const occurredAt = activatedAt || new Date().toISOString();
+  const runtimePlatform = platform || process.platform;
+  const runtimeArch = arch || process.arch;
+  const runtimeNode = nodeVersion || process.version;
+  const text = [
+    'ThumbGate Pro activation detected.',
+    '',
+    `Activated at: ${occurredAt}`,
+    `Key fingerprint: ${keyFingerprint || 'unknown'}`,
+    `Source: ${source || 'unknown'}`,
+    `Version: ${version || 'unknown'}`,
+    `Customer ID: ${customerId || 'unknown'}`,
+    `Install ID: ${installId || 'unknown'}`,
+    `Usage count: ${usageCount ?? 'unknown'}`,
+    `Host: ${hostname || 'unknown'}`,
+    `Runtime: ${runtimePlatform}/${runtimeArch} on ${runtimeNode}`,
+    '',
+    'Secret hygiene: this alert intentionally does not include the raw Pro key.',
+  ].join('\n');
+  const html = `<!doctype html>
+<html>
+  <body style="font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Arial,sans-serif;color:#17212b;line-height:1.5;">
+    <h1 style="font-size:20px;margin:0 0 12px;">ThumbGate Pro activation detected</h1>
+    <table role="presentation" cellspacing="0" cellpadding="0" style="border-collapse:collapse;">
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Activated at</td><td style="padding:4px 0;">${escapeHtml(occurredAt)}</td></tr>
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Key fingerprint</td><td style="padding:4px 0;"><code>${escapeHtml(keyFingerprint || 'unknown')}</code></td></tr>
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Source</td><td style="padding:4px 0;">${escapeHtml(source || 'unknown')}</td></tr>
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Version</td><td style="padding:4px 0;">${escapeHtml(version || 'unknown')}</td></tr>
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Customer ID</td><td style="padding:4px 0;">${escapeHtml(customerId || 'unknown')}</td></tr>
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Install ID</td><td style="padding:4px 0;">${escapeHtml(installId || 'unknown')}</td></tr>
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Usage count</td><td style="padding:4px 0;">${escapeHtml(usageCount ?? 'unknown')}</td></tr>
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Host</td><td style="padding:4px 0;">${escapeHtml(hostname || 'unknown')}</td></tr>
+      <tr><td style="padding:4px 14px 4px 0;color:#64748b;">Runtime</td><td style="padding:4px 0;">${escapeHtml(runtimePlatform)}/${escapeHtml(runtimeArch)} on ${escapeHtml(runtimeNode)}</td></tr>
+    </table>
+    <p style="margin-top:16px;color:#64748b;">Secret hygiene: this alert intentionally does not include the raw Pro key.</p>
+  </body>
+</html>`;
+  return { text, html };
+}
+
+async function sendProActivationAlert({
+  key,
+  source = 'unknown',
+  version,
+  customerId,
+  installId,
+  usageCount,
+  env = process.env,
+  sendEmailImpl,
+} = {}) {
+  const keyFingerprint = fingerprintProKey(key);
+  if (!keyFingerprint) return { sent: false, reason: 'missing_key' };
+  if (!canSendProActivationAlert({ env, sendEmailImpl })) {
+    return { sent: false, reason: 'activation_alert_disabled_or_unconfigured' };
+  }
+
+  const to = resolveProActivationAlertRecipient(env);
+  const { html, text } = renderProActivationAlertBodies({
+    keyFingerprint,
+    source,
+    version,
+    customerId,
+    installId,
+    usageCount,
+    activatedAt: new Date().toISOString(),
+    hostname: os.hostname(),
+    platform: process.platform,
+    arch: process.arch,
+    nodeVersion: process.version,
+  });
+  const sender = sendEmailImpl || require('./mailer').sendEmail;
+
+  try {
+    return await sender({
+      to,
+      subject: 'ThumbGate Pro activated',
+      html,
+      text,
+    });
+  } catch (error) {
+    return {
+      sent: false,
+      reason: 'exception',
+      error: error && error.message ? error.message : String(error),
+    };
+  }
+}
+
+async function notifyHostedProActivation({
+  key,
+  source = 'cli_pro_activate',
+  version,
+  apiBaseUrl = process.env.THUMBGATE_API_BASE_URL || DEFAULT_PRO_API,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const normalizedKey = normalizeText(key);
+  if (!normalizedKey) return { notified: false, reason: 'missing_key' };
+  if (typeof fetchImpl !== 'function') return { notified: false, reason: 'no_fetch' };
+
+  const keyFingerprint = fingerprintProKey(normalizedKey);
+  const endpoint = new URL('/v1/billing/pro-activation', apiBaseUrl).toString();
+  try {
+    const response = await fetchImpl(endpoint, {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${normalizedKey}`,
+        'content-type': 'application/json',
+      },
+      body: JSON.stringify({
+        keyFingerprint,
+        source,
+        version: version || null,
+      }),
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      return {
+        notified: false,
+        reason: body && body.detail ? body.detail : `http_${response.status}`,
+        status: response.status,
+      };
+    }
+    return {
+      notified: true,
+      status: response.status,
+      alert: body.alert || null,
+      keyFingerprint: body.keyFingerprint || keyFingerprint,
+    };
+  } catch (error) {
+    return {
+      notified: false,
+      reason: 'exception',
+      error: error && error.message ? error.message : String(error),
+    };
+  }
+}
+
 function readLicense({ homeDir } = {}) {
   try {
     return JSON.parse(fs.readFileSync(getLicensePath(homeDir), 'utf8'));
@@ -162,12 +353,19 @@ module.exports = {
   CREATOR_BYPASS_VALUE,
   CREATOR_SYNTHETIC_KEY,
   DEFAULT_PRO_API,
+  DEFAULT_PRO_ACTIVATION_ALERT_EMAIL,
+  canSendProActivationAlert,
+  fingerprintProKey,
   getLicenseDir,
   getLicensePath,
   hasDevOverride,
   isCreatorDev,
   readLicense,
+  renderProActivationAlertBodies,
+  notifyHostedProActivation,
+  resolveProActivationAlertRecipient,
   saveLicense,
+  sendProActivationAlert,
   resolveProKey,
   validateProKey,
   startLocalProDashboard,

package/scripts/qa-scenario-planner.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('node:fs');
+
+const RUNTIME_PATTERNS = [
+  { pattern: /^public\/.*\.(html|css|js)$/i, surface: 'browser', reason: 'public UI asset changed' },
+  { pattern: /^src\/api\//i, surface: 'api', reason: 'API route or server behavior changed' },
+  { pattern: /^bin\//i, surface: 'cli', reason: 'CLI entrypoint changed' },
+  { pattern: /^scripts\/(dashboard|pro-local-dashboard|.*gate|.*scanner|.*reward|.*routing).*\.js$/i, surface: 'agent-runtime', reason: 'agent runtime or gate behavior changed' },
+  { pattern: /^adapters\//i, surface: 'agent-adapter', reason: 'agent adapter changed' },
+  { pattern: /^plugins\//i, surface: 'plugin', reason: 'plugin install path changed' },
+  { pattern: /^package\.json$/i, surface: 'package', reason: 'package manifest changed' },
+];
+
+const SKIP_PATTERNS = [
+  /^README\.md$/i,
+  /^docs\//i,
+  /^reports\//i,
+  /^proof\//i,
+  /^tests\/.*\.test\.js$/i,
+  /^\.claude\/implementation-notes\//i,
+];
+
+function normalizeFiles(files = []) {
+  return Array.from(new Set(files
+    .map((file) => String(file || '').trim().replace(/^\.?\//, ''))
+    .filter(Boolean)));
+}
+
+function classifyFile(file) {
+  for (const entry of RUNTIME_PATTERNS) {
+    if (entry.pattern.test(file)) return { ...entry, file };
+  }
+  for (const pattern of SKIP_PATTERNS) {
+    if (pattern.test(file)) return { surface: 'skip', reason: 'no runtime impact', file };
+  }
+  return { surface: 'focused', reason: 'unknown runtime impact; run focused checks', file };
+}
+
+function parseChangedFilesFromDiff(diff = '') {
+  const files = [];
+  for (const line of String(diff || '').split('\n')) {
+    const match = line.match(/^diff --git a\/(.+?) b\/(.+)$/);
+    if (match) files.push(match[2]);
+  }
+  return normalizeFiles(files);
+}
+
+function planQaScenario(input = {}) {
+  const files = normalizeFiles(input.files || parseChangedFilesFromDiff(input.diff || ''));
+  const classifications = files.map(classifyFile);
+  const surfaces = Array.from(new Set(classifications.map((entry) => entry.surface)));
+  const runtimeChanges = classifications.filter((entry) => entry.surface !== 'skip');
+  const skipOnly = files.length > 0 && runtimeChanges.length === 0;
+
+  const recommendedRunner = chooseRunner(surfaces, input);
+  const userScenario = buildUserScenario(runtimeChanges, input);
+  return {
+    name: 'thumbgate-user-impact-qa-scenario',
+    status: skipOnly ? 'skip' : 'actionable',
+    files,
+    classifications,
+    recommendedRunner,
+    userScenario,
+    commands: buildCommands(recommendedRunner, runtimeChanges),
+    regressionPolicy: skipOnly
+      ? 'skip durable QA; no runtime-impact files changed'
+      : 'if the QA agent finds a deterministic failure, convert it into a focused regression test before opening a fix PR',
+    transientFailurePolicy: 'doctor the browser/computer-use runner once, retry once, then label as infrastructure-flaky instead of product-regression',
+  };
+}
+
+function chooseRunner(surfaces, input = {}) {
+  if (input.forceComputerUse || surfaces.includes('plugin') || surfaces.includes('agent-adapter')) return 'computer-use-qa';
+  if (surfaces.includes('browser') || surfaces.includes('api')) return 'browser-qa';
+  if (surfaces.includes('cli') || surfaces.includes('agent-runtime') || surfaces.includes('package')) return 'focused-node-qa';
+  if (surfaces.every((surface) => surface === 'skip')) return 'skip';
+  return 'focused-node-qa';
+}
+
+function buildUserScenario(runtimeChanges, input = {}) {
+  if (runtimeChanges.length === 0) return 'No user-impact scenario required; changed files are docs, tests, reports, or proof artifacts only.';
+  const surfaces = Array.from(new Set(runtimeChanges.map((entry) => entry.surface)));
+  if (surfaces.includes('browser') || surfaces.includes('api')) {
+    return 'Open the affected page as a user, perform the primary CTA or dashboard action, verify visible state changes, then check the related API response.';
+  }
+  if (surfaces.includes('plugin') || surfaces.includes('agent-adapter')) {
+    return 'Install or reload the affected agent integration, run one thumbs-up and one thumbs-down capture, then verify the next risky action is gated.';
+  }
+  if (surfaces.includes('cli')) {
+    return 'Run the changed CLI command with --help and one realistic command path, then verify exit code, JSON output, and no stale command copy.';
+  }
+  return input.scenario || 'Run the focused test for the changed runtime surface, then verify the behavior with one realistic operator workflow.';
+}
+
+function buildCommands(runner, runtimeChanges) {
+  if (runner === 'skip') return [];
+  const commands = ['npm test -- --test-concurrency=1'];
+  if (runner === 'browser-qa') commands.push('npx playwright test tests/e2e --project=chromium');
+  if (runner === 'computer-use-qa') commands.push('node scripts/qa-scenario-planner.js --doctor-runner');
+  if (runtimeChanges.some((entry) => entry.surface === 'package')) commands.push('npm pack --dry-run');
+  return commands;
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const args = {};
+  for (const arg of argv) {
+    if (arg === '--json') args.json = true;
+    else if (arg === '--doctor-runner') args.doctorRunner = true;
+    else if (arg.startsWith('--files=')) args.files = arg.slice('--files='.length).split(',');
+    else if (arg.startsWith('--diff-file=')) args.diff = fs.readFileSync(arg.slice('--diff-file='.length), 'utf8');
+    else if (arg.startsWith('--scenario=')) args.scenario = arg.slice('--scenario='.length);
+  }
+  return args;
+}
+
+if (require.main === module) {
+  const args = parseArgs();
+  if (args.doctorRunner) {
+    console.log('QA runner doctor: verify browser/computer-use target, screenshot capture, and network reachability before blaming product code.');
+    process.exit(0);
+  }
+  const report = planQaScenario(args);
+  if (args.json) console.log(JSON.stringify(report, null, 2));
+  else {
+    console.log(`${report.status.toUpperCase()}: ${report.userScenario}`);
+    for (const command of report.commands) console.log(`- ${command}`);
+  }
+}
+
+module.exports = {
+  classifyFile,
+  parseChangedFilesFromDiff,
+  planQaScenario,
+};

package/scripts/repeat-metric.js

@@ -0,0 +1,137 @@
+'use strict';
+
+// ---------------------------------------------------------------------------
+// repeat-metric — first-class "repeat-attempts blocked before execution" metric
+//
+// This module exposes data ThumbGate already collects in gate-stats state. It
+// does NOT write to disk; it is a pure function over gates-engine.loadStats().
+//
+// The headline number is stats.recurringBlocks — incremented by recordStat()
+// in gates-engine.js every time the same gate blocks/warns the same sanitized
+// action fingerprint within one session bucket. That is "a pre-action gate fire
+// that stopped a tool call the agent had already been blocked on", rather than
+// merely "the same noisy gate fired again."
+// ---------------------------------------------------------------------------
+
+const gatesEngine = require('./gates-engine');
+
+/**
+ * Derive a per-gate { firstBlocks, repeatBlocks } split from the raw stats.
+ *
+ * Modern stats record, per session bucket, which sanitized action fingerprints
+ * each gate fired on:
+ *   stats.sessionFiredActions[sessionKey][gateId][fingerprint] === true
+ *
+ * firstBlocks is the count of distinct first action fingerprints. Legacy stats
+ * without fingerprints fall back to the old per-session-gate split.
+ *
+ * total block+warn events come from stats.byGate[id] (blocked + warned), which
+ * recordStat() also maintains. repeatBlocks is clamped to >= 0 to stay robust
+ * against partially-written / legacy state.
+ *
+ * @param {object} stats raw object returned by gates-engine.loadStats()
+ * @returns {Object<string,{firstBlocks:number, repeatBlocks:number}>}
+ */
+function computeByGateSplit(stats) {
+  const byGate = {};
+  const sessionFiredActions = (stats && stats.sessionFiredActions) || {};
+  const sessionFiredGates = (stats && stats.sessionFiredGates) || {};
+  const rawByGate = (stats && stats.byGate) || {};
+
+  // Count distinct action fingerprints each gate fired on => firstBlocks.
+  const firstBlocksByGate = {};
+  const gatesWithActionStats = new Set();
+  for (const sessionKey of Object.keys(sessionFiredActions)) {
+    const fired = sessionFiredActions[sessionKey] || {};
+    for (const gateId of Object.keys(fired)) {
+      const fingerprints = fired[gateId] || {};
+      const count = Object.values(fingerprints).filter(Boolean).length;
+      if (count > 0) {
+        gatesWithActionStats.add(gateId);
+        firstBlocksByGate[gateId] = (firstBlocksByGate[gateId] || 0) + count;
+      }
+    }
+  }
+
+  // Legacy fallback: old stats only tracked gate fired per session bucket.
+  for (const sessionKey of Object.keys(sessionFiredGates)) {
+    const fired = sessionFiredGates[sessionKey] || {};
+    for (const gateId of Object.keys(fired)) {
+      if (fired[gateId] && !gatesWithActionStats.has(gateId)) {
+        firstBlocksByGate[gateId] = (firstBlocksByGate[gateId] || 0) + 1;
+      }
+    }
+  }
+
+  // Union of every gate id we know about from either source.
+  const gateIds = new Set([
+    ...Object.keys(rawByGate),
+    ...Object.keys(firstBlocksByGate),
+    ...Object.keys(sessionFiredActions).flatMap((sessionKey) => Object.keys(sessionFiredActions[sessionKey] || {})),
+  ]);
+
+  for (const gateId of gateIds) {
+    const gateStat = rawByGate[gateId] || {};
+    const totalFires = (gateStat.blocked || 0) + (gateStat.warned || 0);
+    const firstBlocks = firstBlocksByGate[gateId] || 0;
+    // Repeat fires are total fires beyond the first fire per session bucket.
+    const repeatBlocks = Math.max(0, totalFires - firstBlocks);
+    byGate[gateId] = { firstBlocks, repeatBlocks };
+  }
+
+  return byGate;
+}
+
+/**
+ * Compute the repeat-attempts-blocked-before-execution metric.
+ *
+ * Pure read of gates-engine.loadStats(); no disk writes.
+ *
+ * @returns {{
+ *   repeatBlocksBeforeExecution: number,
+ *   recurringBlocks: number,
+ *   totalBlocked: number,
+ *   byGate: Object<string,{firstBlocks:number, repeatBlocks:number}>
+ * }}
+ */
+function computeRepeatMetric() {
+  let stats;
+  try {
+    stats = gatesEngine.loadStats() || {};
+  } catch (_) {
+    stats = {};
+  }
+
+  const recurringBlocks = Number(stats.recurringBlocks || 0);
+  const totalBlocked = Number(stats.blocked || 0);
+
+  return {
+    // Headline: a pre-action block that stopped a tool call the agent had
+    // already been blocked on this session.
+    repeatBlocksBeforeExecution: recurringBlocks,
+    recurringBlocks,
+    totalBlocked,
+    byGate: computeByGateSplit(stats),
+  };
+}
+
+/**
+ * Add a `repeat` sub-key to a gate-stats object WITHOUT mutating the original.
+ *
+ * Takes the object returned by gate-stats.calculateStats() or
+ * dashboard.computeGateStats() and returns a shallow copy with the repeat
+ * metric attached. The caller's file does not need to import any internals.
+ *
+ * @param {object} gateStatsObject
+ * @returns {object} copy of gateStatsObject with `.repeat`
+ */
+function mergeRepeatMetricIntoGateStats(gateStatsObject) {
+  const base = gateStatsObject && typeof gateStatsObject === 'object' ? gateStatsObject : {};
+  return Object.assign({}, base, { repeat: computeRepeatMetric() });
+}
+
+module.exports = {
+  computeRepeatMetric,
+  mergeRepeatMetricIntoGateStats,
+  computeByGateSplit,
+};

package/scripts/risk-scorer.js

@@ -4,6 +4,7 @@
 const fs = require('fs');
 const path = require('path');
 const { resolveFeedbackDir: resolveSharedFeedbackDir } = require('./feedback-paths');
+const { requireLearnedModelsEntitlement } = require('./entitlement');
 
 const PROJECT_ROOT = path.join(__dirname, '..');
 const DEFAULT_FEEDBACK_DIR = resolveSharedFeedbackDir();
@@ -268,6 +269,10 @@ function buildPatternSummary(rows) {
 }
 
 function trainRiskModel(rows, options = {}) {
+  requireLearnedModelsEntitlement({
+    ...(options.entitlement || {}),
+    label: 'risk-scorer AdaBoost training',
+  });
   const registry = buildFeatureRegistry(rows, options);
   const examples = rows.map((row) => ({
     row,
@@ -419,6 +424,7 @@ function trainAndPersistRiskModel(feedbackDir, options = {}) {
 }
 
 function getRiskSummary(feedbackDir) {
+  requireLearnedModelsEntitlement({ label: 'risk-scorer summary' });
   const resolvedDir = resolveFeedbackDir(feedbackDir);
   const rows = readJSONL(sequencePathFor(resolvedDir));
   if (rows.length === 0) return null;

package/scripts/secret-fixture-tokens.js

@@ -0,0 +1,61 @@
+'use strict';
+
+const FIXTURE_TOKENS = {
+  awsAccessKeyId: '__TG_FIXTURE_AWS_ACCESS_KEY_ID__',
+  githubPat: '__TG_FIXTURE_GITHUB_PAT__',
+  openAiLegacyKey: '__TG_FIXTURE_OPENAI_LEGACY_KEY__',
+  openAiProjectKey: '__TG_FIXTURE_OPENAI_PROJECT_KEY__',
+  rsaPrivateKeyHeader: '__TG_FIXTURE_RSA_PRIVATE_KEY_HEADER__',
+  ecPrivateKeyHeader: '__TG_FIXTURE_EC_PRIVATE_KEY_HEADER__',
+  privateKeyHeader: '__TG_FIXTURE_PRIVATE_KEY_HEADER__',
+};
+
+function buildAwsAccessKeyId() {
+  return ['AKIA', 'IOSFODNN7EXAMPLE'].join('');
+}
+
+function buildGitHubPat() {
+  return ['gh', 'p_', 'x'.repeat(36)].join('');
+}
+
+function buildOpenAiLegacyKey() {
+  return ['sk', '-', 'abcdefghijklmnopqrstuvwxyz01234567890'].join('');
+}
+
+function buildOpenAiProjectKey() {
+  return ['sk', '-proj-', 'abcdefghijklmnopqrstuvwxyz01234567890'].join('');
+}
+
+function buildPemHeader(prefix = '') {
+  return ['-----BEGIN ', prefix, 'PRIVATE KEY-----'].join('');
+}
+
+function fixtureReplacements() {
+  return [
+    [FIXTURE_TOKENS.awsAccessKeyId, buildAwsAccessKeyId()],
+    [FIXTURE_TOKENS.githubPat, buildGitHubPat()],
+    [FIXTURE_TOKENS.openAiLegacyKey, buildOpenAiLegacyKey()],
+    [FIXTURE_TOKENS.openAiProjectKey, buildOpenAiProjectKey()],
+    [FIXTURE_TOKENS.rsaPrivateKeyHeader, buildPemHeader('RSA ')],
+    [FIXTURE_TOKENS.ecPrivateKeyHeader, buildPemHeader('EC ')],
+    [FIXTURE_TOKENS.privateKeyHeader, buildPemHeader('')],
+  ];
+}
+
+function expandFixturePlaceholders(value) {
+  let expanded = String(value || '');
+  for (const [token, replacement] of fixtureReplacements()) {
+    expanded = expanded.split(token).join(replacement);
+  }
+  return expanded;
+}
+
+module.exports = {
+  FIXTURE_TOKENS,
+  buildAwsAccessKeyId,
+  buildGitHubPat,
+  buildOpenAiLegacyKey,
+  buildOpenAiProjectKey,
+  buildPemHeader,
+  expandFixturePlaceholders,
+};