thumbgate 1.27.19 → 1.28.0

package/scripts/secret-redaction.js

@@ -0,0 +1,166 @@
+'use strict';
+
+/**
+ * secret-redaction.js — the single, canonical secret-redaction helper.
+ *
+ * WHY THIS EXISTS
+ * On 2026-06-10 a live Stripe `sk_live_` key was found in plaintext inside a captured
+ * `.thumbgate/conversation-window.jsonl`. ThumbGate must never become a secret-leak vector:
+ * secrets must be redacted (a) before any conversation/feedback/memory record lands on disk,
+ * and (b) before any training/analytics dataset is exported or shared.
+ *
+ * This module is the ONE place that owns redaction-at-rest. Capture writers and dataset
+ * exporters all call into it instead of each rolling their own. It is intentionally separate
+ * from `secret-scanner.js`: that module is the PreToolUse *scan/block* layer and deliberately
+ * tolerates `sk_test_`/`test_token` inside commands. For data persisted to disk we redact
+ * test-mode secrets too — a `sk_test_` key is still a credential we should not store.
+ *
+ * NOT REDACTED ON PURPOSE
+ *   - Stripe publishable keys (`pk_live_`, `pk_test_`) are public by design. No pattern matches
+ *     them, and the generic `key=value` pattern keys on `api_key|secret|token|...`, never on a
+ *     bare `publishable_key`, so they are preserved verbatim.
+ *
+ * Properties:
+ *   - Idempotent: re-redacting already-redacted text is a no-op (the `[REDACTED:id]` marker
+ *     contains characters outside every value charset).
+ *   - Non-mutating: `redactSecretsDeep` returns a redacted copy; inputs are untouched.
+ */
+
+const REDACTED = (id) => `[REDACTED:${id}]`;
+
+// Identifier names that denote a credential, used by the generic `key = value` pattern. Kept as
+// two small matchers (instead of one mega-alternation) so the assignment regex stays simple.
+const SECRET_KEY_NAME = /(?:api[_-]?key|secret|token|password|passwd|credential|private[_-]?key|access[_-]?token|client[_-]?secret)/i;
+// Public identifiers whose values are not secrets (e.g. Stripe publishable `pk_*` keys). Excluded
+// so `publishable_key = pk_live_…` is preserved verbatim.
+const PUBLIC_KEY_NAME = /publishable|public/i;
+
+/**
+ * Ordered list of redaction patterns. Order matters: the most specific provider patterns run
+ * before the broad `key=value` fallback so a known secret keeps its precise label. Every regex
+ * is `g` (and case-insensitive where appropriate) so all occurrences are replaced.
+ *
+ * `replace` may be a string or a function `(match, ...groups) => string`.
+ */
+const SECRET_REDACTION_PATTERNS = [
+  // PEM / OpenSSH private key blocks — redact the whole block.
+  {
+    id: 'private_key_block',
+    label: 'Private key block',
+    regex: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----[\s\S]+?-----END (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g,
+  },
+
+  // Stripe secret-bearing keys. Publishable keys (pk_*) are intentionally absent.
+  { id: 'stripe_live_secret', label: 'Stripe live secret key', regex: /\bsk_live_[A-Za-z0-9]{8,}/g },
+  { id: 'stripe_test_secret', label: 'Stripe test secret key', regex: /\bsk_test_[A-Za-z0-9]{8,}/g },
+  { id: 'stripe_restricted_live', label: 'Stripe restricted live key', regex: /\brk_live_[A-Za-z0-9]{8,}/g },
+  { id: 'stripe_restricted_test', label: 'Stripe restricted test key', regex: /\brk_test_[A-Za-z0-9]{8,}/g },
+  { id: 'stripe_webhook_secret', label: 'Stripe webhook signing secret', regex: /\bwhsec_[A-Za-z0-9]{8,}/g },
+
+  // Anthropic / OpenAI. Run before the legacy `sk-` pattern so the precise label wins.
+  { id: 'anthropic_api_key', label: 'Anthropic API key', regex: /\bsk-ant-[A-Za-z0-9_-]{16,}/g },
+  { id: 'openai_project_key', label: 'OpenAI project key', regex: /\bsk-proj-[A-Za-z0-9_-]{16,}/g },
+  { id: 'openai_api_key', label: 'OpenAI API key', regex: /\bsk-[A-Za-z0-9]{20,}/g },
+
+  // GitHub tokens.
+  { id: 'github_pat', label: 'GitHub personal access token', regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{16,}/g },
+  { id: 'github_fine_grained_pat', label: 'GitHub fine-grained token', regex: /\bgithub_pat_\w{20,}/g },
+
+  // Slack tokens.
+  { id: 'slack_token', label: 'Slack token', regex: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g },
+
+  // Google API key.
+  { id: 'google_api_key', label: 'Google API key', regex: /\bAIza[0-9A-Za-z_-]{35}/g },
+
+  // AWS access key id (long-lived AKIA + temporary ASIA).
+  { id: 'aws_access_key', label: 'AWS access key id', regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+
+  // JSON Web Tokens.
+  {
+    id: 'jwt',
+    label: 'JSON Web Token',
+    regex: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9._-]{8,}\.[A-Za-z0-9._-]{8,}/g,
+  },
+
+  // `Authorization: Bearer <token>` style. Keep the scheme word, redact the credential.
+  {
+    id: 'bearer_token',
+    label: 'Bearer token',
+    regex: /\b(Bearer|Token)\s+[a-z0-9._~+/=-]{16,}/gi,
+    replace: (_m, scheme) => `${scheme} ${REDACTED('bearer_token')}`,
+  },
+
+  // Generic `<name> = <value>` / `<name>: "<value>"` assignment with a 16+ char whitespace-free
+  // value. A simple matcher finds every assignment; the replace fn redacts only when the name is a
+  // credential (SECRET_KEY_NAME) and not a public identifier (PUBLIC_KEY_NAME), so `publishable_key`
+  // is preserved. Runs last so provider-specific labels are preferred.
+  {
+    id: 'secret_assignment',
+    label: 'Secret assignment',
+    regex: /\b([\w.-]{2,40})(\s*[:=]\s*["']?)([A-Za-z0-9._+=~/-]{16,})(["']?)/g,
+    replace: (match, key, pre, _value, post) =>
+      (SECRET_KEY_NAME.test(key) && !PUBLIC_KEY_NAME.test(key))
+        ? `${key}${pre}${REDACTED('secret_assignment')}${post}`
+        : match,
+  },
+];
+
+/**
+ * Redact secrets from a single string. Returns the input unchanged when it is not a non-empty
+ * string. Each pattern's lastIndex is reset before use so the module-level (stateful, `g`-flag)
+ * regexes are safe to reuse across calls.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+function redactSecrets(text) {
+  if (typeof text !== 'string' || text.length === 0) return text;
+  let out = text;
+  for (const pattern of SECRET_REDACTION_PATTERNS) {
+    pattern.regex.lastIndex = 0;
+    const replacement = pattern.replace || REDACTED(pattern.id);
+    out = out.replace(pattern.regex, replacement);
+  }
+  return out;
+}
+
+/**
+ * Returns true if `text` contains at least one redactable secret.
+ * @param {string} text
+ * @returns {boolean}
+ */
+function containsSecret(text) {
+  if (typeof text !== 'string' || text.length === 0) return false;
+  return SECRET_REDACTION_PATTERNS.some((pattern) => {
+    pattern.regex.lastIndex = 0;
+    return pattern.regex.test(text);
+  });
+}
+
+/**
+ * Recursively redact every string contained in `value`. Objects and arrays are deep-copied so
+ * the input is never mutated; non-string primitives pass through untouched. Object keys are left
+ * as-is (only values are redacted).
+ *
+ * @param {*} value
+ * @returns {*} redacted copy
+ */
+function redactSecretsDeep(value) {
+  if (typeof value === 'string') return redactSecrets(value);
+  if (Array.isArray(value)) return value.map((item) => redactSecretsDeep(item));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+      out[key] = redactSecretsDeep(val);
+    }
+    return out;
+  }
+  return value;
+}
+
+module.exports = {
+  SECRET_REDACTION_PATTERNS,
+  redactSecrets,
+  redactSecretsDeep,
+  containsSecret,
+};

package/scripts/self-harness-optimizer.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+/**
+ * Self-Harness Optimizer
+ * 
+ * Implements the continuous self-improving loop from the "Self-Harness" paradigm (arXiv:2606.09498):
+ * 1. Weakness Mining: Reads auto-promoted gates from repeated failures (.thumbgate/auto-promoted-gates.json)
+ * 2. Harness Proposal: Generates technical rules and injects them directly into system prompts (AGENTS.md & GEMINI.md)
+ * 3. Validation: Runs quick test suites to ensure prompt updates do not introduce regressions.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const ROOT = path.join(__dirname, '..');
+const GATES_PATH = path.join(ROOT, '.thumbgate', 'auto-promoted-gates.json');
+const AGENTS_MD_PATH = path.join(ROOT, 'AGENTS.md');
+const GEMINI_MD_PATH = path.join(ROOT, 'GEMINI.md');
+
+const RULE_SECTION_HEADER = '## 🛡️ Self-Harness Prevention Rules (Auto-Generated)';
+
+function readGates() {
+  if (!fs.existsSync(GATES_PATH)) return [];
+  try {
+    const data = JSON.parse(fs.readFileSync(GATES_PATH, 'utf-8'));
+    return Array.isArray(data.gates) ? data.gates : [];
+  } catch (err) {
+    console.error('Failed to parse auto-promoted-gates.json:', err);
+    return [];
+  }
+}
+
+function generateRuleSection(gates) {
+  if (gates.length === 0) {
+    return `${RULE_SECTION_HEADER}\n\n- No active auto-generated prevention rules at this time.\n`;
+  }
+
+  const lines = [
+    RULE_SECTION_HEADER,
+    '',
+    '> [!IMPORTANT]',
+    '> The following rules were automatically derived from execution failures and thumbs-down feedback.',
+    '> You MUST follow these constraints strictly to prevent repeated errors.',
+    ''
+  ];
+
+  gates.forEach(gate => {
+    // Extract rule message or pattern
+    const ruleText = gate.message ? gate.message.replace('Automatically blocked due to repeated failures: ', '') : `NEVER match pattern: ${gate.pattern}`;
+    lines.push(`- **Rule [${gate.id}]**: ${ruleText}`);
+  });
+
+  lines.push('');
+  return lines.join('\n');
+}
+
+function updatePromptFile(filePath, newSection) {
+  if (!fs.existsSync(filePath)) {
+    console.warn(`Prompt file not found: ${filePath}`);
+    return null;
+  }
+
+  const content = fs.readFileSync(filePath, 'utf-8');
+  const backup = content;
+
+  let newContent;
+  const index = content.indexOf(RULE_SECTION_HEADER);
+  if (index !== -1) {
+    // Replace existing section till the end or next major section
+    const before = content.substring(0, index);
+    const remainder = content.substring(index);
+    
+    // Find next header (e.g. '## ')
+    const nextHeaderIndex = remainder.slice(RULE_SECTION_HEADER.length).search(/\n## /);
+    if (nextHeaderIndex !== -1) {
+      const after = remainder.substring(RULE_SECTION_HEADER.length + nextHeaderIndex + 1);
+      newContent = before + newSection + after;
+    } else {
+      newContent = before + newSection;
+    }
+  } else {
+    // Append to the end of the file
+    newContent = content.trim() + '\n\n' + newSection;
+  }
+
+  fs.writeFileSync(filePath, newContent, 'utf-8');
+  return backup;
+}
+
+function validateAndRollback(backups) {
+  console.log('Running quick validation suite...');
+  try {
+    execSync('npm run verify:quick', { cwd: ROOT, stdio: 'inherit' });
+    console.log('✅ Validation succeeded! No regressions detected.');
+    
+    // Auto-commit prompt updates to git if validation succeeds
+    try {
+      execSync('git add AGENTS.md GEMINI.md', { cwd: ROOT, stdio: 'ignore' });
+      execSync('git commit -m "chore(prompt): auto-update self-harness prevention rules [auto-commit]"', { cwd: ROOT, stdio: 'ignore' });
+      console.log('✅ Prompt updates auto-committed to git.');
+    } catch (gitErr) {
+      console.warn('⚠️ Git commit failed or no changes to commit:', gitErr.message);
+    }
+    
+    return true;
+  } catch (err) {
+    console.error('❌ Validation failed! Reverting prompt changes.');
+    for (const [filePath, backupContent] of Object.entries(backups)) {
+      if (backupContent) {
+        fs.writeFileSync(filePath, backupContent, 'utf-8');
+        console.log(`Reverted: ${path.basename(filePath)}`);
+      }
+    }
+    return false;
+  }
+}
+
+function main() {
+  console.log('Mining weaknesses from auto-promoted gates...');
+  const gates = readGates();
+  console.log(`Found ${gates.length} active gates.`);
+
+  const newSection = generateRuleSection(gates);
+  const backups = {};
+
+  console.log('Updating AGENTS.md...');
+  backups[AGENTS_MD_PATH] = updatePromptFile(AGENTS_MD_PATH, newSection);
+
+  console.log('Updating GEMINI.md...');
+  backups[GEMINI_MD_PATH] = updatePromptFile(GEMINI_MD_PATH, newSection);
+
+  const success = validateAndRollback(backups);
+  if (!success) {
+    process.exit(1);
+  }
+  console.log('Self-Harness optimization complete.');
+}
+
+if (require.main === module) {
+  main();
+}

package/scripts/self-healing-check.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { diagnoseFailure } = require('./failure-diagnostics');
+const { appendDiagnosticRecord } = require('./feedback-loop');
+
+const PROJECT_ROOT = path.join(__dirname, '..');
+const DEFAULT_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
+const DEFAULT_TESTS_TIMEOUT_MS = Number.parseInt(
+  process.env.THUMBGATE_SELF_HEAL_TEST_TIMEOUT_MS || '',
+  10,
+) || 60 * 60_000;
+
+const DEFAULT_CHECKS = [
+  { name: 'budget_status', command: ['npm', 'run', 'budget:status'], timeoutMs: 60_000 },
+  { name: 'tests', command: ['npm', 'test'], timeoutMs: DEFAULT_TESTS_TIMEOUT_MS },
+  { name: 'prove_adapters', command: ['npm', 'run', 'prove:adapters'], timeoutMs: 10 * 60_000, useTempProofDir: true },
+  { name: 'prove_automation', command: ['npm', 'run', 'prove:automation'], timeoutMs: 10 * 60_000, useTempProofDir: true },
+  { name: 'prove_data_pipeline', command: ['npm', 'run', 'prove:data-pipeline'], timeoutMs: 10 * 60_000, useTempProofDir: true },
+  { name: 'prove_tessl', command: ['npm', 'run', 'prove:tessl'], timeoutMs: 10 * 60_000, useTempProofDir: true },
+];
+
+function runCommand(command, {
+  cwd = PROJECT_ROOT,
+  timeoutMs = 5 * 60_000,
+  env = process.env,
+  maxBufferBytes = DEFAULT_MAX_BUFFER_BYTES,
+} = {}) {
+  const [cmd, ...args] = command;
+  const started = Date.now();
+  const result = spawnSync(cmd, args, {
+    cwd,
+    env,
+    encoding: 'utf-8',
+    timeout: timeoutMs,
+    maxBuffer: maxBufferBytes,
+    shell: false,
+  });
+
+  const durationMs = Date.now() - started;
+  const status = Number.isInteger(result.status) ? result.status : 1;
+  return {
+    exitCode: status,
+    durationMs,
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    error: result.error ? result.error.message : null,
+  };
+}
+
+function createCheckEnvironment(check) {
+  const environment = { ...process.env };
+  let cleanup = null;
+
+  if (check.useTempProofDir) {
+    const proofDir = fs.mkdtempSync(path.join(os.tmpdir(), `thumbgate-${check.name}-`));
+    environment.THUMBGATE_PROOF_DIR = proofDir;
+    if (check.name === 'prove_automation') {
+      environment.THUMBGATE_AUTOMATION_PROOF_DIR = proofDir;
+    }
+    cleanup = () => {
+      fs.rmSync(proofDir, { recursive: true, force: true });
+    };
+  }
+
+  return { env: environment, cleanup };
+}
+
+function collectHealthReport({
+  checks = DEFAULT_CHECKS,
+  runner = runCommand,
+  cwd = PROJECT_ROOT,
+  persistDiagnostics = false,
+} = {}) {
+  const startedAt = new Date();
+  const results = checks.map((check) => {
+    const { env, cleanup } = createCheckEnvironment(check);
+    let run;
+    try {
+      run = runner(check.command, { cwd, timeoutMs: check.timeoutMs, env });
+    } finally {
+      if (cleanup) {
+        cleanup();
+      }
+    }
+    const diagnosis = run.exitCode === 0
+      ? null
+      : diagnoseFailure({
+        step: check.name,
+        context: check.command.join(' '),
+        healthCheck: {
+          name: check.name,
+          exitCode: run.exitCode,
+          status: 'unhealthy',
+          outputTail: `${run.stdout}\n${run.stderr}`.trim().slice(-2000),
+        },
+        exitCode: run.exitCode,
+        error: run.error,
+        output: `${run.stdout}\n${run.stderr}`.trim(),
+      });
+    const persistedDiagnosis = persistDiagnostics && diagnosis
+      ? appendDiagnosticRecord({
+        source: 'self_heal_check',
+        step: check.name,
+        context: check.command.join(' '),
+        diagnosis,
+        metadata: {
+          command: check.command.join(' '),
+        },
+      })
+      : null;
+    return {
+      name: check.name,
+      command: check.command.join(' '),
+      status: run.exitCode === 0 ? 'healthy' : 'unhealthy',
+      exitCode: run.exitCode,
+      durationMs: run.durationMs,
+      error: run.error,
+      outputTail: `${run.stdout}\n${run.stderr}`.trim().slice(-2000),
+      diagnosis,
+      persistedDiagnosis,
+    };
+  });
+
+  const healthyCount = results.filter((x) => x.status === 'healthy').length;
+  const unhealthyCount = results.length - healthyCount;
+
+  return {
+    generatedAt: startedAt.toISOString(),
+    durationMs: Date.now() - startedAt.getTime(),
+    overall_status: unhealthyCount === 0 ? 'healthy' : 'unhealthy',
+    summary: {
+      total: results.length,
+      healthy: healthyCount,
+      unhealthy: unhealthyCount,
+    },
+    checks: results,
+  };
+}
+
+function reportToText(report) {
+  const lines = [];
+  lines.push(`Self-Healing Health Check @ ${report.generatedAt}`);
+  lines.push(`Overall: ${report.overall_status.toUpperCase()}`);
+  lines.push(`Checks: ${report.summary.healthy}/${report.summary.total} healthy`);
+  lines.push('');
+
+  report.checks.forEach((check) => {
+    const icon = check.status === 'healthy' ? '✅' : '❌';
+    lines.push(`${icon} ${check.name} (${check.durationMs}ms)`);
+    if (check.status !== 'healthy') {
+      lines.push(`   command: ${check.command}`);
+      if (check.error) lines.push(`   error: ${check.error}`);
+      if (check.diagnosis && check.diagnosis.rootCauseCategory) {
+        lines.push(`   diagnosis: ${check.diagnosis.rootCauseCategory}`);
+      }
+    }
+  });
+
+  return `${lines.join('\n')}\n`;
+}
+
+function runCli() {
+  const args = new Set(process.argv.slice(2));
+  const emitJson = args.has('--json');
+  const noFail = args.has('--no-fail');
+  const report = collectHealthReport({ persistDiagnostics: true });
+
+  if (emitJson) {
+    console.log(JSON.stringify(report, null, 2));
+  } else {
+    process.stdout.write(reportToText(report));
+  }
+
+  if (!noFail && report.overall_status !== 'healthy') {
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  DEFAULT_CHECKS,
+  DEFAULT_TESTS_TIMEOUT_MS,
+  DEFAULT_MAX_BUFFER_BYTES,
+  runCommand,
+  collectHealthReport,
+  reportToText,
+};
+
+if (require.main === module) {
+  runCli();
+}

package/scripts/self-protection.js

@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * self-protection.js — guard the files that configure ThumbGate itself.
+ *
+ * Added 2026-07-08 after Andy Martin's review: in the shipped `gate-check`
+ * path, editing ThumbGate's own hook wiring / gate config was ALLOWED by
+ * default (warn-by-default posture only denies under strict enforcement), so
+ * an agent could disable the firewall before continuing and the surfaced
+ * verdict was a clean ALLOW.
+ *
+ * This module is the single source of truth for "is this edit touching the
+ * firewall's own kill-switches", used by BOTH the shipped `npx thumbgate
+ * gate-check` entrypoint and this repo's dogfood PreToolUse hook.
+ *
+ * Posture threads three constraints:
+ *   * Andy's ask: don't let the agent quietly rewrite/disable the gate.
+ *   * CEO warn-by-default (2026-06-04): never hard-block legitimate work.
+ *   * Self-lockout lesson (2026-07-07): a PreToolUse hook must NEVER deny the
+ *     tools needed to repair its own config, or the agent is bricked.
+ *
+ * Resolution:
+ *   default                         -> WARN (surfaced + logged, never silent)
+ *   THUMBGATE_STRICT_ENFORCEMENT=1  -> BLOCK
+ *   THUMBGATE_ALLOW_SELF_EDIT=1     -> full opt-out (preserves the repair path)
+ */
+
+const SELF_GOVERNANCE_PATH_PATTERNS = [
+  /(?:^|\/)\.claude\/settings(?:\.local)?\.json$/i, // hook wiring / can disable ThumbGate
+  /(?:^|\/)\.codex\/config\.toml$/i,
+  /(?:^|\/)scripts\/hook-[^/]+\.(?:js|sh)$/i, // the hook scripts themselves
+  /(?:^|\/)config\/gates\//i, // gate definitions
+  /(?:^|\/)config\/enforcement\.json$/i, // enforcement policy
+  /(?:^|\/)config\/mcp-allowlists\.json$/i, // MCP policy surface
+];
+
+const EDIT_LIKE_TOOLS = new Set(['Edit', 'Write', 'MultiEdit']);
+
+function isTrueEnv(value) {
+  if (value === undefined || value === null) return false;
+  const v = String(value).trim().toLowerCase();
+  return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+
+/**
+ * Returns the matched governance file path, or null. Accepts both camelCase
+ * (`tool_name`/`tool_input`) and the already-normalized shapes callers use.
+ */
+function selfProtectionTarget(toolName, toolInput) {
+  if (!EDIT_LIKE_TOOLS.has(toolName)) return null;
+  const filePath = String((toolInput && (toolInput.file_path || toolInput.filePath)) || '');
+  if (!filePath) return null;
+  return SELF_GOVERNANCE_PATH_PATTERNS.some((re) => re.test(filePath)) ? filePath : null;
+}
+
+/**
+ * Evaluate the self-protection posture for a tool call.
+ * @returns {{action:'block'|'warn', target:string, message:string}|null}
+ */
+function evaluateSelfProtection(toolName, toolInput, env = process.env) {
+  const target = selfProtectionTarget(toolName, toolInput);
+  if (!target) return null;
+  // Escape hatch: an operator repairing the gate opts out explicitly. Honors the
+  // self-lockout lesson — the repair path is never denied.
+  if (isTrueEnv(env.THUMBGATE_ALLOW_SELF_EDIT)) return null;
+  if (isTrueEnv(env.THUMBGATE_STRICT_ENFORCEMENT)) {
+    return {
+      action: 'block',
+      target,
+      message:
+        `ThumbGate self-protection: blocked ${toolName} to its own governance file "${target}". `
+        + `Editing the firewall's own hook wiring / gate config while strict enforcement is on is denied. `
+        + `Set THUMBGATE_ALLOW_SELF_EDIT=1 to make an intentional repair.`,
+    };
+  }
+  return {
+    action: 'warn',
+    target,
+    message:
+      `⚠️ ThumbGate self-protection: this ${toolName} targets a governance file that configures the firewall itself `
+      + `("${target}"). It is being ALLOWED and LOGGED (warn-by-default). An agent editing this could weaken or disable `
+      + `its own guardrails — confirm this is intentional. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block such edits.`,
+  };
+}
+
+module.exports = {
+  SELF_GOVERNANCE_PATH_PATTERNS,
+  selfProtectionTarget,
+  evaluateSelfProtection,
+};

package/scripts/seo-gsd.js

@@ -562,7 +562,7 @@ const PRETOOLUSE_HOOK_GUIDE_SPEC = Object.freeze({
     ],
     [
       'Does this run locally or call a cloud service?',
-      'Local-first. The PreToolUse decision happens in the hook process on your machine in milliseconds — no network round-trip, no cloud dependency, no data leaving the laptop. Optional hosted sync exists for teams that want to share rules across seats.',
+      'Local-first. The PreToolUse decision happens in the hook process on your machine in milliseconds — no network round-trip, no cloud dependency, no data leaving the laptop. Pro adds personal recall, exports, dashboard proof, and managed adapter coverage. Enterprise adds hosted sharing for teams that want to share rules across seats.',
     ],
   ],
   relatedPaths: ['/guides/mcp-tool-governance', '/guides/ai-agent-pre-action-approval-gates', '/guides/ai-coding-agent-zero-trust'],
@@ -1972,7 +1972,7 @@ const PAGE_BLUEPRINTS = [
     faq: [
       {
         question: 'Why pay $19/mo for ThumbGate Pro when disler hooks are free?',
-        answer: 'Free disler hooks are static patterns you maintain per machine — re-copying them when they change, debugging false positives alone, and re-applying them in every new project. ThumbGate Pro adds the learning loop (thumbs-down → cross-session prevention rule), the dashboard, hosted sync across machines, and adapter maintenance across the weekly breaking-change cycle of Claude Code, Cursor, and Cline. Free disler is the right answer if you only ever work in one project on one machine and never want to learn from past mistakes. Pro is the right answer when those assumptions stop holding.',
+        answer: 'Free disler hooks are static patterns you maintain per machine — re-copying them when they change, debugging false positives alone, and re-applying them in every new project. ThumbGate Pro adds the learning loop (repeated thumbs-downs → cross-session prevention rule), the personal dashboard, lesson recall/search, DPO export, and adapter maintenance across the weekly breaking-change cycle of Claude Code, Cursor, and Cline. Free disler is the right answer if you only ever work in one project on one machine and never want to learn from past mistakes. Pro is the right answer when those assumptions stop holding; Enterprise adds shared hosted lessons across seats.',
       },
       {
         question: 'Is ThumbGate just a packaged version of disler/claude-code-hooks-mastery?',