thumbgate 1.27.20 → 1.28.1

package/scripts/gates-engine.js

@@ -131,28 +131,38 @@ const DOWNLOAD_EXEC_CHAIN_PATTERN = /\b(?:curl|wget)\b[\s\S]{0,400}(?:\|\s*(?:ba
 const DESTRUCTIVE_OR_PRIVILEGE_BOUNDARY_PATTERN = /\b(?:rm\s+-rf|chmod\s+(?:\+x|777)|chown\b|sudo\b|dd\s+if=|mkfs|git\s+reset\s+--hard|git\s+clean\s+-f[a-z]*|kubectl\s+(?:apply|delete)|terraform\s+(?:apply|destroy)|railway\s+(?:deploy|up)|gcloud\s+(?:run\s+deploy|app\s+deploy)|vercel\s+--prod|firebase\s+deploy)\b/i;
 
 // ---------------------------------------------------------------------------
-// Enforcement posture (CEO decision 2026-06-04): warn-by-default.
-// The firewall ALWAYS fires and logs every decision, but most gates WARN rather
-// than hard-block — only TRULY CATASTROPHIC, irreversible actions hard-block:
-//   - secret exfiltration (handled on its own deny path; never downgraded)
-//   - security-vulnerability / supply-chain denies (own deny path; not downgraded)
-//   - irreversibly destructive filesystem commands (rm -rf class, mkfs, dd to disk,
-//     fork bomb) — kept as hard deny via DESTRUCTIVE_FS_PATTERN below.
-// Everything else (memory-high-risk, workflow-sequence, off-scope, git push, deploy,
-// approval gates) downgrades deny/approve -> warn so legitimate work is never blocked.
-// Opt back into full hard enforcement with THUMBGATE_STRICT_ENFORCEMENT=1.
 // Enforcement posture (CEO decision 2026-06-04): WARN + AUDIT by default.
-// The firewall fires and LOGS every decision, but downgrades deny/approve -> warn so
-// legitimate work is never hard-blocked. We deliberately do NOT try to hard-block
-// arbitrary destructive commands here: a regex "catastrophic floor" is unwinnable
-// (sudo / bash -c / find -exec / eval / base64|sh all evade it) and gives false confidence.
-// HARD enforcement is an explicit opt-in via THUMBGATE_STRICT_ENFORCEMENT=1, which keeps
-// the engine's FULL gate set (its high-risk-command gates catch prefixed/obfuscated forms
-// far better than any single regex). Secret exfiltration and the security-vulnerability
-// scan hard-deny on their OWN paths before this runs, so irreversible data-leak / supply
-// chain risks stay blocked regardless of posture.
+// Unconditional floors run before posture conversion: secret exfiltration, deny results
+// from the security scanner, and the four canonical self-protection gates. Arbitrary
+// destructive commands do not get a regex-based "catastrophic" floor; wrappers and
+// obfuscation make that boundary misleading. Every other deny/approve becomes a warning
+// unless the operator explicitly enables THUMBGATE_STRICT_ENFORCEMENT=1.
+const SELF_PROTECT_HARD_FLOOR_GATE_IDS = new Set([
+  'self-protect-config',
+  'self-protect-kill',
+  'self-protect-env-override',
+  'self-protect-hooks-disable',
+]);
+const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
+  'secret-exfiltration',
+  'security-vuln-scan',
+  'slopsquat-guard',
+  ...SELF_PROTECT_HARD_FLOOR_GATE_IDS,
+]);
+const SELF_PROTECT_CONFIG_TARGET_PATTERN = /(?:^|\/)(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json$|\.thumbgate\/config\.json$|thumbgate\.json$)/i;
+const SELF_PROTECT_HOOK_TARGET_PATTERN = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^/]+\.(?:js|sh))$/i;
+const SELF_PROTECT_CONFIG_COMMAND_PATTERN = /(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json\b|\.thumbgate\/config\.json\b|thumbgate\.json\b)/i;
+const SELF_PROTECT_HOOK_COMMAND_PATTERN = /(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^\s'";|]+\.(?:js|sh))\b/i;
+const SHELL_FILE_MUTATION_PATTERN = /\b(?:sed\s+-i|perl\s+-pi|python\d*\s+-c|node\s+-e|ruby\s+-e|tee|truncate|rm|mv|cp|install|patch|jq)\b|(?:^|[\s;&|])>{1,2}\s*\S/i;
+
+function isSelfProtectGate(gateId) {
+  return SELF_PROTECT_HARD_FLOOR_GATE_IDS.has(gateId);
+}
+
 function applyEnforcementPosture(result) {
   if (!result || (result.decision !== 'deny' && result.decision !== 'approve')) return result;
+  // Defensive backstop: hard-floor results must never be posture-downgraded.
+  if (UNCONDITIONAL_HARD_FLOOR_GATE_IDS.has(result.gate)) return result;
   // Full hard enforcement opt-in: keep every deny.
   if (process.env.THUMBGATE_STRICT_ENFORCEMENT === '1') return result;
   // Honor the explicit strict-knowledge-conflict opt-in for that gate.
@@ -163,7 +173,7 @@ function applyEnforcementPosture(result) {
     ...result,
     decision: 'warn',
     warnByDefault: true,
-    message: `${result.message}\n\n⚠️ ThumbGate is in warn-by-default mode — this was flagged and logged, not blocked. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block, or THUMBGATE_HOTFIX_BYPASS=1 to disable checks entirely.`,
+    message: `${result.message}\n\n⚠️ ThumbGate is in warn-by-default mode — this was flagged and logged, not blocked. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block other flagged actions.`,
   };
 }
 const BREAK_GLASS_CONDITION = 'thumbgate_break_glass';
@@ -1698,6 +1708,10 @@ function matchGate(gate, toolName, toolInput = {}) {
   const governanceState = loadGovernanceState();
   const constraints = loadConstraints();
 
+  if (isSelfProtectGate(gate.id) && hasActiveProtectedApproval(governanceState, affectedFiles)) {
+    return { matched: false, matchText, affectedFiles };
+  }
+
   if (gate.id === 'on-demand-freeze-mode' || (gate.when && gate.when.constraints && gate.when.constraints.freeze_mode)) {
     let freezePaths = [];
     if (process.env.THUMBGATE_FREEZE_PATHS) {
@@ -1805,6 +1819,78 @@ function matchesGate(gate, toolName, toolInput) {
   return matchGate(gate, toolName, toolInput).matched;
 }
 
+function hasActiveProtectedApproval(governanceState, affectedFiles) {
+  if (!Array.isArray(affectedFiles) || affectedFiles.length === 0) return false;
+  const approvals = Array.isArray(governanceState && governanceState.protectedApprovals)
+    ? governanceState.protectedApprovals
+    : [];
+  return affectedFiles.every((filePath) => approvals.some((entry) => {
+    return matchesAnyGlob(filePath, sanitizeGlobList(entry && entry.pathGlobs));
+  }));
+}
+
+function matchSelfProtectHardFloor(gate, toolName, toolInput = {}) {
+  const affected = extractAffectedFiles(toolName, toolInput);
+  const affectedFiles = affected.files;
+  if (hasActiveProtectedApproval(loadGovernanceState(), affectedFiles)) return null;
+
+  const command = String(toolInput.command || '');
+  let matchText = command;
+  if (gate.id === 'self-protect-config' || gate.id === 'self-protect-hooks-disable') {
+    const targetPattern = gate.id === 'self-protect-config'
+      ? SELF_PROTECT_CONFIG_TARGET_PATTERN
+      : SELF_PROTECT_HOOK_TARGET_PATTERN;
+    if (EDIT_LIKE_TOOLS.has(toolName)) {
+      matchText = affectedFiles.join(' ');
+      if (!targetPattern.test(matchText)) return null;
+    } else if (toolName === 'Bash') {
+      const commandTargetPattern = gate.id === 'self-protect-config'
+        ? SELF_PROTECT_CONFIG_COMMAND_PATTERN
+        : SELF_PROTECT_HOOK_COMMAND_PATTERN;
+      if (!SHELL_FILE_MUTATION_PATTERN.test(command) || !commandTargetPattern.test(command)) return null;
+    } else {
+      return null;
+    }
+  } else {
+    if (!Array.isArray(gate.toolNames) || !gate.toolNames.includes(toolName)) return null;
+    if (!matchText || !gate.pattern) return null;
+    try {
+      if (!new RegExp(gate.pattern).test(matchText)) return null;
+    } catch {
+      return null;
+    }
+  }
+
+  return {
+    matched: true,
+    matchText,
+    affectedFiles,
+  };
+}
+
+function evaluateSelfProtectHardFloor(input = {}) {
+  const toolName = input.tool_name || input.toolName || '';
+  const toolInput = input.tool_input || input.toolInput || {};
+  const config = loadGatesConfig(DEFAULT_CONFIG_PATH);
+
+  for (const gate of config.gates) {
+    if (!isSelfProtectGate(gate.id)) continue;
+    const matchDetails = matchSelfProtectHardFloor(gate, toolName, toolInput);
+    if (!matchDetails) continue;
+
+    const result = {
+      decision: 'deny',
+      gate: gate.id,
+      message: buildGateMessage(gate, matchDetails),
+      severity: gate.severity,
+      reasoning: buildReasoning(gate, toolName, toolInput, matchDetails),
+    };
+    return recordStructuralGateBlock(toolName, toolInput, result);
+  }
+
+  return null;
+}
+
 function isSafeLocalCredentialHardeningCommand(toolName, toolInput = {}) {
   if (toolName !== 'Bash') return false;
   const command = String(toolInput.command || '').trim();
@@ -2631,6 +2717,26 @@ function evaluateSecretGuard(input = {}) {
   return result;
 }
 
+function evaluateUnconditionalHardFloor(input = {}) {
+  const secretGuard = evaluateSecretGuard(input);
+  if (secretGuard) return { hardFloor: secretGuard, securityScan: null };
+
+  const securityScan = evaluateSecurityScan(input);
+  if (securityScan && securityScan.decision === 'deny') {
+    return { hardFloor: securityScan, securityScan };
+  }
+
+  return {
+    hardFloor: evaluateSelfProtectHardFloor(input),
+    securityScan,
+  };
+}
+
+function runHardFloor(input) {
+  const { hardFloor } = evaluateUnconditionalHardFloor(input);
+  return hardFloor ? formatOutput(hardFloor) : null;
+}
+
 // ---------------------------------------------------------------------------
 function isApprovalGatesEnabled() {
   return process.env.THUMBGATE_APPROVAL_GATES !== '0';
@@ -2672,12 +2778,12 @@ function buildBlockActionProCta() {
     if (totalBlocks < 5) return null; // Too early — let them experience the product
 
     if (totalBlocks < 25) {
-      return '\n\n💡 Pro: keep this rule synced across laptops, CI, containers, and agent runtimes → thumbgate.ai/go/pro';
+      return '\n\n💡 Pro: keep this rule searchable, exportable, and visible → thumbgate.ai/go/pro';
     }
     if (totalBlocks < 100) {
-      return `\n\n💡 ${totalBlocks} actions blocked. Pro keeps these lessons/rules synced everywhere → thumbgate.ai/go/pro ($19/mo)`;
+      return `\n\n💡 ${totalBlocks} actions blocked. Pro adds recall, dashboard proof, and exports → thumbgate.ai/go/pro ($19/mo)`;
     }
-    return `\n\n💡 ${totalBlocks} mistakes caught. Your team could use shared hosted enforcement → thumbgate.ai/go/pro`;
+    return `\n\n💡 ${totalBlocks} mistakes caught. Your team could use Enterprise shared hosted enforcement → thumbgate.ai/go/pro`;
   } catch (_) {
     return null;
   }
@@ -2984,16 +3090,8 @@ function mergeContextStrings(...ctxs) {
 }
 
 async function runAsync(input) {
-  const secretGuard = evaluateSecretGuard(input);
-  if (secretGuard) {
-    return formatOutput(secretGuard);
-  }
-
-  // Security vulnerability scan (Tier 1: pattern match, Tier 2: supply chain)
-  const securityScan = evaluateSecurityScan(input);
-  if (securityScan && securityScan.decision === 'deny') {
-    return formatOutput(securityScan);
-  }
+  const { hardFloor, securityScan } = evaluateUnconditionalHardFloor(input);
+  if (hardFloor) return formatOutput(hardFloor);
 
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
@@ -3031,16 +3129,8 @@ async function runAsync(input) {
 }
 
 function run(input) {
-  const secretGuard = evaluateSecretGuard(input);
-  if (secretGuard) {
-    return formatOutput(secretGuard);
-  }
-
-  // Security vulnerability scan (Tier 1: pattern match, Tier 2: supply chain)
-  const securityScan = evaluateSecurityScan(input);
-  if (securityScan && securityScan.decision === 'deny') {
-    return formatOutput(securityScan);
-  }
+  const { hardFloor, securityScan } = evaluateUnconditionalHardFloor(input);
+  if (hardFloor) return formatOutput(hardFloor);
 
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
@@ -3367,6 +3457,7 @@ module.exports = {
   computeExecutableHash,
   formatOutput,
   isApprovalGatesEnabled,
+  runHardFloor,
   run,
   runAsync,
   trackAction,

package/scripts/hosted-config.js

@@ -13,6 +13,9 @@ const DEFAULT_PRO_PRICE_DOLLARS = PRO_MONTHLY_PRICE_DOLLARS;
 const DEFAULT_PRO_PRICE_LABEL = PRO_PRICE_LABEL;
 const DEFAULT_SPRINT_DIAGNOSTIC_PRICE_DOLLARS = 499;
 const DEFAULT_WORKFLOW_SPRINT_PRICE_DOLLARS = 1500;
+// Keep fallbacks price-aligned. Sprint must NOT share the diagnostic Stripe slug.
+const DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL = 'https://buy.stripe.com/9B69ATbmI4r4aK5eOD3sI3k';
+const DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL = 'https://www.paypal.com/ncp/payment/LTQFR7P9AR3QG';
 const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]+$/i;
 
 function normalizeOrigin(value) {
@@ -127,8 +130,10 @@ function resolveHostedBillingConfig({ requestOrigin } = {}, env = process.env) {
   const gaMeasurementId = normalizeTrackingId(env.THUMBGATE_GA_MEASUREMENT_ID, GA_MEASUREMENT_ID_PATTERN);
   const posthogApiKey = env.POSTHOG_API_KEY || '';
   const googleSiteVerification = normalizeTrackingId(env.THUMBGATE_GOOGLE_SITE_VERIFICATION);
-  const sprintDiagnosticCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_SPRINT_DIAGNOSTIC_CHECKOUT_URL);
-  const workflowSprintCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_WORKFLOW_SPRINT_CHECKOUT_URL);
+  const sprintDiagnosticCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_SPRINT_DIAGNOSTIC_CHECKOUT_URL)
+    || DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL;
+  const workflowSprintCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_WORKFLOW_SPRINT_CHECKOUT_URL)
+    || DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL;
 
   return {
     appOrigin,
@@ -159,6 +164,8 @@ module.exports = {
   DEFAULT_PRO_PRICE_LABEL,
   DEFAULT_SPRINT_DIAGNOSTIC_PRICE_DOLLARS,
   DEFAULT_WORKFLOW_SPRINT_PRICE_DOLLARS,
+  DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL,
+  DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL,
   GA_MEASUREMENT_ID_PATTERN,
   normalizeAbsoluteUrl,
   normalizeOrigin,

package/scripts/imperative-detector.js

@@ -0,0 +1,85 @@
+'use strict';
+
+/**
+ * imperative-detector.js — detect an explicit NEVER / ALWAYS directive in a
+ * feedback message so the CLI can OFFER immediate enforcement (force-gate) when
+ * the user clearly asked for it.
+ *
+ * Why this exists: auto-promotion is deliberately occurrence-gated (a rule
+ * blocks only after a pattern repeats) — that accumulate-evidence-before-you-
+ * enforce default is what makes ThumbGate trustworthy rather than a one-signal
+ * lockout. But when a user types "never do X again", that is an explicit intent
+ * to guard NOW. This module recognizes that intent and lets the CLI SURFACE the
+ * one-shot path (force-gate) as an offer. It never blocks on its own — the user
+ * still confirms. Detecting intent ≠ acting on it.
+ *
+ * Pure and deterministic: no state, no I/O.
+ */
+
+// A leading (or clause-initial) negative imperative → intent to forbid.
+const NEVER_RE = /(?:^|[.;:,]\s*)(never|do\s*not|don'?t|stop\s+\w|must\s*not|no\s+longer|quit\s+\w|avoid\s+\w)/i;
+// A leading (or clause-initial) positive imperative → intent to always do.
+const ALWAYS_RE = /(?:^|[.;:,]\s*)(always|make\s+sure|ensure\s+\w|be\s+sure\s+to)/i;
+
+function firstMeaningfulText(text) {
+  // Strip common feedback prefixes/quote marks so "❯ never …" still matches.
+  return String(text || '').trim().replace(/^[\s>❯"'`*-]+/, '');
+}
+
+/**
+ * @param {string} text
+ * @returns {{isImperative:boolean, polarity:('never'|'always'|null), directive:string}}
+ */
+function detectImperative(text) {
+  const t = firstMeaningfulText(text);
+  if (!t) return { isImperative: false, polarity: null, directive: '' };
+  // Negative wins if both appear — a forbid directive is the actionable one.
+  if (NEVER_RE.test(t)) return { isImperative: true, polarity: 'never', directive: t };
+  if (ALWAYS_RE.test(t)) return { isImperative: true, polarity: 'always', directive: t };
+  return { isImperative: false, polarity: null, directive: '' };
+}
+
+function shellQuote(text) {
+  return String(text).trim().slice(0, 140).replace(/"/g, "'").replace(/\s+/g, ' ');
+}
+
+/**
+ * Build a suggestion for the capture confirmation. Returns null when there's no
+ * explicit directive to act on.
+ * - down + "never …"  → OFFER immediate force-gate (the user asked to forbid it).
+ * - up   + "always …" → clarify it's stored as guidance, not a hard block.
+ * @param {{signal?:string, text?:string}} opts
+ * @returns {{kind:string, message:string}|null}
+ */
+function suggestForceGate({ signal, text } = {}) {
+  const isDown = signal === 'down' || signal === 'negative' || signal === 'thumbs_down';
+  const det = detectImperative(text);
+  if (!det.isImperative) return null;
+
+  if (isDown && det.polarity === 'never') {
+    const ctx = shellQuote(text);
+    return {
+      kind: 'force-gate-offer',
+      message: 'You said "never" — block this immediately instead of waiting for it to recur:\n'
+        + `    npx thumbgate force-gate --context="${ctx}" --action=block\n`
+        + '  (or run /thumbgate-guard). Left alone, it auto-promotes to a gate after the pattern repeats.',
+    };
+  }
+
+  if (!isDown && det.polarity === 'always') {
+    return {
+      kind: 'always-note',
+      message: 'You said "always" — stored as an ALWAYS guidance principle. '
+        + 'It is surfaced as context on future actions (guidance, not a hard block; positive patterns are not gate-enforced).',
+    };
+  }
+
+  return null;
+}
+
+module.exports = {
+  detectImperative,
+  suggestForceGate,
+  NEVER_RE,
+  ALWAYS_RE,
+};

package/scripts/intervention-policy.js

@@ -5,6 +5,7 @@ const fs = require('fs');
 const path = require('path');
 const { resolveFeedbackDir } = require('./feedback-paths');
 const { getDecisionLogPath, readDecisionLog, collapseDecisionTimeline } = require('./decision-journal');
+const { requireLearnedModelsEntitlement } = require('./entitlement');
 
 const LABELS = ['allow', 'recall', 'verify', 'warn', 'deny'];
 const DAY_MS = 24 * 60 * 60 * 1000;
@@ -551,6 +552,10 @@ function summarizeTopTokens(model, limit = 5) {
 }
 
 function trainInterventionPolicy(examples, options = {}) {
+  requireLearnedModelsEntitlement({
+    ...(options.entitlement || {}),
+    label: 'intervention-policy training',
+  });
   const split = splitExamples(examples);
   const evaluationModel = fitNaiveBayes(split.train);
   const deployedModel = fitNaiveBayes(examples);
@@ -631,6 +636,10 @@ function buildRuntimeCandidate(params = {}) {
 }
 
 function getInterventionRecommendation(params = {}, options = {}) {
+  requireLearnedModelsEntitlement({
+    ...(options.entitlement || {}),
+    label: 'intervention-policy recommendation',
+  });
   const resolvedDir = resolveFeedbackDir({ feedbackDir: options.feedbackDir || params.feedbackDir });
   let model = options.model || loadInterventionPolicy(resolvedDir);
   const candidate = options.candidate || buildRuntimeCandidate(params);
@@ -693,6 +702,10 @@ function computeDailySeries(examples, dayCount = 14) {
 }
 
 function getInterventionPolicySummary(feedbackDir, options = {}) {
+  requireLearnedModelsEntitlement({
+    ...(options.entitlement || {}),
+    label: 'intervention-policy summary',
+  });
   const resolvedDir = resolveFeedbackDir({ feedbackDir });
   const { examples, sourceCounts } = buildExamplesFromFeedbackDir(resolvedDir);
   const model = loadInterventionPolicy(resolvedDir) || trainInterventionPolicy(examples);

package/scripts/mailer/resend-mailer.js

@@ -226,12 +226,13 @@ function parseJsonOrNull(bodyText) {
   }
 }
 
-async function postResendEmail({ fetcher, apiKey, payload }) {
+async function postResendEmail({ fetcher, apiKey, payload, idempotencyKey }) {
   const res = await fetcher(RESEND_ENDPOINT, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
       Authorization: `Bearer ${apiKey}`,
+      ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
     },
     body: JSON.stringify(payload),
   });
@@ -256,7 +257,7 @@ function buildSendSuccess({ bodyJson, status, senderFallback }) {
  * Low-level send. Posts to the Resend API or no-ops when RESEND_API_KEY is
  * missing. Never throws on network errors; returns a structured result instead.
  */
-async function sendEmail({ to, subject, html, text, from, replyTo, fetchImpl, dnsResolver } = {}) {
+async function sendEmail({ to, subject, html, text, from, replyTo, idempotencyKey, fetchImpl, dnsResolver } = {}) {
   validateSendEmailInput({ to, subject, html, text });
 
   const apiKey = getApiKey();
@@ -278,7 +279,12 @@ async function sendEmail({ to, subject, html, text, from, replyTo, fetchImpl, dn
   }
 
   try {
-    const { res, bodyText, bodyJson } = await postResendEmail({ fetcher, apiKey, payload });
+    const { res, bodyText, bodyJson } = await postResendEmail({
+      fetcher,
+      apiKey,
+      payload,
+      idempotencyKey: isNonEmptyString(idempotencyKey) ? idempotencyKey.slice(0, 256) : null,
+    });
     if (!res.ok) {
       // eslint-disable-next-line no-console
       console.warn(`[mailer] Resend returned ${res.status}:`, bodyText);
@@ -490,7 +496,7 @@ function renderTrialWelcomeBodies({ licenseKey, customerId, customerName, trialE
  * Never throws on send failures (beyond input validation); the Stripe webhook
  * must keep working even if email breaks.
  */
-async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName, trialEndAt, fetchImpl, dnsResolver } = {}) {
+async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName, trialEndAt, idempotencyKey, fetchImpl, dnsResolver } = {}) {
   if (!isNonEmptyString(to)) throw new Error('sendTrialWelcomeEmail: `to` is required');
   if (!isNonEmptyString(licenseKey)) throw new Error('sendTrialWelcomeEmail: `licenseKey` is required');
 
@@ -500,7 +506,7 @@ async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName,
     ? `${name}, your ThumbGate Pro key is inside`
     : 'Your ThumbGate Pro key is inside';
 
-  return sendEmail({ to, subject, html, text, replyTo: getReplyTo(), fetchImpl, dnsResolver });
+  return sendEmail({ to, subject, html, text, replyTo: getReplyTo(), idempotencyKey, fetchImpl, dnsResolver });
 }
 
 function renderNewsletterWelcomeBodies() {

package/scripts/pr-manager.js

@@ -1,11 +1,4 @@
 #!/usr/bin/env node
-/**
- * PR Manager — High-Throughput Merge & Blocker Diagnosis
- * 
- * Inspired by the 2026 GitHub 'Quick Access' update. Centralizes merge status 
- * detection and triggers autonomous self-healing for common blockers.
- */
-
 'use strict';
 
 const fs = require('node:fs');
@@ -34,6 +27,8 @@ const PASSING_BUCKETS = new Set((MERGE_QUALITY_CHECKS.passingBuckets || []).map(
 const PENDING_BUCKETS = new Set((MERGE_QUALITY_CHECKS.pendingBuckets || []).map((value) => String(value || '').toLowerCase()));
 const FAILING_BUCKETS = new Set((MERGE_QUALITY_CHECKS.failingBuckets || []).map((value) => String(value || '').toLowerCase()));
 
+const SELF_REFERENTIAL_CHECKS = new Set(MERGE_QUALITY_CHECKS.selfReferentialChecks || []);
+
 function assertSafeGhArgs(args) {
   if (!Array.isArray(args) || args.length === 0) {
     throw new Error('GH CLI args must be a non-empty array.');
@@ -119,9 +114,6 @@ function isMissingCurrentBranchPr(result, prNumber) {
     || /could not determine current branch:.*not on any branch/i.test(formatGhError(result));
 }
 
-/**
- * Fetch granular PR status using GH CLI
- */
 function getPrStatus(prNumber = '', runner = runGh) {
   const normalizedPrNumber = normalizePrNumber(prNumber);
   const args = ['pr', 'view'];
@@ -182,6 +174,9 @@ function summarizeChecks(checks = []) {
 
   for (const check of checks) {
     const name = check.name || 'unknown-check';
+
+    if (SELF_REFERENTIAL_CHECKS.has(name)) continue;
+
     const bucket = String(check.bucket || '').toLowerCase();
     if (bucket) {
       if (FAILING_BUCKETS.has(bucket)) {
@@ -225,9 +220,6 @@ function sleep(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
 
-/**
- * Diagnose and resolve blockers autonomously
- */
 async function resolveBlockers(pr, runner = runGh) {
   const title = pr.title || 'Untitled PR';
   const mergeState = pr.mergeStateStatus || 'UNKNOWN';
@@ -241,7 +233,6 @@ async function resolveBlockers(pr, runner = runGh) {
     return { status: 'skipped', reason: 'draft' };
   }
 
-  // 1. Handle Outdated Branch (BEHIND)
   if (pr.mergeStateStatus === 'BEHIND') {
     console.log('[PR Manager] PR is behind main. Triggering auto-update...');
     const update = runner(['pr', 'update-branch', pr.number.toString()]);
@@ -250,13 +241,11 @@ async function resolveBlockers(pr, runner = runGh) {
     }
   }
 
-  // 2. Handle Merge Conflicts (DIRTY)
   if (pr.mergeStateStatus === 'DIRTY' || pr.mergeable === 'CONFLICTING') {
     console.log('[PR Manager] CRITICAL: Merge conflicts detected. Manual intervention or advanced rebase required.');
     return { status: 'blocked', reason: 'conflicts' };
   }
 
-  // 3. Handle CI Failures
   let checks = pr.statusCheckRollup || [];
   let checkSource = 'statusCheckRollup';
 
@@ -282,7 +271,6 @@ async function resolveBlockers(pr, runner = runGh) {
     return { status: 'blocked', reason: 'ci_pending', checks: checkSummary.pending, checkSource };
   }
 
-  // 4. Handle Review Blockers
   if (pr.reviewDecision === 'CHANGES_REQUESTED') {
     console.log('[PR Manager] BLOCKED: Changes requested by reviewer.');
     return { status: 'blocked', reason: 'changes_requested' };
@@ -293,8 +281,10 @@ async function resolveBlockers(pr, runner = runGh) {
     return { status: 'blocked', reason: 'review_required' };
   }
 
-  // 5. Ready to Merge
-  if (pr.mergeStateStatus === 'CLEAN' && pr.mergeable === 'MERGEABLE') {
+  if (
+    (pr.mergeStateStatus === 'CLEAN' || pr.mergeStateStatus === 'UNSTABLE')
+    && pr.mergeable === 'MERGEABLE'
+  ) {
     console.log('[PR Manager] SUCCESS: PR is ready for protected autonomous merge.');
     return { status: 'ready' };
   }
@@ -368,9 +358,6 @@ function submitTrunkMergeRequest(prNumber, runner = runGh) {
   };
 }
 
-/**
- * Perform autonomous merge
- */
 function performMerge(prInput, runner = runGh, options = {}) {
   const pr = (prInput && typeof prInput === 'object')
     ? prInput