thumbgate 1.28.0 → 1.28.1

package/scripts/feedback-sanitizer.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const crypto = require('crypto');
+const crypto = require('node:crypto');
 
 const TRANSPORT_KEYS = new Set([
   'hookeventname',
@@ -52,10 +52,136 @@ const TRANSPORT_WORDS = new Set([
   'json',
 ]);
 
+// Transport keys that distinguish hook/session envelopes from ordinary JSON
+// tool inputs. A JSON object is rejected only when it carries one of these
+// keys; valid inputs such as {"filePath":"AGENTS.md"} must remain searchable.
+const REJECT_SUBSTRINGS = [
+  'session_id',
+  'transcript_path',
+  'prompt_id',
+  'hook_event_name',
+];
+const REJECT_JSON_KEYS = new Set([
+  ...REJECT_SUBSTRINGS,
+  'sessionid',
+  'transcriptpath',
+  'promptid',
+  'hookeventname',
+]);
+
+// A token is treated as a filesystem-path fragment when it contains a path
+// separator, ends in a machine-file extension, or is a bare UUID.
+function isPathToken(token) {
+  if (!token) return false;
+  return (
+    token.includes('/') ||
+    token.includes('\\') ||
+    /\.(?:jsonl|json|log|sqlite|db)$/i.test(token) ||
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(token)
+  );
+}
+
+function parseJsonValue(text) {
+  try {
+    return { ok: true, value: JSON.parse(text) };
+  } catch (error) {
+    if (!(error instanceof SyntaxError)) throw error;
+    return { ok: false, value: null };
+  }
+}
+
+function hasTransportJsonKey(text) {
+  const trimmed = String(text || '').trim();
+  if (!/^[[{]/.test(trimmed)) return false;
+  const parsedResult = parseJsonValue(trimmed);
+  if (!parsedResult.ok) return false;
+  const parsed = parsedResult.value;
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return false;
+  const keys = new Set(Object.keys(parsed).map((key) => key.toLowerCase()));
+  return [...keys].some((key) => REJECT_JSON_KEYS.has(key));
+}
+
+// Positive rejection guard. Returns true when `text` is a transport/metadata
+// blob that must never be stored as a lesson, because it:
+//   (a) is a JSON object carrying a hook/session transport key, OR
+//   (b) contains multiple known transport marker substrings, OR
+//   (c) is dominated by filesystem-path tokens.
+function looksLikeTransportBlob(text) {
+  const trimmed = String(text || '').trim();
+  if (!trimmed) return false;
+
+  if (hasTransportJsonKey(trimmed)) return true;
+
+  // Multiple marker names identify non-JSON transport residue. A human
+  // sentence that merely discusses `session_id` is not itself an envelope.
+  const lower = trimmed.toLowerCase();
+  const markerCount = REJECT_SUBSTRINGS.filter((marker) => lower.includes(marker)).length;
+  if (markerCount >= 2) return true;
+
+  // (b) Dominated by filesystem-path tokens.
+  const tokens = trimmed.split(/\s+/).filter(Boolean);
+  if (tokens.length > 0) {
+    const pathTokens = tokens.filter(isPathToken);
+    if (pathTokens.length > 0 && pathTokens.length / tokens.length > 0.5) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+function firstStringField(record, names) {
+  for (const name of names) {
+    if (typeof record[name] === 'string' && record[name].trim()) return record[name].trim();
+    if (typeof record[name] === 'number' && Number.isFinite(record[name])) return String(record[name]);
+  }
+  return null;
+}
+
+/**
+ * Extract the human prompt plus the minimum source metadata needed to identify
+ * one hook event. Transcript paths and raw identifiers never enter lesson text;
+ * callers hash the source fields before persistence.
+ */
+function extractPromptEnvelope(rawStdin) {
+  const raw = typeof rawStdin === 'string' ? rawStdin : '';
+  const trimmed = raw.trim();
+  if (!trimmed) return { prompt: '' };
+
+  if (/^[[{]/.test(trimmed)) {
+    const parsedResult = parseJsonValue(trimmed);
+    if (!parsedResult.ok) return { prompt: trimmed };
+    const parsed = parsedResult.value;
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      return {
+        prompt: typeof parsed.prompt === 'string' ? parsed.prompt.trim() : '',
+        sessionId: firstStringField(parsed, ['session_id', 'sessionId']),
+        promptId: firstStringField(parsed, ['prompt_id', 'promptId']),
+        projectDir: firstStringField(parsed, ['cwd', 'project', 'project_dir', 'projectDir']),
+        timestamp: firstStringField(parsed, ['timestamp', 'created_at', 'createdAt']),
+        hookEventName: firstStringField(parsed, ['hook_event_name', 'hookEventName']),
+      };
+    }
+    return { prompt: '' };
+  }
+
+  return { prompt: trimmed };
+}
+
+// Persist ONLY the human `.prompt` field from a hook transport envelope.
+function extractPromptText(rawStdin) {
+  return extractPromptEnvelope(rawStdin).prompt;
+}
+
 function stripEphemeralText(text) {
   if (!text || typeof text !== 'string') return '';
-  return String(text)
-    .replace(/["']?(?:hook_?event_?name|session_?id|transcript_?path|timestamp|created_?at|updated_?at|cwd|pid|process_?id|prompt_?id|trace_?id|request_?id|install_?id|visitor_?session_?id)["']?\s*[:=]\s*["']?[^"',}\]\s]+["']?/gi, ' ')
+  let stripped = String(text);
+  for (const key of TRANSPORT_KEYS) {
+    const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+    const assignment = new RegExp(String.raw`["']?${escapedKey}["']?\s*[:=]\s*["']?[^"',}\]\s]+["']?`, 'gi');
+    stripped = stripped.replace(assignment, ' ');
+  }
+  return stripped
     .replace(/\/(?:private\/)?tmp\/[^\s"',}\]]+/gi, ' ')
     .replace(/\/var\/folders\/[^\s"',}\]]+/gi, ' ')
     .replace(/\/Users\/[^/\s]+\/\.(?:claude|codex|thumbgate)\/[^\s"',}\]]+/gi, ' ')
@@ -68,6 +194,10 @@ function stripEphemeralText(text) {
 }
 
 function transportWordsOnly(text) {
+  // Positive rejection first: JSON payloads, transport markers, and
+  // path-dominated blobs are always "transport only" regardless of the
+  // incidental non-transport words they contain.
+  if (looksLikeTransportBlob(text)) return true;
   const tokens = String(text || '')
     .toLowerCase()
     .replace(/[^a-z0-9_ -]/g, ' ')
@@ -78,6 +208,20 @@ function transportWordsOnly(text) {
 }
 
 function sanitizeFeedbackText(text) {
+  const raw = String(text || '').trim();
+  // A raw hook-stdin PAYLOAD — a pure JSON object carrying transport markers
+  // (session_id / transcript_path / prompt_id / hook_event_name) — is never a
+  // human lesson; reject it whole, even when it also carries a `prompt` field
+  // (that field is pulled out separately via extractPromptText). But do NOT
+  // reject content JSON that carries no transport markers (e.g. a tool input
+  // {"filePath":"…","reason":"…"}): it must survive so it can be matched against
+  // patterns. The discriminator is the marker, not JSON-ness.
+  if (hasTransportJsonKey(raw)) return '';
+  // Otherwise scrub ephemeral marker key:value pairs and volatile paths, then
+  // reject only if nothing substantive remains — so real feedback that arrives
+  // next to hook metadata keeps the sentence while the metadata is stripped, and
+  // space-separated marker residue / path-dominated blobs collapse to
+  // transport-only text and are dropped by transportWordsOnly().
   const stripped = stripEphemeralText(text)
     .replace(/\/Users\/[^\s/]+/g, '/Users/redacted')
     .replace(/\s+/g, ' ')
@@ -99,7 +243,11 @@ function actionFingerprint(parts) {
 
 module.exports = {
   TRANSPORT_WORDS,
+  REJECT_SUBSTRINGS,
   sanitizeFeedbackText,
   actionFingerprint,
   transportWordsOnly,
+  looksLikeTransportBlob,
+  extractPromptEnvelope,
+  extractPromptText,
 };

package/scripts/gates-engine.js

@@ -131,42 +131,40 @@ const DOWNLOAD_EXEC_CHAIN_PATTERN = /\b(?:curl|wget)\b[\s\S]{0,400}(?:\|\s*(?:ba
 const DESTRUCTIVE_OR_PRIVILEGE_BOUNDARY_PATTERN = /\b(?:rm\s+-rf|chmod\s+(?:\+x|777)|chown\b|sudo\b|dd\s+if=|mkfs|git\s+reset\s+--hard|git\s+clean\s+-f[a-z]*|kubectl\s+(?:apply|delete)|terraform\s+(?:apply|destroy)|railway\s+(?:deploy|up)|gcloud\s+(?:run\s+deploy|app\s+deploy)|vercel\s+--prod|firebase\s+deploy)\b/i;
 
 // ---------------------------------------------------------------------------
-// Enforcement posture (CEO decision 2026-06-04): warn-by-default.
-// The firewall ALWAYS fires and logs every decision, but most gates WARN rather
-// than hard-block — only TRULY CATASTROPHIC, irreversible actions hard-block:
-//   - secret exfiltration (handled on its own deny path; never downgraded)
-//   - security-vulnerability / supply-chain denies (own deny path; not downgraded)
-//   - irreversibly destructive filesystem commands (rm -rf class, mkfs, dd to disk,
-//     fork bomb) — kept as hard deny via DESTRUCTIVE_FS_PATTERN below.
-// Everything else (memory-high-risk, workflow-sequence, off-scope, git push, deploy,
-// approval gates) downgrades deny/approve -> warn so legitimate work is never blocked.
-// Opt back into full hard enforcement with THUMBGATE_STRICT_ENFORCEMENT=1.
 // Enforcement posture (CEO decision 2026-06-04): WARN + AUDIT by default.
-// The firewall fires and LOGS every decision, but downgrades deny/approve -> warn so
-// legitimate work is never hard-blocked. We deliberately do NOT try to hard-block
-// arbitrary destructive commands here: a regex "catastrophic floor" is unwinnable
-// (sudo / bash -c / find -exec / eval / base64|sh all evade it) and gives false confidence.
-// HARD enforcement is an explicit opt-in via THUMBGATE_STRICT_ENFORCEMENT=1, which keeps
-// the engine's FULL gate set (its high-risk-command gates catch prefixed/obfuscated forms
-// far better than any single regex). Secret exfiltration and the security-vulnerability
-// scan hard-deny on their OWN paths before this runs, so irreversible data-leak / supply
-// chain risks stay blocked regardless of posture.
-// Self-protective gates guard ThumbGate's own guardrails (kill/env/config/hooks). See the
-// self-protect-binds-regardless-of-posture changeset for the full rationale.
+// Unconditional floors run before posture conversion: secret exfiltration, deny results
+// from the security scanner, and the four canonical self-protection gates. Arbitrary
+// destructive commands do not get a regex-based "catastrophic" floor; wrappers and
+// obfuscation make that boundary misleading. Every other deny/approve becomes a warning
+// unless the operator explicitly enables THUMBGATE_STRICT_ENFORCEMENT=1.
+const SELF_PROTECT_HARD_FLOOR_GATE_IDS = new Set([
+  'self-protect-config',
+  'self-protect-kill',
+  'self-protect-env-override',
+  'self-protect-hooks-disable',
+]);
+const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
+  'secret-exfiltration',
+  'security-vuln-scan',
+  'slopsquat-guard',
+  ...SELF_PROTECT_HARD_FLOOR_GATE_IDS,
+]);
+const SELF_PROTECT_CONFIG_TARGET_PATTERN = /(?:^|\/)(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json$|\.thumbgate\/config\.json$|thumbgate\.json$)/i;
+const SELF_PROTECT_HOOK_TARGET_PATTERN = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^/]+\.(?:js|sh))$/i;
+const SELF_PROTECT_CONFIG_COMMAND_PATTERN = /(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json\b|\.thumbgate\/config\.json\b|thumbgate\.json\b)/i;
+const SELF_PROTECT_HOOK_COMMAND_PATTERN = /(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^\s'";|]+\.(?:js|sh))\b/i;
+const SHELL_FILE_MUTATION_PATTERN = /\b(?:sed\s+-i|perl\s+-pi|python\d*\s+-c|node\s+-e|ruby\s+-e|tee|truncate|rm|mv|cp|install|patch|jq)\b|(?:^|[\s;&|])>{1,2}\s*\S/i;
+
 function isSelfProtectGate(gateId) {
-  return typeof gateId === 'string' && gateId.startsWith('self-protect');
+  return SELF_PROTECT_HARD_FLOOR_GATE_IDS.has(gateId);
 }
 
 function applyEnforcementPosture(result) {
   if (!result || (result.decision !== 'deny' && result.decision !== 'approve')) return result;
+  // Defensive backstop: hard-floor results must never be posture-downgraded.
+  if (UNCONDITIONAL_HARD_FLOOR_GATE_IDS.has(result.gate)) return result;
   // Full hard enforcement opt-in: keep every deny.
   if (process.env.THUMBGATE_STRICT_ENFORCEMENT === '1') return result;
-  // Self-protection binds regardless of posture: a warning is worthless once the guardrail is
-  // gone. Owner escape: THUMBGATE_SELF_PROTECT_OVERRIDE=1 (break-glass covers .claude/settings*
-  // but not this surface, so it needs its own escape — self-lockout, 2026-07-07).
-  if (isSelfProtectGate(result.gate) && process.env.THUMBGATE_SELF_PROTECT_OVERRIDE !== '1') {
-    return result;
-  }
   // Honor the explicit strict-knowledge-conflict opt-in for that gate.
   if (process.env.THUMBGATE_STRICT_KNOWLEDGE_CONFLICT === '1' && result.gate === 'knowledge-conflict-gate') return result;
   // Warn-by-default: the gate still fired and is recorded; the action is allowed through
@@ -175,7 +173,7 @@ function applyEnforcementPosture(result) {
     ...result,
     decision: 'warn',
     warnByDefault: true,
-    message: `${result.message}\n\n⚠️ ThumbGate is in warn-by-default mode — this was flagged and logged, not blocked. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block, or THUMBGATE_HOTFIX_BYPASS=1 to disable checks entirely.`,
+    message: `${result.message}\n\n⚠️ ThumbGate is in warn-by-default mode — this was flagged and logged, not blocked. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block other flagged actions.`,
   };
 }
 const BREAK_GLASS_CONDITION = 'thumbgate_break_glass';
@@ -1710,6 +1708,10 @@ function matchGate(gate, toolName, toolInput = {}) {
   const governanceState = loadGovernanceState();
   const constraints = loadConstraints();
 
+  if (isSelfProtectGate(gate.id) && hasActiveProtectedApproval(governanceState, affectedFiles)) {
+    return { matched: false, matchText, affectedFiles };
+  }
+
   if (gate.id === 'on-demand-freeze-mode' || (gate.when && gate.when.constraints && gate.when.constraints.freeze_mode)) {
     let freezePaths = [];
     if (process.env.THUMBGATE_FREEZE_PATHS) {
@@ -1817,6 +1819,78 @@ function matchesGate(gate, toolName, toolInput) {
   return matchGate(gate, toolName, toolInput).matched;
 }
 
+function hasActiveProtectedApproval(governanceState, affectedFiles) {
+  if (!Array.isArray(affectedFiles) || affectedFiles.length === 0) return false;
+  const approvals = Array.isArray(governanceState && governanceState.protectedApprovals)
+    ? governanceState.protectedApprovals
+    : [];
+  return affectedFiles.every((filePath) => approvals.some((entry) => {
+    return matchesAnyGlob(filePath, sanitizeGlobList(entry && entry.pathGlobs));
+  }));
+}
+
+function matchSelfProtectHardFloor(gate, toolName, toolInput = {}) {
+  const affected = extractAffectedFiles(toolName, toolInput);
+  const affectedFiles = affected.files;
+  if (hasActiveProtectedApproval(loadGovernanceState(), affectedFiles)) return null;
+
+  const command = String(toolInput.command || '');
+  let matchText = command;
+  if (gate.id === 'self-protect-config' || gate.id === 'self-protect-hooks-disable') {
+    const targetPattern = gate.id === 'self-protect-config'
+      ? SELF_PROTECT_CONFIG_TARGET_PATTERN
+      : SELF_PROTECT_HOOK_TARGET_PATTERN;
+    if (EDIT_LIKE_TOOLS.has(toolName)) {
+      matchText = affectedFiles.join(' ');
+      if (!targetPattern.test(matchText)) return null;
+    } else if (toolName === 'Bash') {
+      const commandTargetPattern = gate.id === 'self-protect-config'
+        ? SELF_PROTECT_CONFIG_COMMAND_PATTERN
+        : SELF_PROTECT_HOOK_COMMAND_PATTERN;
+      if (!SHELL_FILE_MUTATION_PATTERN.test(command) || !commandTargetPattern.test(command)) return null;
+    } else {
+      return null;
+    }
+  } else {
+    if (!Array.isArray(gate.toolNames) || !gate.toolNames.includes(toolName)) return null;
+    if (!matchText || !gate.pattern) return null;
+    try {
+      if (!new RegExp(gate.pattern).test(matchText)) return null;
+    } catch {
+      return null;
+    }
+  }
+
+  return {
+    matched: true,
+    matchText,
+    affectedFiles,
+  };
+}
+
+function evaluateSelfProtectHardFloor(input = {}) {
+  const toolName = input.tool_name || input.toolName || '';
+  const toolInput = input.tool_input || input.toolInput || {};
+  const config = loadGatesConfig(DEFAULT_CONFIG_PATH);
+
+  for (const gate of config.gates) {
+    if (!isSelfProtectGate(gate.id)) continue;
+    const matchDetails = matchSelfProtectHardFloor(gate, toolName, toolInput);
+    if (!matchDetails) continue;
+
+    const result = {
+      decision: 'deny',
+      gate: gate.id,
+      message: buildGateMessage(gate, matchDetails),
+      severity: gate.severity,
+      reasoning: buildReasoning(gate, toolName, toolInput, matchDetails),
+    };
+    return recordStructuralGateBlock(toolName, toolInput, result);
+  }
+
+  return null;
+}
+
 function isSafeLocalCredentialHardeningCommand(toolName, toolInput = {}) {
   if (toolName !== 'Bash') return false;
   const command = String(toolInput.command || '').trim();
@@ -2643,6 +2717,26 @@ function evaluateSecretGuard(input = {}) {
   return result;
 }
 
+function evaluateUnconditionalHardFloor(input = {}) {
+  const secretGuard = evaluateSecretGuard(input);
+  if (secretGuard) return { hardFloor: secretGuard, securityScan: null };
+
+  const securityScan = evaluateSecurityScan(input);
+  if (securityScan && securityScan.decision === 'deny') {
+    return { hardFloor: securityScan, securityScan };
+  }
+
+  return {
+    hardFloor: evaluateSelfProtectHardFloor(input),
+    securityScan,
+  };
+}
+
+function runHardFloor(input) {
+  const { hardFloor } = evaluateUnconditionalHardFloor(input);
+  return hardFloor ? formatOutput(hardFloor) : null;
+}
+
 // ---------------------------------------------------------------------------
 function isApprovalGatesEnabled() {
   return process.env.THUMBGATE_APPROVAL_GATES !== '0';
@@ -2996,16 +3090,8 @@ function mergeContextStrings(...ctxs) {
 }
 
 async function runAsync(input) {
-  const secretGuard = evaluateSecretGuard(input);
-  if (secretGuard) {
-    return formatOutput(secretGuard);
-  }
-
-  // Security vulnerability scan (Tier 1: pattern match, Tier 2: supply chain)
-  const securityScan = evaluateSecurityScan(input);
-  if (securityScan && securityScan.decision === 'deny') {
-    return formatOutput(securityScan);
-  }
+  const { hardFloor, securityScan } = evaluateUnconditionalHardFloor(input);
+  if (hardFloor) return formatOutput(hardFloor);
 
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
@@ -3043,16 +3129,8 @@ async function runAsync(input) {
 }
 
 function run(input) {
-  const secretGuard = evaluateSecretGuard(input);
-  if (secretGuard) {
-    return formatOutput(secretGuard);
-  }
-
-  // Security vulnerability scan (Tier 1: pattern match, Tier 2: supply chain)
-  const securityScan = evaluateSecurityScan(input);
-  if (securityScan && securityScan.decision === 'deny') {
-    return formatOutput(securityScan);
-  }
+  const { hardFloor, securityScan } = evaluateUnconditionalHardFloor(input);
+  if (hardFloor) return formatOutput(hardFloor);
 
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
@@ -3379,6 +3457,7 @@ module.exports = {
   computeExecutableHash,
   formatOutput,
   isApprovalGatesEnabled,
+  runHardFloor,
   run,
   runAsync,
   trackAction,

package/scripts/hosted-config.js

@@ -13,6 +13,9 @@ const DEFAULT_PRO_PRICE_DOLLARS = PRO_MONTHLY_PRICE_DOLLARS;
 const DEFAULT_PRO_PRICE_LABEL = PRO_PRICE_LABEL;
 const DEFAULT_SPRINT_DIAGNOSTIC_PRICE_DOLLARS = 499;
 const DEFAULT_WORKFLOW_SPRINT_PRICE_DOLLARS = 1500;
+// Keep fallbacks price-aligned. Sprint must NOT share the diagnostic Stripe slug.
+const DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL = 'https://buy.stripe.com/9B69ATbmI4r4aK5eOD3sI3k';
+const DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL = 'https://www.paypal.com/ncp/payment/LTQFR7P9AR3QG';
 const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]+$/i;
 
 function normalizeOrigin(value) {
@@ -127,8 +130,10 @@ function resolveHostedBillingConfig({ requestOrigin } = {}, env = process.env) {
   const gaMeasurementId = normalizeTrackingId(env.THUMBGATE_GA_MEASUREMENT_ID, GA_MEASUREMENT_ID_PATTERN);
   const posthogApiKey = env.POSTHOG_API_KEY || '';
   const googleSiteVerification = normalizeTrackingId(env.THUMBGATE_GOOGLE_SITE_VERIFICATION);
-  const sprintDiagnosticCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_SPRINT_DIAGNOSTIC_CHECKOUT_URL);
-  const workflowSprintCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_WORKFLOW_SPRINT_CHECKOUT_URL);
+  const sprintDiagnosticCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_SPRINT_DIAGNOSTIC_CHECKOUT_URL)
+    || DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL;
+  const workflowSprintCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_WORKFLOW_SPRINT_CHECKOUT_URL)
+    || DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL;
 
   return {
     appOrigin,
@@ -159,6 +164,8 @@ module.exports = {
   DEFAULT_PRO_PRICE_LABEL,
   DEFAULT_SPRINT_DIAGNOSTIC_PRICE_DOLLARS,
   DEFAULT_WORKFLOW_SPRINT_PRICE_DOLLARS,
+  DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL,
+  DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL,
   GA_MEASUREMENT_ID_PATTERN,
   normalizeAbsoluteUrl,
   normalizeOrigin,

package/scripts/mailer/resend-mailer.js

@@ -226,12 +226,13 @@ function parseJsonOrNull(bodyText) {
   }
 }
 
-async function postResendEmail({ fetcher, apiKey, payload }) {
+async function postResendEmail({ fetcher, apiKey, payload, idempotencyKey }) {
   const res = await fetcher(RESEND_ENDPOINT, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
       Authorization: `Bearer ${apiKey}`,
+      ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
     },
     body: JSON.stringify(payload),
   });
@@ -256,7 +257,7 @@ function buildSendSuccess({ bodyJson, status, senderFallback }) {
  * Low-level send. Posts to the Resend API or no-ops when RESEND_API_KEY is
  * missing. Never throws on network errors; returns a structured result instead.
  */
-async function sendEmail({ to, subject, html, text, from, replyTo, fetchImpl, dnsResolver } = {}) {
+async function sendEmail({ to, subject, html, text, from, replyTo, idempotencyKey, fetchImpl, dnsResolver } = {}) {
   validateSendEmailInput({ to, subject, html, text });
 
   const apiKey = getApiKey();
@@ -278,7 +279,12 @@ async function sendEmail({ to, subject, html, text, from, replyTo, fetchImpl, dn
   }
 
   try {
-    const { res, bodyText, bodyJson } = await postResendEmail({ fetcher, apiKey, payload });
+    const { res, bodyText, bodyJson } = await postResendEmail({
+      fetcher,
+      apiKey,
+      payload,
+      idempotencyKey: isNonEmptyString(idempotencyKey) ? idempotencyKey.slice(0, 256) : null,
+    });
     if (!res.ok) {
       // eslint-disable-next-line no-console
       console.warn(`[mailer] Resend returned ${res.status}:`, bodyText);
@@ -490,7 +496,7 @@ function renderTrialWelcomeBodies({ licenseKey, customerId, customerName, trialE
  * Never throws on send failures (beyond input validation); the Stripe webhook
  * must keep working even if email breaks.
  */
-async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName, trialEndAt, fetchImpl, dnsResolver } = {}) {
+async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName, trialEndAt, idempotencyKey, fetchImpl, dnsResolver } = {}) {
   if (!isNonEmptyString(to)) throw new Error('sendTrialWelcomeEmail: `to` is required');
   if (!isNonEmptyString(licenseKey)) throw new Error('sendTrialWelcomeEmail: `licenseKey` is required');
 
@@ -500,7 +506,7 @@ async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName,
     ? `${name}, your ThumbGate Pro key is inside`
     : 'Your ThumbGate Pro key is inside';
 
-  return sendEmail({ to, subject, html, text, replyTo: getReplyTo(), fetchImpl, dnsResolver });
+  return sendEmail({ to, subject, html, text, replyTo: getReplyTo(), idempotencyKey, fetchImpl, dnsResolver });
 }
 
 function renderNewsletterWelcomeBodies() {