thumbgate 1.28.0 → 1.28.2

package/scripts/gates-engine.js

@@ -131,42 +131,40 @@ const DOWNLOAD_EXEC_CHAIN_PATTERN = /\b(?:curl|wget)\b[\s\S]{0,400}(?:\|\s*(?:ba
 const DESTRUCTIVE_OR_PRIVILEGE_BOUNDARY_PATTERN = /\b(?:rm\s+-rf|chmod\s+(?:\+x|777)|chown\b|sudo\b|dd\s+if=|mkfs|git\s+reset\s+--hard|git\s+clean\s+-f[a-z]*|kubectl\s+(?:apply|delete)|terraform\s+(?:apply|destroy)|railway\s+(?:deploy|up)|gcloud\s+(?:run\s+deploy|app\s+deploy)|vercel\s+--prod|firebase\s+deploy)\b/i;
 
 // ---------------------------------------------------------------------------
-// Enforcement posture (CEO decision 2026-06-04): warn-by-default.
-// The firewall ALWAYS fires and logs every decision, but most gates WARN rather
-// than hard-block — only TRULY CATASTROPHIC, irreversible actions hard-block:
-//   - secret exfiltration (handled on its own deny path; never downgraded)
-//   - security-vulnerability / supply-chain denies (own deny path; not downgraded)
-//   - irreversibly destructive filesystem commands (rm -rf class, mkfs, dd to disk,
-//     fork bomb) — kept as hard deny via DESTRUCTIVE_FS_PATTERN below.
-// Everything else (memory-high-risk, workflow-sequence, off-scope, git push, deploy,
-// approval gates) downgrades deny/approve -> warn so legitimate work is never blocked.
-// Opt back into full hard enforcement with THUMBGATE_STRICT_ENFORCEMENT=1.
 // Enforcement posture (CEO decision 2026-06-04): WARN + AUDIT by default.
-// The firewall fires and LOGS every decision, but downgrades deny/approve -> warn so
-// legitimate work is never hard-blocked. We deliberately do NOT try to hard-block
-// arbitrary destructive commands here: a regex "catastrophic floor" is unwinnable
-// (sudo / bash -c / find -exec / eval / base64|sh all evade it) and gives false confidence.
-// HARD enforcement is an explicit opt-in via THUMBGATE_STRICT_ENFORCEMENT=1, which keeps
-// the engine's FULL gate set (its high-risk-command gates catch prefixed/obfuscated forms
-// far better than any single regex). Secret exfiltration and the security-vulnerability
-// scan hard-deny on their OWN paths before this runs, so irreversible data-leak / supply
-// chain risks stay blocked regardless of posture.
-// Self-protective gates guard ThumbGate's own guardrails (kill/env/config/hooks). See the
-// self-protect-binds-regardless-of-posture changeset for the full rationale.
+// Unconditional floors run before posture conversion: secret exfiltration, deny results
+// from the security scanner, and the four canonical self-protection gates. Arbitrary
+// destructive commands do not get a regex-based "catastrophic" floor; wrappers and
+// obfuscation make that boundary misleading. Every other deny/approve becomes a warning
+// unless the operator explicitly enables THUMBGATE_STRICT_ENFORCEMENT=1.
+const SELF_PROTECT_HARD_FLOOR_GATE_IDS = new Set([
+  'self-protect-config',
+  'self-protect-kill',
+  'self-protect-env-override',
+  'self-protect-hooks-disable',
+]);
+const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
+  'secret-exfiltration',
+  'security-vuln-scan',
+  'slopsquat-guard',
+  ...SELF_PROTECT_HARD_FLOOR_GATE_IDS,
+]);
+const SELF_PROTECT_CONFIG_TARGET_PATTERN = /(?:^|\/)(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json$|\.thumbgate\/config\.json$|thumbgate\.json$)/i;
+const SELF_PROTECT_HOOK_TARGET_PATTERN = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^/]+\.(?:js|sh))$/i;
+const SELF_PROTECT_CONFIG_COMMAND_PATTERN = /(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json\b|\.thumbgate\/config\.json\b|thumbgate\.json\b)/i;
+const SELF_PROTECT_HOOK_COMMAND_PATTERN = /(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^\s'";|]+\.(?:js|sh))\b/i;
+const SHELL_FILE_MUTATION_PATTERN = /\b(?:sed\s+-i|perl\s+-pi|python\d*\s+-c|node\s+-e|ruby\s+-e|tee|truncate|rm|mv|cp|install|patch|jq)\b|(?:^|[\s;&|])>{1,2}\s*\S/i;
+
 function isSelfProtectGate(gateId) {
-  return typeof gateId === 'string' && gateId.startsWith('self-protect');
+  return SELF_PROTECT_HARD_FLOOR_GATE_IDS.has(gateId);
 }
 
 function applyEnforcementPosture(result) {
   if (!result || (result.decision !== 'deny' && result.decision !== 'approve')) return result;
+  // Defensive backstop: hard-floor results must never be posture-downgraded.
+  if (UNCONDITIONAL_HARD_FLOOR_GATE_IDS.has(result.gate)) return result;
   // Full hard enforcement opt-in: keep every deny.
   if (process.env.THUMBGATE_STRICT_ENFORCEMENT === '1') return result;
-  // Self-protection binds regardless of posture: a warning is worthless once the guardrail is
-  // gone. Owner escape: THUMBGATE_SELF_PROTECT_OVERRIDE=1 (break-glass covers .claude/settings*
-  // but not this surface, so it needs its own escape — self-lockout, 2026-07-07).
-  if (isSelfProtectGate(result.gate) && process.env.THUMBGATE_SELF_PROTECT_OVERRIDE !== '1') {
-    return result;
-  }
   // Honor the explicit strict-knowledge-conflict opt-in for that gate.
   if (process.env.THUMBGATE_STRICT_KNOWLEDGE_CONFLICT === '1' && result.gate === 'knowledge-conflict-gate') return result;
   // Warn-by-default: the gate still fired and is recorded; the action is allowed through
@@ -175,7 +173,7 @@ function applyEnforcementPosture(result) {
     ...result,
     decision: 'warn',
     warnByDefault: true,
-    message: `${result.message}\n\n⚠️ ThumbGate is in warn-by-default mode — this was flagged and logged, not blocked. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block, or THUMBGATE_HOTFIX_BYPASS=1 to disable checks entirely.`,
+    message: `${result.message}\n\n⚠️ ThumbGate is in warn-by-default mode — this was flagged and logged, not blocked. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block other flagged actions.`,
   };
 }
 const BREAK_GLASS_CONDITION = 'thumbgate_break_glass';
@@ -1710,6 +1708,10 @@ function matchGate(gate, toolName, toolInput = {}) {
   const governanceState = loadGovernanceState();
   const constraints = loadConstraints();
 
+  if (isSelfProtectGate(gate.id) && hasActiveProtectedApproval(governanceState, affectedFiles)) {
+    return { matched: false, matchText, affectedFiles };
+  }
+
   if (gate.id === 'on-demand-freeze-mode' || (gate.when && gate.when.constraints && gate.when.constraints.freeze_mode)) {
     let freezePaths = [];
     if (process.env.THUMBGATE_FREEZE_PATHS) {
@@ -1817,6 +1819,78 @@ function matchesGate(gate, toolName, toolInput) {
   return matchGate(gate, toolName, toolInput).matched;
 }
 
+function hasActiveProtectedApproval(governanceState, affectedFiles) {
+  if (!Array.isArray(affectedFiles) || affectedFiles.length === 0) return false;
+  const approvals = Array.isArray(governanceState && governanceState.protectedApprovals)
+    ? governanceState.protectedApprovals
+    : [];
+  return affectedFiles.every((filePath) => approvals.some((entry) => {
+    return matchesAnyGlob(filePath, sanitizeGlobList(entry && entry.pathGlobs));
+  }));
+}
+
+function matchSelfProtectHardFloor(gate, toolName, toolInput = {}) {
+  const affected = extractAffectedFiles(toolName, toolInput);
+  const affectedFiles = affected.files;
+  if (hasActiveProtectedApproval(loadGovernanceState(), affectedFiles)) return null;
+
+  const command = String(toolInput.command || '');
+  let matchText = command;
+  if (gate.id === 'self-protect-config' || gate.id === 'self-protect-hooks-disable') {
+    const targetPattern = gate.id === 'self-protect-config'
+      ? SELF_PROTECT_CONFIG_TARGET_PATTERN
+      : SELF_PROTECT_HOOK_TARGET_PATTERN;
+    if (EDIT_LIKE_TOOLS.has(toolName)) {
+      matchText = affectedFiles.join(' ');
+      if (!targetPattern.test(matchText)) return null;
+    } else if (toolName === 'Bash') {
+      const commandTargetPattern = gate.id === 'self-protect-config'
+        ? SELF_PROTECT_CONFIG_COMMAND_PATTERN
+        : SELF_PROTECT_HOOK_COMMAND_PATTERN;
+      if (!SHELL_FILE_MUTATION_PATTERN.test(command) || !commandTargetPattern.test(command)) return null;
+    } else {
+      return null;
+    }
+  } else {
+    if (!Array.isArray(gate.toolNames) || !gate.toolNames.includes(toolName)) return null;
+    if (!matchText || !gate.pattern) return null;
+    try {
+      if (!new RegExp(gate.pattern).test(matchText)) return null;
+    } catch {
+      return null;
+    }
+  }
+
+  return {
+    matched: true,
+    matchText,
+    affectedFiles,
+  };
+}
+
+function evaluateSelfProtectHardFloor(input = {}) {
+  const toolName = input.tool_name || input.toolName || '';
+  const toolInput = input.tool_input || input.toolInput || {};
+  const config = loadGatesConfig(DEFAULT_CONFIG_PATH);
+
+  for (const gate of config.gates) {
+    if (!isSelfProtectGate(gate.id)) continue;
+    const matchDetails = matchSelfProtectHardFloor(gate, toolName, toolInput);
+    if (!matchDetails) continue;
+
+    const result = {
+      decision: 'deny',
+      gate: gate.id,
+      message: buildGateMessage(gate, matchDetails),
+      severity: gate.severity,
+      reasoning: buildReasoning(gate, toolName, toolInput, matchDetails),
+    };
+    return recordStructuralGateBlock(toolName, toolInput, result);
+  }
+
+  return null;
+}
+
 function isSafeLocalCredentialHardeningCommand(toolName, toolInput = {}) {
   if (toolName !== 'Bash') return false;
   const command = String(toolInput.command || '').trim();
@@ -2643,6 +2717,26 @@ function evaluateSecretGuard(input = {}) {
   return result;
 }
 
+function evaluateUnconditionalHardFloor(input = {}) {
+  const secretGuard = evaluateSecretGuard(input);
+  if (secretGuard) return { hardFloor: secretGuard, securityScan: null };
+
+  const securityScan = evaluateSecurityScan(input);
+  if (securityScan && securityScan.decision === 'deny') {
+    return { hardFloor: securityScan, securityScan };
+  }
+
+  return {
+    hardFloor: evaluateSelfProtectHardFloor(input),
+    securityScan,
+  };
+}
+
+function runHardFloor(input) {
+  const { hardFloor } = evaluateUnconditionalHardFloor(input);
+  return hardFloor ? formatOutput(hardFloor) : null;
+}
+
 // ---------------------------------------------------------------------------
 function isApprovalGatesEnabled() {
   return process.env.THUMBGATE_APPROVAL_GATES !== '0';
@@ -2996,16 +3090,8 @@ function mergeContextStrings(...ctxs) {
 }
 
 async function runAsync(input) {
-  const secretGuard = evaluateSecretGuard(input);
-  if (secretGuard) {
-    return formatOutput(secretGuard);
-  }
-
-  // Security vulnerability scan (Tier 1: pattern match, Tier 2: supply chain)
-  const securityScan = evaluateSecurityScan(input);
-  if (securityScan && securityScan.decision === 'deny') {
-    return formatOutput(securityScan);
-  }
+  const { hardFloor, securityScan } = evaluateUnconditionalHardFloor(input);
+  if (hardFloor) return formatOutput(hardFloor);
 
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
@@ -3043,16 +3129,8 @@ async function runAsync(input) {
 }
 
 function run(input) {
-  const secretGuard = evaluateSecretGuard(input);
-  if (secretGuard) {
-    return formatOutput(secretGuard);
-  }
-
-  // Security vulnerability scan (Tier 1: pattern match, Tier 2: supply chain)
-  const securityScan = evaluateSecurityScan(input);
-  if (securityScan && securityScan.decision === 'deny') {
-    return formatOutput(securityScan);
-  }
+  const { hardFloor, securityScan } = evaluateUnconditionalHardFloor(input);
+  if (hardFloor) return formatOutput(hardFloor);
 
   const toolName = input.tool_name || '';
   const toolInput = input.tool_input || {};
@@ -3379,6 +3457,7 @@ module.exports = {
   computeExecutableHash,
   formatOutput,
   isApprovalGatesEnabled,
+  runHardFloor,
   run,
   runAsync,
   trackAction,

package/scripts/hosted-config.js

@@ -13,6 +13,9 @@ const DEFAULT_PRO_PRICE_DOLLARS = PRO_MONTHLY_PRICE_DOLLARS;
 const DEFAULT_PRO_PRICE_LABEL = PRO_PRICE_LABEL;
 const DEFAULT_SPRINT_DIAGNOSTIC_PRICE_DOLLARS = 499;
 const DEFAULT_WORKFLOW_SPRINT_PRICE_DOLLARS = 1500;
+// Keep fallbacks price-aligned. Sprint must NOT share the diagnostic Stripe slug.
+const DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL = 'https://buy.stripe.com/9B69ATbmI4r4aK5eOD3sI3k';
+const DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL = 'https://www.paypal.com/ncp/payment/LTQFR7P9AR3QG';
 const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]+$/i;
 
 function normalizeOrigin(value) {
@@ -127,8 +130,10 @@ function resolveHostedBillingConfig({ requestOrigin } = {}, env = process.env) {
   const gaMeasurementId = normalizeTrackingId(env.THUMBGATE_GA_MEASUREMENT_ID, GA_MEASUREMENT_ID_PATTERN);
   const posthogApiKey = env.POSTHOG_API_KEY || '';
   const googleSiteVerification = normalizeTrackingId(env.THUMBGATE_GOOGLE_SITE_VERIFICATION);
-  const sprintDiagnosticCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_SPRINT_DIAGNOSTIC_CHECKOUT_URL);
-  const workflowSprintCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_WORKFLOW_SPRINT_CHECKOUT_URL);
+  const sprintDiagnosticCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_SPRINT_DIAGNOSTIC_CHECKOUT_URL)
+    || DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL;
+  const workflowSprintCheckoutUrl = normalizeAbsoluteUrl(env.THUMBGATE_WORKFLOW_SPRINT_CHECKOUT_URL)
+    || DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL;
 
   return {
     appOrigin,
@@ -159,6 +164,8 @@ module.exports = {
   DEFAULT_PRO_PRICE_LABEL,
   DEFAULT_SPRINT_DIAGNOSTIC_PRICE_DOLLARS,
   DEFAULT_WORKFLOW_SPRINT_PRICE_DOLLARS,
+  DEFAULT_SPRINT_DIAGNOSTIC_CHECKOUT_URL,
+  DEFAULT_WORKFLOW_SPRINT_CHECKOUT_URL,
   GA_MEASUREMENT_ID_PATTERN,
   normalizeAbsoluteUrl,
   normalizeOrigin,

package/scripts/mailer/resend-mailer.js

@@ -226,12 +226,13 @@ function parseJsonOrNull(bodyText) {
   }
 }
 
-async function postResendEmail({ fetcher, apiKey, payload }) {
+async function postResendEmail({ fetcher, apiKey, payload, idempotencyKey }) {
   const res = await fetcher(RESEND_ENDPOINT, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
       Authorization: `Bearer ${apiKey}`,
+      ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
     },
     body: JSON.stringify(payload),
   });
@@ -256,7 +257,7 @@ function buildSendSuccess({ bodyJson, status, senderFallback }) {
  * Low-level send. Posts to the Resend API or no-ops when RESEND_API_KEY is
  * missing. Never throws on network errors; returns a structured result instead.
  */
-async function sendEmail({ to, subject, html, text, from, replyTo, fetchImpl, dnsResolver } = {}) {
+async function sendEmail({ to, subject, html, text, from, replyTo, idempotencyKey, fetchImpl, dnsResolver } = {}) {
   validateSendEmailInput({ to, subject, html, text });
 
   const apiKey = getApiKey();
@@ -278,7 +279,12 @@ async function sendEmail({ to, subject, html, text, from, replyTo, fetchImpl, dn
   }
 
   try {
-    const { res, bodyText, bodyJson } = await postResendEmail({ fetcher, apiKey, payload });
+    const { res, bodyText, bodyJson } = await postResendEmail({
+      fetcher,
+      apiKey,
+      payload,
+      idempotencyKey: isNonEmptyString(idempotencyKey) ? idempotencyKey.slice(0, 256) : null,
+    });
     if (!res.ok) {
       // eslint-disable-next-line no-console
       console.warn(`[mailer] Resend returned ${res.status}:`, bodyText);
@@ -490,7 +496,7 @@ function renderTrialWelcomeBodies({ licenseKey, customerId, customerName, trialE
  * Never throws on send failures (beyond input validation); the Stripe webhook
  * must keep working even if email breaks.
  */
-async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName, trialEndAt, fetchImpl, dnsResolver } = {}) {
+async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName, trialEndAt, idempotencyKey, fetchImpl, dnsResolver } = {}) {
   if (!isNonEmptyString(to)) throw new Error('sendTrialWelcomeEmail: `to` is required');
   if (!isNonEmptyString(licenseKey)) throw new Error('sendTrialWelcomeEmail: `licenseKey` is required');
 
@@ -500,7 +506,7 @@ async function sendTrialWelcomeEmail({ to, licenseKey, customerId, customerName,
     ? `${name}, your ThumbGate Pro key is inside`
     : 'Your ThumbGate Pro key is inside';
 
-  return sendEmail({ to, subject, html, text, replyTo: getReplyTo(), fetchImpl, dnsResolver });
+  return sendEmail({ to, subject, html, text, replyTo: getReplyTo(), idempotencyKey, fetchImpl, dnsResolver });
 }
 
 function renderNewsletterWelcomeBodies() {