thumbgate 1.29.2 → 1.31.0

package/scripts/feedback-paths.js

@@ -78,6 +78,15 @@ function isTransientProjectDir(dirPath, options = {}) {
   if (!normalizedDir) return true;
   if (!dirExists(normalizedDir)) return true;
 
+  // MCP hosts and desktop launchers commonly start global servers from `/` or
+  // the user's home directory. Those are launcher contexts, not projects. If
+  // they win resolution they create `projects/default` / `~/.thumbgate` split
+  // stores and make the same lesson corpus depend on which client started the
+  // process. A durable active-project state is a better signal.
+  if (normalizedDir === path.parse(normalizedDir).root) return true;
+  const homeDir = normalizeDir(getHomeDir(options));
+  if (homeDir && normalizedDir === homeDir) return true;
+
   const runtimeDir = getRuntimeDir(options);
   if (isWithinDir(normalizedDir, runtimeDir)) return true;
 
@@ -119,11 +128,12 @@ function writeActiveProjectState(projectDir, options = {}) {
 function resolveProjectDir(options = {}) {
   const env = options.env || process.env;
   const stored = options.includeStored === false ? null : readActiveProjectState(options);
-  const cwdCandidates = uniquePaths([
-    options.cwd,
-    env.PWD,
-    process.cwd(),
-  ]);
+  // An injected cwd is authoritative for callers that resolve on behalf of a
+  // different process. Mixing in this Node process's cwd can silently route a
+  // global launcher back into ThumbGate's own checkout during diagnostics.
+  const cwdCandidates = uniquePaths(options.cwd
+    ? [options.cwd]
+    : [env.PWD, process.cwd()]);
   const isTransientExecution = cwdCandidates.length > 0
     && cwdCandidates.every((candidate) => isTransientProjectDir(candidate, options));
   const candidates = uniquePaths([
@@ -167,15 +177,12 @@ function getExplicitFeedbackDir(options = {}) {
   const env = options.env || process.env;
   if (options.feedbackDir) return options.feedbackDir;
   if (options.skipExplicitFeedbackDir) return null;
-  // A caller-provided feedback root should stay authoritative over stored
-  // active-project state so isolated CLI/test commands do not drift into a
-  // different project. Only direct project overrides suppress it.
-  if (env.THUMBGATE_FEEDBACK_DIR && !hasDirectProjectScope(options)) {
+  // An explicit storage root is the strongest storage instruction. Project
+  // metadata may still identify the project, but it must not redirect writes
+  // out of an isolated test/runtime directory.
+  if (env.THUMBGATE_FEEDBACK_DIR) {
     return env.THUMBGATE_FEEDBACK_DIR;
   }
-  if (hasDirectProjectScope(options)) {
-    return null;
-  }
   if (env.RAILWAY_VOLUME_MOUNT_PATH) {
     return path.join(env.RAILWAY_VOLUME_MOUNT_PATH, 'feedback');
   }
@@ -221,7 +228,19 @@ function resolveFeedbackDir(options = {}) {
   const localLegacy = getLegacyFeedbackDir(options);
   if (dirExists(localLegacy)) return localLegacy;
 
-  return getGlobalFeedbackDir(options);
+  // Existing installations may only have the pre-1.31 basename-scoped store.
+  // Preserve that corpus instead of silently switching to an empty directory.
+  // New projects never create this legacy global shape, so same-basename
+  // projects remain isolated going forward.
+  const globalLegacy = getGlobalFeedbackDir(options);
+  if (dirExists(globalLegacy)) return globalLegacy;
+
+  const projectDir = resolveProjectDir(options);
+  // New real projects select their collision-free local store before it is
+  // created, preventing the old first-write flip from global to local.
+  if (!isTransientProjectDir(projectDir, options)) return localThumbgate;
+
+  return globalLegacy;
 }
 
 function getFeedbackPaths(options = {}) {

package/scripts/feedback-quality.js

@@ -154,6 +154,58 @@ function isGenericFeedbackText(value, signal) {
   return rules.some((pattern) => pattern.test(normalized));
 }
 
+/**
+ * Score a captured feedback entry with the reward rubric in judge-reward-function.
+ *
+ * `assessFeedbackActionability` answers a binary question — is this promotable at
+ * all. This answers the graded one: how good is the correction the operator wrote.
+ * A 👎 whose whatToChange is "be better" and a 👎 that says "run npm test before
+ * claiming green, see commit abc123" are both promotable; only one of them makes a
+ * useful prevention rule.
+ *
+ * Deterministic by construction. `buildCompositeReward` runs its Boolean rubric
+ * first and only consults an LLM judge if one is injected; we deliberately inject
+ * none, so this returns `scoringMode: 'deterministic_only'` and costs nothing. That
+ * matters: ANTHROPIC_API_KEY is frequently absent, and a scorer that silently
+ * degrades to nothing is worse than one that never claimed the LLM path.
+ *
+ * Reporting only — nothing here gates promotion. Wiring a fresh quality signal
+ * straight into enforcement would change which lessons become blocking rules, and
+ * that decision deserves its own change with its own evidence.
+ *
+ * @returns {{score: number, label: string, scoringMode: string, dimensions: object, passed: boolean}|null}
+ *   null when there is no corrective text worth scoring.
+ */
+function scoreFeedbackReward(params = {}) {
+  const signal = normalizeFeedbackSignal(params.signal);
+  const prediction = normalizeFeedbackText(
+    signal === 'positive'
+      ? (params.whatWorked || params.context)
+      : (params.whatToChange || params.whatWentWrong || params.context),
+  );
+  if (!prediction) return null;
+
+  // Lazy-require: judge-reward-function is a leaf, but feedback-quality is required
+  // by feedback-loop and three other modules — keep the import cost off that path
+  // until someone actually asks for a score.
+  let buildCompositeReward;
+  try {
+    ({ buildCompositeReward } = require('./judge-reward-function'));
+  } catch {
+    return null;
+  }
+  if (typeof buildCompositeReward !== 'function') return null;
+
+  const reward = buildCompositeReward({ prediction });
+  return {
+    score: reward.score,
+    label: reward.label,
+    scoringMode: reward.scoringMode || 'deterministic_only',
+    dimensions: reward.deterministic ? reward.deterministic.dimensions : {},
+    passed: Boolean(reward.deterministic && reward.deterministic.passed),
+  };
+}
+
 function assessFeedbackActionability(params = {}) {
   const signal = normalizeFeedbackSignal(params.signal);
   const primaryFields = signal === 'positive'
@@ -222,4 +274,5 @@ module.exports = {
   isGenericFeedbackText,
   assessFeedbackActionability,
   buildClarificationMessage,
+  scoreFeedbackReward,
 };

package/scripts/filesystem-search.js

@@ -154,14 +154,19 @@ function scoreRecord(queryTokens, queryText, record) {
 // ---------------------------------------------------------------------------
 
 function searchFeedbackLog(queryText, limit = 5, options = {}) {
-  const logPath = path.join(options.feedbackDir || getFeedbackDir(), 'feedback-log.jsonl');
+  const feedbackDir = options.feedbackDir || getFeedbackDir();
+  const logPath = path.join(feedbackDir, 'feedback-log.jsonl');
   let records = readJsonl(logPath);
 
-  // SQLite fallback: if JSONL is empty/tiny, pull records from the lesson DB
-  if (records.length <= 1) {
+  // SQLite fallback is allowed only inside the exact selected feedback root.
+  // Falling back through lesson-db's ambient default can cross project/tenant
+  // boundaries when a sparse project has zero or one JSONL row.
+  const lessonDbPath = path.join(feedbackDir, 'lessons.sqlite');
+  if (records.length <= 1 && fs.existsSync(lessonDbPath)) {
+    let db = null;
     try {
       const { initDB } = require('./lesson-db');
-      const db = initDB();
+      db = initDB(lessonDbPath);
       const rows = db.prepare('SELECT * FROM lessons ORDER BY timestamp DESC LIMIT 500').all();
       if (rows.length > records.length) {
         records = rows.map((r) => ({
@@ -171,12 +176,17 @@ function searchFeedbackLog(queryText, limit = 5, options = {}) {
           title: r.title || r.context,
           tags: r.tags ? JSON.parse(r.tags) : [],
           timestamp: r.timestamp,
-          whatWentWrong: r.what_went_wrong,
-          whatWorked: r.what_worked,
-          whatToChange: r.what_to_change,
+          whatWentWrong: r.whatWentWrong ?? r.what_went_wrong,
+          whatWorked: r.whatWorked ?? r.what_worked,
+          whatToChange: r.whatToChange ?? r.what_to_change,
         }));
       }
     } catch { /* lesson-db not available */ }
+    finally {
+      if (db) {
+        try { db.close(); } catch { /* best-effort close */ }
+      }
+    }
   }
 
   // Wildcard query: return all records sorted by recency

package/scripts/gates-engine.js

@@ -146,10 +146,18 @@ const SELF_PROTECT_HARD_FLOOR_GATE_IDS = new Set([
   'self-protect-env-override',
   'self-protect-hooks-disable',
 ]);
+// An expired task-scope lease gets its OWN gate id so it can be exempted from the two downgrade
+// paths without touching ordinary task-scope denials. Without this the fail-closed guarantee is
+// cosmetic: applyEnforcementPosture turns denials into warnings by default, and applyDailyBlockCap
+// does the same for capped free-tier users — so an edit under a lapsed lease would execute anyway.
+// A lease that stops binding when you are busy or over quota is not a lease.
+const TASK_SCOPE_LEASE_EXPIRED_GATE_ID = 'task-scope-lease-expired';
+
 const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
   'secret-exfiltration',
   'security-vuln-scan',
   'slopsquat-guard',
+  TASK_SCOPE_LEASE_EXPIRED_GATE_ID,
   ...SELF_PROTECT_HARD_FLOOR_GATE_IDS,
 ]);
 // Issue #2782 (reported by Andy Martin, 2026-07-08): after the free-tier daily
@@ -161,6 +169,7 @@ const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
 // map directly to CLAUDE.md's own hard-block list and must never be subject
 // to the daily cap discount, regardless of tier or strict-mode setting.
 const CATASTROPHIC_DECLARATIVE_GATE_IDS = new Set([
+  TASK_SCOPE_LEASE_EXPIRED_GATE_ID,
   'force-push',
   'git-reset-hard',
   'git-clean-force',
@@ -425,6 +434,25 @@ function clampTtlMs(value, fallbackMs) {
   return Math.min(Math.max(numeric, 60 * 1000), 24 * 60 * 60 * 1000);
 }
 
+// Default lease when a caller asks for one without saying how long. clampTtlMs floors at 60s.
+const TASK_SCOPE_LEASE_MS = 15 * 60 * 1000;
+
+/**
+ * A task scope with no `expiresAt` is permanent — that is the historical contract and every
+ * existing scope on disk has it. Only a scope that explicitly took a lease can expire.
+ */
+function isTaskScopeExpired(taskScope, nowMs = Date.now()) {
+  if (!taskScope || typeof taskScope !== 'object') return false;
+  // `expiresAt: null` means permanent, and it MUST be checked before the numeric coercion:
+  // Number(null) is 0, not NaN, so a null deadline would otherwise read as "expired in 1970".
+  // Combined with fail-closed enforcement that would revoke authority from every permanent
+  // scope the moment this shipped. Caught by tests/task-scope-lease.test.js.
+  if (taskScope.expiresAt == null) return false;
+  const deadline = Number(taskScope.expiresAt);
+  if (!Number.isFinite(deadline)) return false;
+  return nowMs >= deadline;
+}
+
 function loadGovernanceState() {
   const raw = loadJSON(module.exports.GOVERNANCE_STATE_PATH);
   const state = {
@@ -438,6 +466,12 @@ function loadGovernanceState() {
       : null,
   };
   const now = Date.now();
+  // Annotate rather than delete. A vanished scope is indistinguishable from one never set, and
+  // the difference matters: "your lease lapsed, renew it" is a different instruction from
+  // "you never declared a scope".
+  if (state.taskScope) {
+    state.taskScope = { ...state.taskScope, expired: isTaskScopeExpired(state.taskScope, now) };
+  }
   const activeApprovals = state.protectedApprovals.filter((entry) => {
     if (!entry || typeof entry !== 'object') return false;
     if (!entry.timestamp || !entry.expiresAt) return false;
@@ -485,6 +519,11 @@ function setTaskScope(scopeInput = {}) {
       ? scopeInput.protectedPaths
       : DEFAULT_PROTECTED_FILE_GLOBS
   ), repoPath);
+  // Optional LEASE. Without ttlMs the scope is permanent, which is the historical behaviour
+  // and stays byte-identical. With ttlMs the scope becomes time-bounded authority: "write under
+  // ./src for 90 seconds" rather than a standing approval that never says when it stops.
+  const scopeNow = Date.now();
+  const leaseMs = scopeInput.ttlMs == null ? null : clampTtlMs(scopeInput.ttlMs, TASK_SCOPE_LEASE_MS);
   const taskScope = {
     taskId: String(scopeInput.taskId || '').trim() || null,
     summary: String(scopeInput.summary || '').trim() || null,
@@ -493,7 +532,9 @@ function setTaskScope(scopeInput = {}) {
     localOnly: scopeInput.localOnly === true,
     repoPath,
     createdAt: new Date().toISOString(),
-    timestamp: Date.now(),
+    timestamp: scopeNow,
+    leaseMs,
+    expiresAt: leaseMs == null ? null : scopeNow + leaseMs,
   };
   const state = loadGovernanceState();
   state.taskScope = taskScope;
@@ -1195,11 +1236,28 @@ const COMMAND_WRAPPERS = new Set([
 ]);
 const ENV_ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]*)\s+/;
 const WRAPPER_HEAD = /^([A-Za-z_][\w.-]*)\s+/;
+const LITERAL_COMMAND_SUBSTITUTION_HEADS = [
+  /^\$\(\s*printf\s+(?:(?:['"]?%s['"]?)\s+)?(['"]?)([A-Za-z_][\w.-]*)\1\s*\)\s+/,
+  /^\$\(\s*echo\s+(['"]?)([A-Za-z_][\w.-]*)\1\s*\)\s+/,
+  /^\$\(\s*(?:command\s+-v|which)\s+(['"]?)([A-Za-z_][\w.-]*)\1\s*\)\s+/,
+];
+
+function canonicalizeLiteralCommandSubstitutionHead(segment) {
+  for (const pattern of LITERAL_COMMAND_SUBSTITUTION_HEADS) {
+    const match = String(segment || '').match(pattern);
+    if (match) return `${match[2]} ${String(segment).slice(match[0].length)}`;
+  }
+  return segment;
+}
 
 function canonicalizeSegmentHead(segment) {
   let text = String(segment || '').trim();
   for (let i = 0; i < 12; i += 1) {
     const before = text;
+    // Resolve only literal, side-effect-free command-position substitutions.
+    // Never execute or guess arbitrary shell; this closes common `$(printf git)`
+    // and `$(command -v git)` spellings while keeping matching deterministic.
+    text = canonicalizeLiteralCommandSubstitutionHead(text);
     text = text.replace(ENV_ASSIGNMENT_PREFIX, '');
     const wrapper = text.match(WRAPPER_HEAD);
     if (wrapper && COMMAND_WRAPPERS.has(wrapper[1].toLowerCase())) {
@@ -1921,8 +1979,23 @@ function formatFileList(files, limit = 5) {
   return `${items.slice(0, limit).join(', ')} (+${items.length - limit} more)`;
 }
 
-function buildTaskScopeViolation(taskScope, affectedFiles) {
+function buildTaskScopeViolation(taskScope, affectedFiles, nowMs = Date.now()) {
   if (!Array.isArray(affectedFiles) || affectedFiles.length === 0) return null;
+  // EXPIRY FAILS CLOSED, and that direction is the whole point.
+  //
+  // A task scope is a restriction, so simply dropping it on expiry would make the agent MORE
+  // powerful the moment its lease ran out — expiry would remove a boundary instead of removing
+  // authority. A lease has to mean the opposite: while it is live you may work in these paths,
+  // and when it lapses the authority is gone until it is renewed.
+  if (taskScope && isTaskScopeExpired(taskScope, nowMs)) {
+    return {
+      reasonCode: 'expired_task_scope',
+      outsideFiles: affectedFiles.slice(),
+      allowedPaths: Array.isArray(taskScope.allowedPaths) ? taskScope.allowedPaths.slice() : [],
+      summary: taskScope.summary || null,
+      expiresAt: taskScope.expiresAt || null,
+    };
+  }
   if (!taskScope || !Array.isArray(taskScope.allowedPaths) || taskScope.allowedPaths.length === 0) {
     return {
       reasonCode: 'missing_task_scope',
@@ -1995,6 +2068,11 @@ function buildBranchGovernanceViolation(governanceState, toolInput = {}, affecte
 function buildGateMessage(gate, matchDetails) {
   if (matchDetails && matchDetails.taskScopeViolation) {
     const violation = matchDetails.taskScopeViolation;
+    if (violation.reasonCode === 'expired_task_scope') {
+      const lapsed = violation.expiresAt ? new Date(violation.expiresAt).toISOString() : 'unknown time';
+      return `The task-scope lease expired at ${lapsed}, so its authority no longer applies. `
+        + `Renew it with set_task_scope (allowed paths were: ${formatFileList(violation.allowedPaths)}).`;
+    }
     if (violation.reasonCode === 'missing_task_scope') {
       return `No task scope is declared for this high-risk action. Affected files: ${formatFileList(violation.outsideFiles)}.`;
     }
@@ -2760,7 +2838,13 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
     });
 
     if (gate.action === 'block') {
-      const denyResult = { decision: 'deny', gate: gate.id, message, severity: gate.severity, reasoning };
+      // Expired leases report under their own gate id so neither the enforcement posture nor
+      // the daily block cap can quietly turn this denial into a warning.
+      const gateId = matchDetails && matchDetails.taskScopeViolation
+        && matchDetails.taskScopeViolation.reasonCode === 'expired_task_scope'
+        ? TASK_SCOPE_LEASE_EXPIRED_GATE_ID
+        : gate.id;
+      const denyResult = { decision: 'deny', gate: gateId, message, severity: gate.severity, reasoning };
       // Free-tier daily block cap: after N blocks/day, deny → warn + upgrade CTA
       const cappedResult = applyDailyBlockCap(denyResult);
       if (cappedResult) {
@@ -2973,7 +3057,13 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
     const reasoning = buildReasoning(gate, toolName, toolInput, matchDetails);
 
     if (gate.action === 'block') {
-      const denyResult = { decision: 'deny', gate: gate.id, message, severity: gate.severity, reasoning };
+      // Expired leases report under their own gate id so neither the enforcement posture nor
+      // the daily block cap can quietly turn this denial into a warning.
+      const gateId = matchDetails && matchDetails.taskScopeViolation
+        && matchDetails.taskScopeViolation.reasonCode === 'expired_task_scope'
+        ? TASK_SCOPE_LEASE_EXPIRED_GATE_ID
+        : gate.id;
+      const denyResult = { decision: 'deny', gate: gateId, message, severity: gate.severity, reasoning };
       // Free-tier daily block cap: after N blocks/day, deny → warn + upgrade CTA
       const cappedResult = applyDailyBlockCap(denyResult);
       if (cappedResult) {
@@ -3968,6 +4058,10 @@ module.exports = {
   loadGovernanceState,
   saveGovernanceState,
   setTaskScope,
+  isTaskScopeExpired,
+  TASK_SCOPE_LEASE_EXPIRED_GATE_ID,
+  applyEnforcementPosture,
+  buildTaskScopeViolation,
   setBranchGovernance,
   approveProtectedAction,
   breakGlassEmergency,

package/scripts/generate-case-study-outreach.js

@@ -0,0 +1,253 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * generate-case-study-outreach.js — buyer outreach pack from dogfood case studies.
+ *
+ * No fabricated customer logos. Packs are built from public case-study anchors
+ * with first-party UTMs for the cash path.
+ *
+ *   node scripts/generate-case-study-outreach.js --case=sudo-evasion
+ *   node scripts/generate-case-study-outreach.js --case=sudo-evasion --json
+ *   node scripts/generate-case-study-outreach.js --case=sudo-evasion --write
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const PROJECT_ROOT = path.resolve(__dirname, '..');
+const DEFAULT_OUT_DIR = path.join(PROJECT_ROOT, 'docs', 'proof', 'outreach');
+
+const CASES = Object.freeze({
+  'sudo-evasion': {
+    id: 'sudo-evasion',
+    title: 'A guardrail you could walk past with sudo',
+    anchor: 'sudo-evasion',
+    problem: 'Catastrophic PreToolUse gates matched the happy path but missed wrappers like `sudo rm -rf ~`.',
+    metric: '62 evasion holes → 0 on the published npm artifact',
+    result: 'Canonicalization + an adversarial grid (14 commands × 9 transforms) closed the class; CI + 6-hourly published-artifact jobs keep it closed.',
+    buyerPain: 'Your coding agent can re-spell a blocked command and walk past a regex denylist.',
+    ctaPrimary: 'diagnostic',
+    proofLinks: {
+      caseStudyPath: '/case-studies#sudo-evasion',
+      scorecardPath: '/eval-scorecard',
+      whitepaperPath: '/whitepaper',
+      diagnosticPath: '/diagnostic',
+      proPath: '/checkout/pro',
+    },
+  },
+  'fail-open': {
+    id: 'fail-open',
+    title: 'Production failure: a firewall enforcing nothing',
+    anchor: 'fail-open',
+    problem: 'A missing PreToolUse hook binary fails open — the product looked fine while blocking nothing.',
+    metric: 'Silent-gate canary + published-artifact deny checks',
+    result: 'Enforcement restored and verified with known-dangerous commands; silence is now treated as a P0 class.',
+    buyerPain: 'Green uptime does not mean your agent firewall is still firing.',
+    ctaPrimary: 'diagnostic',
+    proofLinks: {
+      caseStudyPath: '/case-studies#fail-open',
+      scorecardPath: '/eval-scorecard',
+      whitepaperPath: '/whitepaper',
+      diagnosticPath: '/diagnostic',
+      proPath: '/checkout/pro',
+    },
+  },
+});
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const args = {
+    caseId: 'sudo-evasion',
+    json: false,
+    write: false,
+    help: false,
+    outDir: DEFAULT_OUT_DIR,
+    baseUrl: 'https://thumbgate.ai',
+  };
+  for (const arg of argv) {
+    if (arg === '--json') args.json = true;
+    else if (arg === '--write') args.write = true;
+    else if (arg === '--help' || arg === '-h') args.help = true;
+    else if (arg.startsWith('--case=')) args.caseId = arg.slice('--case='.length);
+    else if (arg.startsWith('--out-dir=')) args.outDir = path.resolve(arg.slice('--out-dir='.length));
+    else if (arg.startsWith('--base-url=')) args.baseUrl = arg.slice('--base-url='.length).replace(/\/$/, '');
+  }
+  return args;
+}
+
+function printHelp() {
+  console.log(`Usage: node scripts/generate-case-study-outreach.js --case=<id> [--write] [--json]
+
+Cases: ${Object.keys(CASES).join(', ')}
+`);
+}
+
+function withUtm(baseUrl, pathAndHash, campaign, content) {
+  const [pathname, hash = ''] = pathAndHash.split('#');
+  const url = new URL(pathname, baseUrl);
+  url.searchParams.set('utm_source', 'case_study_outreach');
+  url.searchParams.set('utm_medium', content);
+  url.searchParams.set('utm_campaign', campaign);
+  url.searchParams.set('cta_id', `${campaign}_${content}`);
+  const hashPart = hash ? `#${hash}` : '';
+  return `${url.toString()}${hashPart}`;
+}
+
+function buildPack(caseDef, options = {}) {
+  const baseUrl = options.baseUrl || 'https://thumbgate.ai';
+  const campaign = `case_${caseDef.id.replace(/-/g, '_')}`;
+  const links = {
+    caseStudy: withUtm(baseUrl, caseDef.proofLinks.caseStudyPath, campaign, 'case_study'),
+    scorecard: withUtm(baseUrl, caseDef.proofLinks.scorecardPath, campaign, 'scorecard'),
+    whitepaper: withUtm(baseUrl, caseDef.proofLinks.whitepaperPath, campaign, 'whitepaper'),
+    diagnostic: withUtm(baseUrl, caseDef.proofLinks.diagnosticPath, campaign, 'diagnostic'),
+    pro: withUtm(baseUrl, `${caseDef.proofLinks.proPath}`, campaign, 'pro'),
+  };
+
+  const linkedin = [
+    caseDef.buyerPain,
+    '',
+    `We dogfooded this on ThumbGate itself: ${caseDef.metric}.`,
+    caseDef.result,
+    '',
+    `Full write-up (no fabricated logos): ${links.caseStudy}`,
+    `Live bench scorecard: ${links.scorecard}`,
+    '',
+    `If one repeated AI-agent failure is already costing you, the $499 Diagnostic installs one hard gate with regression proof: ${links.diagnostic}`,
+  ].join('\n');
+
+  const email = [
+    `Subject: Your agent can walk past a regex denylist`,
+    '',
+    `Hi —`,
+    '',
+    caseDef.buyerPain,
+    '',
+    `Concrete proof from our own product loop (not a customer logo page):`,
+    `- ${caseDef.metric}`,
+    `- ${caseDef.result}`,
+    '',
+    `Case study: ${links.caseStudy}`,
+    `Scorecard: ${links.scorecard}`,
+    `White paper: ${links.whitepaper}`,
+    '',
+    `If you want this on one painful workflow this week: ${links.diagnostic}`,
+    `Self-serve Pro: ${links.pro}`,
+    '',
+    `— Igor`,
+  ].join('\n');
+
+  const reddit = [
+    `**Problem:** ${caseDef.problem}`,
+    '',
+    `**What we measured:** ${caseDef.metric}`,
+    '',
+    `**What fixed it:** ${caseDef.result}`,
+    '',
+    `Public case study (dogfood, not a fake logo wall): ${links.caseStudy}`,
+    `Bench scorecard: ${links.scorecard}`,
+  ].join('\n');
+
+  const markdown = [
+    `# Outreach pack — ${caseDef.title}`,
+    '',
+    `Case id: \`${caseDef.id}\``,
+    '',
+    '## Links (tracked)',
+    '',
+    `- Case study: ${links.caseStudy}`,
+    `- Scorecard: ${links.scorecard}`,
+    `- White paper: ${links.whitepaper}`,
+    `- Diagnostic $499: ${links.diagnostic}`,
+    `- Pro: ${links.pro}`,
+    '',
+    '## LinkedIn',
+    '',
+    linkedin,
+    '',
+    '## Email',
+    '',
+    '```',
+    email,
+    '```',
+    '',
+    '## Reddit / forum',
+    '',
+    reddit,
+    '',
+    '## Honesty',
+    '',
+    'First-party dogfood narrative only. Do not imply third-party customer endorsement.',
+    '',
+  ].join('\n');
+
+  return {
+    caseId: caseDef.id,
+    title: caseDef.title,
+    links,
+    channels: {
+      linkedin,
+      email,
+      reddit,
+    },
+    markdown,
+  };
+}
+
+function generate(options = {}) {
+  const caseId = options.caseId || 'sudo-evasion';
+  const caseDef = CASES[caseId];
+  if (!caseDef) {
+    throw new Error(`Unknown case id: ${caseId}. Known: ${Object.keys(CASES).join(', ')}`);
+  }
+  const pack = buildPack(caseDef, { baseUrl: options.baseUrl });
+  let outPath = null;
+  if (options.write) {
+    const outDir = options.outDir || DEFAULT_OUT_DIR;
+    fs.mkdirSync(outDir, { recursive: true });
+    outPath = path.join(outDir, `case-study-outreach-${caseId}.md`);
+    fs.writeFileSync(outPath, pack.markdown, 'utf8');
+  }
+  return { ...pack, outPath };
+}
+
+function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    printHelp();
+    return 0;
+  }
+  const result = generate(args);
+  if (args.json) {
+    console.log(JSON.stringify({
+      caseId: result.caseId,
+      title: result.title,
+      links: result.links,
+      channels: result.channels,
+      outPath: result.outPath,
+    }, null, 2));
+  } else if (result.outPath) {
+    console.log(`Wrote ${result.outPath}`);
+  } else {
+    console.log(result.markdown);
+  }
+  return 0;
+}
+
+if (path.resolve(process.argv[1] || '') === path.resolve(__filename)) {
+  try {
+    process.exitCode = main();
+  } catch (err) {
+    console.error(err.message || err);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = {
+  CASES,
+  parseArgs,
+  withUtm,
+  buildPack,
+  generate,
+  main,
+};