thumbgate 1.30.0 → 1.34.0

package/scripts/gates-engine.js

@@ -16,6 +16,13 @@ const {
 const {
   evaluateWorkflowSentinel,
 } = require('./workflow-sentinel');
+const {
+  evaluateFinancialControl,
+} = require('./financial-control-plane');
+const {
+  buildCostControl,
+  normalizeProviderAction,
+} = require('./provider-action-normalizer');
 const {
   recordDecisionEvaluation,
   recordDecisionOutcome,
@@ -1236,11 +1243,28 @@ const COMMAND_WRAPPERS = new Set([
 ]);
 const ENV_ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]*)\s+/;
 const WRAPPER_HEAD = /^([A-Za-z_][\w.-]*)\s+/;
+const LITERAL_COMMAND_SUBSTITUTION_HEADS = [
+  /^\$\(\s*printf\s+(?:(?:['"]?%s['"]?)\s+)?(['"]?)([A-Za-z_][\w.-]*)\1\s*\)\s+/,
+  /^\$\(\s*echo\s+(['"]?)([A-Za-z_][\w.-]*)\1\s*\)\s+/,
+  /^\$\(\s*(?:command\s+-v|which)\s+(['"]?)([A-Za-z_][\w.-]*)\1\s*\)\s+/,
+];
+
+function canonicalizeLiteralCommandSubstitutionHead(segment) {
+  for (const pattern of LITERAL_COMMAND_SUBSTITUTION_HEADS) {
+    const match = String(segment || '').match(pattern);
+    if (match) return `${match[2]} ${String(segment).slice(match[0].length)}`;
+  }
+  return segment;
+}
 
 function canonicalizeSegmentHead(segment) {
   let text = String(segment || '').trim();
   for (let i = 0; i < 12; i += 1) {
     const before = text;
+    // Resolve only literal, side-effect-free command-position substitutions.
+    // Never execute or guess arbitrary shell; this closes common `$(printf git)`
+    // and `$(command -v git)` spellings while keeping matching deterministic.
+    text = canonicalizeLiteralCommandSubstitutionHead(text);
     text = text.replace(ENV_ASSIGNMENT_PREFIX, '');
     const wrapper = text.match(WRAPPER_HEAD);
     if (wrapper && COMMAND_WRAPPERS.has(wrapper[1].toLowerCase())) {
@@ -1919,6 +1943,43 @@ function recordStructuralGateBlock(toolName, toolInput, result) {
   return result;
 }
 
+/**
+ * Resolve catastrophic declarative gates before the ordinary first-match loop.
+ *
+ * Config order is useful for normal policy routing, but it must not let a broad
+ * rule mask a narrower irreversible-action rule. For example, the generic
+ * `push-without-thread-check` gate also matches `git push --force`; selecting it
+ * first allowed the free-tier daily cap to downgrade the action to a warning
+ * before the exempt `force-push` gate was ever evaluated.
+ *
+ * Catastrophic gates are deliberately limited to the audited allowlist above.
+ * Metric-backed gates are excluded because their condition is asynchronous and
+ * none of the catastrophic command boundaries may depend on a remote metric.
+ */
+function evaluateCatastrophicDeclarativeGate(config, constraints, toolName, toolInput) {
+  if (!config || !Array.isArray(config.gates)) return null;
+
+  for (const gate of config.gates) {
+    if (!CATASTROPHIC_DECLARATIVE_GATE_IDS.has(gate.id)) continue;
+    if (gate.action !== 'block' || gate.metrics) continue;
+
+    const matchDetails = matchGate(gate, toolName, toolInput);
+    if (!matchDetails.matched) continue;
+    if (gate.when && !checkWhenClause(gate.when, constraints)) continue;
+    if (gate.unless && isConditionSatisfied(gate.unless)) continue;
+
+    return {
+      decision: 'deny',
+      gate: gate.id,
+      message: buildGateMessage(gate, matchDetails),
+      severity: gate.severity,
+      reasoning: buildReasoning(gate, toolName, toolInput, matchDetails),
+    };
+  }
+
+  return null;
+}
+
 function isScopeEnforcedAction(toolName, toolInput = {}, affectedFiles = []) {
   if (EDIT_LIKE_TOOLS.has(toolName) && affectedFiles.length > 0) return true;
   if (toolName !== 'Bash') return false;
@@ -2759,6 +2820,16 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
     return boostedRiskGuard;
   }
 
+  const catastrophicDeclarativeGate = evaluateCatastrophicDeclarativeGate(
+    config,
+    constraints,
+    toolName,
+    toolInput,
+  );
+  if (catastrophicDeclarativeGate) {
+    return recordStructuralGateBlock(toolName, toolInput, catastrophicDeclarativeGate);
+  }
+
   // Tier 1b: Planning and Trajectory (v1.26.0 - CodeRabbit Pattern).
   // Keep runtime enforcement explicit so advisory planning checks do not mask
   // higher-priority deny/approve gates in established workflows.
@@ -3005,6 +3076,16 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
     return boostedRiskGuard;
   }
 
+  const catastrophicDeclarativeGate = evaluateCatastrophicDeclarativeGate(
+    config,
+    constraints,
+    toolName,
+    toolInput,
+  );
+  if (catastrophicDeclarativeGate) {
+    return recordStructuralGateBlock(toolName, toolInput, catastrophicDeclarativeGate);
+  }
+
   // Tier 1b: Planning and Trajectory (v1.26.0 - CodeRabbit Pattern).
   // Keep runtime enforcement explicit so advisory planning checks do not mask
   // higher-priority deny/approve gates in established workflows.
@@ -3286,7 +3367,7 @@ function evaluateSecretGuard(input = {}) {
   return result;
 }
 
-function evaluateUnconditionalHardFloor(input = {}) {
+function evaluateUnconditionalHardFloor(input = {}, options = {}) {
   const secretGuard = evaluateSecretGuard(input);
   if (secretGuard) return { hardFloor: secretGuard, securityScan: null };
 
@@ -3295,14 +3376,81 @@ function evaluateUnconditionalHardFloor(input = {}) {
     return { hardFloor: securityScan, securityScan };
   }
 
+  const financialHardFloor = evaluateFinancialHardFloor(input, false, options);
+  if (financialHardFloor) return { hardFloor: financialHardFloor, securityScan };
+
   return {
     hardFloor: evaluateSelfProtectHardFloor(input),
     securityScan,
   };
 }
 
-function runHardFloor(input) {
-  const { hardFloor } = evaluateUnconditionalHardFloor(input);
+function evaluateFinancialHardFloor(input = {}, consumeReservation = false, options = {}) {
+  const toolName = input.tool_name || input.toolName || 'unknown';
+  const toolInput = input.tool_input && typeof input.tool_input === 'object'
+    ? input.tool_input
+    : {};
+  const normalizedAction = normalizeProviderAction({
+    toolName,
+    toolInput,
+    usage: input.usage || toolInput.usage,
+    costUsd: input.costUsd ?? toolInput.costUsd,
+    budget: input.budget || toolInput.budget,
+  });
+  const costControl = buildCostControl(
+    normalizedAction,
+    input.budget || toolInput.budget || {}
+  );
+  const financialControl = evaluateFinancialControl({
+    toolName,
+    toolInput,
+    actionProfile: {
+      economicAction: undefined,
+    },
+    costControl,
+  }, { ...options, consumeReservation });
+  if (financialControl.mode === 'block') {
+    const result = {
+      decision: 'deny',
+      gate: 'financial-control',
+      message: financialControl.reasons.join(' '),
+      severity: 'critical',
+      financialControl,
+      reasoning: [
+        'Economic actions default to deny at the pre-tool boundary.',
+        'Learned policy and advisory memories cannot override this deterministic control.',
+      ],
+    };
+    recordStat('financial-control', 'block', null, { toolName, toolInput });
+    const auditRecord = recordAuditEvent({
+      toolName,
+      toolInput,
+      decision: 'deny',
+      gateId: 'financial-control',
+      message: result.message,
+      severity: result.severity,
+      source: 'financial-control',
+    });
+    auditToFeedback(auditRecord);
+    return result;
+  }
+  return null;
+}
+
+// Reservations are single-use. They are consumed only after every other gate
+// has reached its final allow/warn boundary, never during the preliminary hard
+// floor preview. This prevents a later workflow or learned-risk denial from
+// burning an approval for an action that did not execute.
+function finalizeFinancialAuthorization(input = {}, options = {}) {
+  return evaluateFinancialHardFloor(input, true, options);
+}
+
+function isBlockingDecision(result) {
+  return result?.decision === 'deny' || result?.decision === 'approve';
+}
+
+function runHardFloor(input, options = {}) {
+  const { hardFloor } = evaluateUnconditionalHardFloor(input, options);
   return hardFloor ? formatOutput(hardFloor) : null;
 }
 
@@ -3376,7 +3524,7 @@ function formatOutput(result, behavioralContext) {
   if (result.decision === 'deny') {
     const reminder = behavioralContext ? buildReminderOutput(behavioralContext) : {};
     const reminderSuffix = behavioralContext ? `\n\nSystem reminder:\n${behavioralContext}` : '';
-    const proCta = buildBlockActionProCta() || '';
+    const proCta = result.gate === 'financial-control' ? '' : (buildBlockActionProCta() || '');
     return JSON.stringify({
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
@@ -3690,10 +3838,18 @@ async function runAsync(input) {
   if (lessonContext && lessonContext.decision === "deny") {
     return formatOutput(applyEnforcementPosture(lessonContext));
   }
+
+  const posturedResult = applyEnforcementPosture(result);
+  if (isBlockingDecision(posturedResult)) {
+    return formatOutput(posturedResult);
+  }
+
+  const financialAuthorization = finalizeFinancialAuthorization(input);
+  if (financialAuthorization) return formatOutput(financialAuthorization);
   
   const recentContext = buildRecentCorrectiveActionsContext();
   const combinedContext = mergeContextStrings(lessonContext, recentContext, behavioralContext);
-  return formatOutput(applyEnforcementPosture(result), combinedContext);
+  return formatOutput(posturedResult, combinedContext);
 
 }
 
@@ -3729,10 +3885,18 @@ function run(input) {
   if (lessonContext && lessonContext.decision === "deny") {
     return formatOutput(applyEnforcementPosture(lessonContext));
   }
+
+  const posturedResult = applyEnforcementPosture(result);
+  if (isBlockingDecision(posturedResult)) {
+    return formatOutput(posturedResult);
+  }
+
+  const financialAuthorization = finalizeFinancialAuthorization(input);
+  if (financialAuthorization) return formatOutput(financialAuthorization);
   
   const recentContext = buildRecentCorrectiveActionsContext();
   const combinedContext = mergeContextStrings(lessonContext, recentContext, behavioralContext);
-  return formatOutput(applyEnforcementPosture(result), combinedContext);
+  return formatOutput(posturedResult, combinedContext);
 
 }
 
@@ -4020,10 +4184,40 @@ function verifyClaimEvidence(claimText, options = {}) {
     });
   }
 
+  // Universal factual claims (row counts, file lines/bytes/existence, version values)
+  // recheck the configured source of truth. Fail-closed on mismatch or missing verifier.
+  let universal = null;
+  if (options.skipUniversal !== true) {
+    try {
+      const {
+        evaluateUniversalClaimsAsGateChecks,
+      } = require('./universal-claim-evaluator');
+      universal = evaluateUniversalClaimsAsGateChecks(normalizedClaimText, {
+        cwd: options.cwd,
+        verifiers: options.verifiers,
+        configPath: options.claimVerifiersPath,
+        config: options.claimVerifiers,
+        feedbackDir: options.feedbackDir,
+        failUnconfigured: options.failUnconfigured,
+      });
+      for (const check of universal.checks) {
+        checks.push(check);
+      }
+    } catch (error) {
+      checks.push({
+        claim: 'universal_evaluator',
+        passed: false,
+        missing: ['universal_claim_evaluator'],
+        message: `Universal claim evaluator failed closed: ${error && error.message ? error.message : 'unknown error'}`,
+      });
+    }
+  }
+
   return {
-    verified: checks.every((check) => check.passed),
+    verified: checks.length === 0 ? true : checks.every((check) => check.passed),
     checks,
     goalContract,
+    universal,
   };
 }
 
@@ -4071,6 +4265,7 @@ module.exports = {
   isAutonomousRun,
   computeExecutableHash,
   formatOutput,
+  finalizeFinancialAuthorization,
   isApprovalGatesEnabled,
   runHardFloor,
   run,

package/scripts/gemini-embedding-policy.js

@@ -190,6 +190,7 @@ module.exports = {
   GEMINI_TASK_TYPES,
   buildGeminiEmbeddingRolloutPlan,
   isSymmetricTask,
+  normalizeEmbeddingKind,
   normalizeOutputDimensionality,
   normalizeTask,
   prepareEmbeddingText,

package/scripts/harness-tool-names.js

@@ -0,0 +1,70 @@
+'use strict';
+
+/**
+ * Harness tool names -> canonical gate-engine names.
+ *
+ * Policy gates match Claude Code's vocabulary (Bash, Write, Edit, MultiEdit). Other
+ * harnesses use their own: Cline's .clinerules instructs the agent to gate-check
+ * `execute_command`, `write_to_file`, `replace_in_file` and `browser_action`.
+ * Forwarding those through unchanged meant every gate silently missed — a strict
+ * `gate_check` on `{tool_name: "execute_command", command: "rm -rf /"}` returned ALLOW,
+ * which is precisely the scenario the adapter advertises as protected.
+ *
+ * Argument keys differ too: Cline writes use `path`, Claude Code uses `file_path`.
+ */
+
+const TOOL_NAME_MAP = new Map(Object.entries({
+  // Cline / Roo Code
+  execute_command: 'Bash',
+  write_to_file: 'Write',
+  replace_in_file: 'Edit',
+  apply_diff: 'Edit',
+  insert_content: 'Edit',
+  search_and_replace: 'Edit',
+  // OpenCode / generic MCP
+  bash: 'Bash',
+  shell: 'Bash',
+  run_command: 'Bash',
+  edit_file: 'Edit',
+  write_file: 'Write',
+  create_file: 'Write',
+  str_replace_editor: 'Edit',
+  // Cursor
+  run_terminal_cmd: 'Bash',
+}));
+
+const ARG_KEY_MAP = new Map(Object.entries({
+  path: 'file_path',
+  filePath: 'file_path',
+  target_file: 'file_path',
+  cmd: 'command',
+  shell_command: 'command',
+  diff: 'new_string',
+}));
+
+function canonicalizeToolName(toolName) {
+  const raw = String(toolName || '').trim();
+  if (!raw) return raw;
+  return TOOL_NAME_MAP.get(raw) || TOOL_NAME_MAP.get(raw.toLowerCase()) || raw;
+}
+
+function canonicalizeToolInput(toolInput) {
+  if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput)) return toolInput || {};
+  const out = {};
+  for (const [key, value] of Object.entries(toolInput)) {
+    const canonicalKey = ARG_KEY_MAP.get(key) || key;
+    // Never let a mapped key clobber one the caller already supplied canonically.
+    if (canonicalKey in out) continue;
+    out[canonicalKey] = value;
+  }
+  return out;
+}
+
+function canonicalizeToolCall(toolName, toolInput) {
+  return {
+    toolName: canonicalizeToolName(toolName),
+    toolInput: canonicalizeToolInput(toolInput),
+  };
+}
+
+module.exports = { canonicalizeToolCall, canonicalizeToolName, canonicalizeToolInput, TOOL_NAME_MAP, ARG_KEY_MAP };

package/scripts/hook-runtime.js

@@ -51,13 +51,20 @@ function resolveCliCommand(subcommand) {
 }
 
 function resolveCodexCliCommand(subcommand) {
+  // Codex hooks live in user-global config. Pinning them to a disposable source
+  // worktree breaks every hook as soon as normal post-merge cleanup removes it.
+  // The stable @latest launcher stays offline at configuration time and survives
+  // cleanup. Checkout-pinned hooks remain available as an explicit dev override.
+  if (isSourceCheckout(PKG_ROOT) && process.env.THUMBGATE_CODEX_USE_SOURCE_RUNTIME === '1') {
+    return `node ${shellQuote(path.join(PKG_ROOT, 'bin', 'cli.js'))} ${subcommand}`;
+  }
+  if (isSourceCheckout(PKG_ROOT)) {
+    return publishedCliShellCommand('latest', [subcommand]);
+  }
   const version = packageVersion();
   if (publishedHookCommandsAvailable(version)) {
     return publishedCliShellCommand('latest', [subcommand]);
   }
-  if (isSourceCheckout(PKG_ROOT)) {
-    return `node ${shellQuote(path.join(PKG_ROOT, 'bin', 'cli.js'))} ${subcommand}`;
-  }
   return publishedCliShellCommand('latest', [subcommand]);
 }
 
@@ -85,6 +92,10 @@ function cacheUpdateHookCommand() {
   return buildPortableHookCommand('cache-update');
 }
 
+function claimStopHookCommand() {
+  return buildPortableHookCommand('claim-stop-check');
+}
+
 function statuslineCommand() {
   return buildPortableHookCommand('statusline-render');
 }
@@ -113,6 +124,7 @@ module.exports = {
   buildPortableHookCommand,
   buildCodexPortableHookCommand,
   cacheUpdateHookCommand,
+  claimStopHookCommand,
   codexCacheUpdateHookCommand,
   codexPreToolHookCommand,
   codexSessionStartHookCommand,

package/scripts/hook-stop-anti-claim.js

@@ -29,6 +29,9 @@
  */
 
 const fs = require('node:fs');
+const {
+  evaluateUniversalClaims,
+} = require('./universal-claim-evaluator');
 
 // Lie-phrase patterns. These match common "claim of completion" wording
 // the agent emits without verification. Word-boundary anchored to avoid
@@ -233,6 +236,45 @@ function readStdinSync() {
   }
 }
 
+function factualClaimBlock(text, options = {}) {
+  try {
+    const result = evaluateUniversalClaims(text, {
+      cwd: options.cwd,
+      configPath: options.configPath,
+      feedbackDir: options.feedbackDir,
+      failUnconfigured: true,
+    });
+    if (result.parsedCount === 0) return null;
+    if (result.verified) return null;
+    const failures = result.checks.filter((check) => !check.passed);
+    return {
+      decision: 'block',
+      reason: `ThumbGate factual-claim gate: ${failures.map((check) => check.message).join('; ')}. Recheck the configured source of truth and restate the observed value, or retract the claim.`,
+      verification: {
+        verified: false,
+        parsedCount: result.parsedCount,
+        failures: failures.map((check) => ({
+          status: check.status,
+          kind: check.kind,
+          verifierId: check.verifierId || null,
+          expected: check.expected,
+          actual: Object.hasOwn(check, 'actual') ? check.actual : null,
+        })),
+      },
+    };
+  } catch (error) {
+    return {
+      decision: 'block',
+      reason: `ThumbGate factual-claim gate failed closed: ${error.message}`,
+      verification: {
+        verified: false,
+        parsedCount: null,
+        failures: [{ status: 'evaluator_error' }],
+      },
+    };
+  }
+}
+
 function main() {
   const raw = readStdinSync();
   let payload = {};
@@ -242,12 +284,28 @@ function main() {
     payload = {};
   }
 
+  // Claude Code invokes a blocked Stop hook once more with this marker so the
+  // agent can correct its response. Re-blocking the same payload would hit the
+  // host's block cap instead of giving the agent a correction turn.
+  if (payload.stop_hook_active === true) return;
+
   const transcriptPath = payload.transcript_path || process.env.CLAUDE_TRANSCRIPT_PATH;
   const message = readLastAssistantTurn(transcriptPath);
-  if (!message) return; // no transcript visible; nothing to check
+  const text = message
+    ? extractText(message)
+    : String(payload.last_assistant_message || process.env.CLAUDE_RESPONSE || '');
+  if (!text.trim()) return; // no assistant response visible; nothing to check
+
+  const toolUseSummary = message ? extractToolUseSummary(message) : '';
+  const factualBlock = factualClaimBlock(text, {
+    cwd: payload.cwd || payload.workspace_root || process.cwd(),
+    configPath: process.env.THUMBGATE_CLAIM_VERIFIERS_PATH,
+  });
+  if (factualBlock) {
+    process.stdout.write(`${JSON.stringify(factualBlock)}\n`);
+    return;
+  }
 
-  const text = extractText(message);
-  const toolUseSummary = extractToolUseSummary(message);
   const claim = findClaim(text);
   if (!claim) return; // no completion claim made; silent
 
@@ -298,4 +356,6 @@ module.exports = {
   hasProof,
   extractText,
   extractToolUseSummary,
+  factualClaimBlock,
+  main,
 };