thumbgate 1.31.0 → 1.34.0

package/scripts/agent-readiness.js

@@ -165,6 +165,95 @@ function summarizePermissionTier(profileName = getActiveMcpProfile()) {
   };
 }
 
+
+function detectStopHookRegistered(projectRoot, existsSync, readFileSync) {
+  try {
+    const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
+    if (!existsSync(settingsPath)) return false;
+    const settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+    const stopHooks = settings?.hooks?.Stop || [];
+    const flat = Array.isArray(stopHooks)
+      ? stopHooks.flatMap((entry) => entry?.hooks || [entry])
+      : [];
+    return flat.some((hook) => String(hook?.command || '').includes('hook-stop-anti-claim'));
+  } catch {
+    return false;
+  }
+}
+
+function recommendationForClaimState({
+  evaluatorReady,
+  configLoadFailed,
+  verifierCount,
+  stopHookRegistered,
+  configSource,
+  loadErrorMessage,
+}) {
+  if (!evaluatorReady) {
+    return 'Universal claim evaluator module is missing from this install.';
+  }
+  if (configLoadFailed) {
+    return loadErrorMessage;
+  }
+  if (verifierCount === 0) {
+    return 'No claim verifiers configured. Copy config/gates/claim-verifiers.example.json to .thumbgate/claim-verifiers.json and point subjects at your sources of truth.';
+  }
+  if (!stopHookRegistered) {
+    return 'Claim verifiers are present, but the Claude Stop anti-claim hook is not registered in .claude/settings.json.';
+  }
+  return `Factual claim recheck is ready (${verifierCount} verifier(s) from ${configSource}).`;
+}
+
+function summarizeClaimVerification(projectRoot = PROJECT_ROOT, deps = {}) {
+  const resolveEvaluator = deps.resolveEvaluator
+    || (() => require.resolve('./universal-claim-evaluator'));
+  const loadVerifierConfig = deps.loadVerifierConfig
+    || (() => require('./universal-claim-evaluator').loadVerifierConfig);
+  const readFileSync = deps.readFileSync || fs.readFileSync;
+  const existsSync = deps.existsSync || fs.existsSync;
+
+  let evaluatorReady = false;
+  try {
+    resolveEvaluator();
+    evaluatorReady = true;
+  } catch {
+    evaluatorReady = false;
+  }
+
+  let verifierCount = 0;
+  let configSource = 'none';
+  let configLoadFailed = false;
+  let loadErrorMessage = 'Install ThumbGate and configure claim verifiers under .thumbgate/claim-verifiers.json.';
+  try {
+    const loaded = loadVerifierConfig()({ cwd: projectRoot });
+    verifierCount = Array.isArray(loaded.verifiers) ? loaded.verifiers.length : 0;
+    configSource = loaded.source || 'none';
+  } catch (error) {
+    configLoadFailed = true;
+    loadErrorMessage = `Claim verifier config failed to load: ${error?.message || 'unknown error'}`;
+  }
+
+  const stopHookRegistered = detectStopHookRegistered(projectRoot, existsSync, readFileSync);
+  const recommendation = recommendationForClaimState({
+    evaluatorReady,
+    configLoadFailed,
+    verifierCount,
+    stopHookRegistered,
+    configSource,
+    loadErrorMessage,
+  });
+
+  return {
+    ready: evaluatorReady && verifierCount > 0 && stopHookRegistered && !configLoadFailed,
+    evaluatorReady,
+    verifierCount,
+    configSource,
+    stopHookRegistered,
+    configLoadFailed,
+    recommendation,
+  };
+}
+
 function generateAgentReadinessReport({
   projectRoot = PROJECT_ROOT,
   mcpProfile = null,
@@ -172,11 +261,18 @@ function generateAgentReadinessReport({
   const runtime = detectRuntimeIsolation();
   const bootstrap = collectBootstrapFiles(projectRoot);
   const permissions = summarizePermissionTier(mcpProfile || getActiveMcpProfile());
+  const claimVerification = summarizeClaimVerification(projectRoot);
 
   const warnings = [];
   if (!runtime.isolated) warnings.push(runtime.recommendation);
   if (!bootstrap.ready) warnings.push(bootstrap.recommendation);
   if (!permissions.ready) warnings.push(permissions.recommendation);
+  // Missing operator verifiers is advisory (not every project asserts SQL row counts).
+  // A missing evaluator module or a broken claim-verifier config is not advisory —
+  // both make factual recheck fail closed at runtime and must surface here.
+  if (!claimVerification.evaluatorReady || claimVerification.configLoadFailed) {
+    warnings.push(claimVerification.recommendation);
+  }
 
   return {
     generatedAt: new Date().toISOString(),
@@ -185,10 +281,12 @@ function generateAgentReadinessReport({
     runtime,
     bootstrap,
     permissions,
+    claimVerification,
     articleAlignment: {
       runtimeIsolation: runtime.isolated,
       contextConditioning: bootstrap.ready,
       permissionEnvelope: permissions.ready,
+      factualClaimRecheck: claimVerification.ready,
     },
     warnings,
   };
@@ -208,6 +306,15 @@ function reportToText(report) {
   lines.push(`Permissions: ${report.permissions.profile} (${report.permissions.tier})`);
   lines.push(`  Write-capable tools: ${report.permissions.writeCapableTools.length}`);
   lines.push(`  Recommendation: ${report.permissions.recommendation}`);
+  if (report.claimVerification) {
+    lines.push(
+      `Claim verification: ${report.claimVerification.ready ? 'ready' : 'needs_attention'}`,
+      `  Evaluator: ${report.claimVerification.evaluatorReady ? 'present' : 'missing'}`,
+      `  Verifiers: ${report.claimVerification.verifierCount} (${report.claimVerification.configSource})`,
+      `  Stop hook: ${report.claimVerification.stopHookRegistered ? 'registered' : 'missing'}`,
+      `  Recommendation: ${report.claimVerification.recommendation}`,
+    );
+  }
 
   if (report.warnings.length > 0) {
     lines.push('');
@@ -226,6 +333,9 @@ module.exports = {
   detectRuntimeIsolation,
   collectBootstrapFiles,
   summarizePermissionTier,
+  summarizeClaimVerification,
+  recommendationForClaimState,
+  detectStopHookRegistered,
   generateAgentReadinessReport,
   reportToText,
 };

package/scripts/auto-wire-hooks.js

@@ -17,6 +17,7 @@ const fs = require('fs');
 const path = require('path');
 const {
   cacheUpdateHookCommand,
+  claimStopHookCommand,
   codexCacheUpdateHookCommand,
   codexPreToolHookCommand,
   codexSessionStartHookCommand,
@@ -36,7 +37,7 @@ function getHome() {
 // --- Hook definitions ---
 const CLAUDE_HOOKS = {
   PreToolUse: {
-    matcher: 'Bash|Edit|Write|MultiEdit',
+    matcher: '.*',
     hooks: [{ type: 'command', command: preToolHookCommand() }],
   },
   UserPromptSubmit: {
@@ -49,11 +50,14 @@ const CLAUDE_HOOKS = {
   SessionStart: {
     hooks: [{ type: 'command', command: sessionStartHookCommand() }],
   },
+  Stop: {
+    hooks: [{ type: 'command', command: claimStopHookCommand() }],
+  },
 };
 
 const CODEX_HOOKS = {
   PreToolUse: {
-    matcher: 'Bash',
+    matcher: '.*',
     hooks: [{ type: 'command', command: codexPreToolHookCommand() }],
   },
   UserPromptSubmit: {
@@ -384,6 +388,7 @@ function wireClaudeHooks(options) {
     UserPromptSubmit: /(hook-auto-capture\.sh|hook-auto-capture\b)/,
     PostToolUse: /(hook-thumbgate-cache-updater|cache-update\b)/,
     SessionStart: /(thumbgate_session_start\.sh|session-start\b)/,
+    Stop: /(hook-stop-anti-claim\.js|claim-stop-check\b)/,
   };
 
   for (const [lifecycle, hookDef] of Object.entries(CLAUDE_HOOKS)) {
@@ -456,8 +461,13 @@ function codexTomlConfigPath(configPath = codexConfigPath()) {
   return path.join(path.dirname(configPath), 'config.toml');
 }
 
+function escapeRegexLiteral(value) {
+  return String(value).replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+}
+
 function tomlSectionRegex(name) {
-  return new RegExp(`^\\[${String(name).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\]\\n(?:^(?!\\[).*(?:\\n|$))*`, 'm');
+  const sectionName = escapeRegexLiteral(name);
+  return new RegExp(String.raw`^\[${sectionName}\]\n(?:^(?!\[).*(?:\n|$))*`, 'm');
 }
 
 function codexUserPromptTomlBlock() {
@@ -470,10 +480,11 @@ function upsertCodexUserPromptToml(configPath, dryRun = false) {
   const current = fs.existsSync(tomlPath) ? fs.readFileSync(tomlPath, 'utf8') : '';
   const canonicalBlock = codexUserPromptTomlBlock();
   const sectionRegex = tomlSectionRegex('hooks.user_prompt_submit');
-  let next = current;
+  const existingMatch = sectionRegex.exec(current);
+  let next;
 
-  if (sectionRegex.test(current)) {
-    const existingBlock = current.match(sectionRegex)[0];
+  if (existingMatch) {
+    const existingBlock = existingMatch[0];
     if (existingBlock === canonicalBlock) {
       return { changed: false, settingsPath: tomlPath };
     }
@@ -610,7 +621,7 @@ function wireGeminiHooks(options) {
   if (!hookAlreadyPresent(settings.hooks.PreToolUse, preToolCmd)) {
     settings.hooks.PreToolUse = settings.hooks.PreToolUse || [];
     settings.hooks.PreToolUse.push({
-      matcher: 'Bash',
+      matcher: '.*',
       hooks: [{ type: 'command', command: preToolCmd }],
     });
     added.push({ lifecycle: 'PreToolUse', command: preToolCmd });
@@ -661,7 +672,7 @@ function wireForgeHooks(options) {
   if (!hookAlreadyPresent(existing.hooks.PreToolUse, preToolCmd)) {
     existing.hooks.PreToolUse = existing.hooks.PreToolUse || [];
     existing.hooks.PreToolUse.push({
-      matcher: 'Bash',
+      matcher: '.*',
       hooks: [{ type: 'command', command: preToolCmd }],
     });
     added.push({ lifecycle: 'PreToolUse', command: preToolCmd });
@@ -765,6 +776,7 @@ module.exports = {
   pruneStaleHooksInFile,
   CLAUDE_HOOKS,
   preToolHookCommand,
+  claimStopHookCommand,
   userPromptHookCommand,
   sessionStartHookCommand,
 };

package/scripts/cli-schema.js

@@ -505,6 +505,20 @@ const CLI_COMMANDS = [
     group: 'gates',
     flags: [],
   },
+  {
+    name: 'verify-claims',
+    aliases: ['verify-claim'],
+    description: 'Recheck factual claims against configured SQLite, filesystem, and JSON sources',
+    group: 'gates',
+    mcpTool: 'verify_claim',
+    flags: [
+      { name: 'claim', type: 'string', required: true, description: 'Factual claim text to verify' },
+      { name: 'config', type: 'string', description: 'Verifier config path (default .thumbgate/claim-verifiers.json)' },
+      { name: 'cwd', type: 'string', description: 'Root directory that contains configured sources' },
+      { name: 'advisory', type: 'boolean', description: 'Do not fail an otherwise parseable claim only because no verifier is configured' },
+      { name: 'json', type: 'boolean', description: 'Output a machine-readable verdict' },
+    ],
+  },
   {
     name: 'hermes-gate',
     description: 'Hermes Agent pre_tool_call hook: gate runtime tool calls (incl. skill_manage) before they run',

package/scripts/feedback-schema.js

@@ -31,6 +31,9 @@ const {
 } = require('./feedback-quality');
 
 const INFERRED_TAG_RULES = [
+  { tag: 'claw-style', keywords: ['claw', 'enterprise-claw', 'openshell', 'dynamic-tool', 'screen-interaction', 'computer-use'] },
+  { tag: 'hybrid-inference', keywords: ['hybrid', 'cloud-escalation', 'local-route', 'hybrid-route', 'perplexity-pc'] },
+  { tag: 'agent-identity', keywords: ['agent identity', 'audit trail', 'identity separation', 'agent-credential'] },
   { tag: 'thumbgate', keywords: ['thumbgate', 'feedback-loop', 'statusline', 'dashboard', 'mcp'] },
   { tag: 'testing', keywords: ['test', 'testing', 'jest', 'coverage', 'verify', 'verification'] },
   { tag: 'security', keywords: ['security', 'secret', 'credential', 'token', 'auth'] },

package/scripts/file-ledger-lock.js

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Cross-process lock for append-only local ledgers.
+ *
+ * `mkdir` is the atomic acquisition primitive. An owner record prevents a
+ * crashed process from permanently wedging the control plane, while a nonce
+ * check prevents an old owner from deleting a replacement lock.
+ */
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const DEFAULT_STALE_MS = 30 * 1000;
+
+function withFileLedgerLock(lockPath, callback, options = {}) {
+  const resolvedLockPath = path.resolve(lockPath);
+  fs.mkdirSync(path.dirname(resolvedLockPath), { recursive: true });
+  const owner = acquireLock(resolvedLockPath, options);
+  try {
+    if (typeof options.beforeCallback === 'function') options.beforeCallback();
+    return callback();
+  } finally {
+    releaseOwnedLock(resolvedLockPath, owner);
+  }
+}
+
+function acquireLock(lockPath, options) {
+  const now = options.now || new Date();
+  const staleMs = positiveNumber(options.lockStaleMs, DEFAULT_STALE_MS);
+  const owner = {
+    schemaVersion: 'thumbgate-ledger-lock-v1',
+    pid: process.pid,
+    nonce: crypto.randomUUID(),
+    acquiredAt: now.toISOString(),
+  };
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      fs.mkdirSync(lockPath);
+      writeOwner(lockPath, owner);
+      return owner;
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      if (!recoverStaleLock(lockPath, now, staleMs)) {
+        throw lockError(options, 'ledger is busy; deny and retry only after the active writer finishes');
+      }
+    }
+  }
+  throw lockError(options, 'ledger lock could not be acquired after stale-lock recovery');
+}
+
+function recoverStaleLock(lockPath, now, staleMs) {
+  const observed = readOwner(lockPath);
+  const ageMs = lockAgeMs(lockPath, observed, now);
+  if (ageMs < staleMs || processIsAlive(observed?.pid)) return false;
+
+  // Rename is atomic. If another process already recovered or replaced the
+  // lock, this attempt loses harmlessly and acquisition is retried.
+  const quarantine = `${lockPath}.stale-${process.pid}-${crypto.randomUUID()}`;
+  try {
+    fs.renameSync(lockPath, quarantine);
+  } catch (error) {
+    if (['ENOENT', 'EEXIST'].includes(error.code)) return true;
+    throw error;
+  }
+  fs.rmSync(quarantine, { recursive: true, force: true });
+  return true;
+}
+
+function writeOwner(lockPath, owner) {
+  const target = path.join(lockPath, 'owner.json');
+  const temporary = `${target}.tmp-${process.pid}-${owner.nonce}`;
+  fs.writeFileSync(temporary, `${JSON.stringify(owner)}\n`, { encoding: 'utf8', mode: 0o600 });
+  fs.renameSync(temporary, target);
+}
+
+function readOwner(lockPath) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(lockPath, 'owner.json'), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function lockAgeMs(lockPath, owner, now) {
+  const recorded = Date.parse(owner?.acquiredAt || '');
+  if (Number.isFinite(recorded)) return Math.max(0, now.getTime() - recorded);
+  try {
+    return Math.max(0, now.getTime() - fs.statSync(lockPath).mtimeMs);
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+}
+
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code !== 'ESRCH';
+  }
+}
+
+function releaseOwnedLock(lockPath, owner) {
+  const recorded = readOwner(lockPath);
+  if (!recorded || recorded.nonce !== owner.nonce) return;
+  try { fs.unlinkSync(path.join(lockPath, 'owner.json')); } catch (error) {
+    if (error.code !== 'ENOENT') return;
+  }
+  try { fs.rmdirSync(lockPath); } catch { /* a replacement owner wins */ }
+}
+
+function positiveNumber(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) && number > 0 ? number : fallback;
+}
+
+function lockError(options, message) {
+  return typeof options.errorFactory === 'function'
+    ? options.errorFactory(message)
+    : Object.assign(new Error(message), { code: 'THUMBGATE_LEDGER_BUSY' });
+}
+
+module.exports = {
+  DEFAULT_STALE_MS,
+  withFileLedgerLock,
+};