thumbgate 1.31.0 → 1.34.0

package/scripts/gates-engine.js

@@ -16,6 +16,13 @@ const {
 const {
   evaluateWorkflowSentinel,
 } = require('./workflow-sentinel');
+const {
+  evaluateFinancialControl,
+} = require('./financial-control-plane');
+const {
+  buildCostControl,
+  normalizeProviderAction,
+} = require('./provider-action-normalizer');
 const {
   recordDecisionEvaluation,
   recordDecisionOutcome,
@@ -1936,6 +1943,43 @@ function recordStructuralGateBlock(toolName, toolInput, result) {
   return result;
 }
 
+/**
+ * Resolve catastrophic declarative gates before the ordinary first-match loop.
+ *
+ * Config order is useful for normal policy routing, but it must not let a broad
+ * rule mask a narrower irreversible-action rule. For example, the generic
+ * `push-without-thread-check` gate also matches `git push --force`; selecting it
+ * first allowed the free-tier daily cap to downgrade the action to a warning
+ * before the exempt `force-push` gate was ever evaluated.
+ *
+ * Catastrophic gates are deliberately limited to the audited allowlist above.
+ * Metric-backed gates are excluded because their condition is asynchronous and
+ * none of the catastrophic command boundaries may depend on a remote metric.
+ */
+function evaluateCatastrophicDeclarativeGate(config, constraints, toolName, toolInput) {
+  if (!config || !Array.isArray(config.gates)) return null;
+
+  for (const gate of config.gates) {
+    if (!CATASTROPHIC_DECLARATIVE_GATE_IDS.has(gate.id)) continue;
+    if (gate.action !== 'block' || gate.metrics) continue;
+
+    const matchDetails = matchGate(gate, toolName, toolInput);
+    if (!matchDetails.matched) continue;
+    if (gate.when && !checkWhenClause(gate.when, constraints)) continue;
+    if (gate.unless && isConditionSatisfied(gate.unless)) continue;
+
+    return {
+      decision: 'deny',
+      gate: gate.id,
+      message: buildGateMessage(gate, matchDetails),
+      severity: gate.severity,
+      reasoning: buildReasoning(gate, toolName, toolInput, matchDetails),
+    };
+  }
+
+  return null;
+}
+
 function isScopeEnforcedAction(toolName, toolInput = {}, affectedFiles = []) {
   if (EDIT_LIKE_TOOLS.has(toolName) && affectedFiles.length > 0) return true;
   if (toolName !== 'Bash') return false;
@@ -2776,6 +2820,16 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
     return boostedRiskGuard;
   }
 
+  const catastrophicDeclarativeGate = evaluateCatastrophicDeclarativeGate(
+    config,
+    constraints,
+    toolName,
+    toolInput,
+  );
+  if (catastrophicDeclarativeGate) {
+    return recordStructuralGateBlock(toolName, toolInput, catastrophicDeclarativeGate);
+  }
+
   // Tier 1b: Planning and Trajectory (v1.26.0 - CodeRabbit Pattern).
   // Keep runtime enforcement explicit so advisory planning checks do not mask
   // higher-priority deny/approve gates in established workflows.
@@ -3022,6 +3076,16 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
     return boostedRiskGuard;
   }
 
+  const catastrophicDeclarativeGate = evaluateCatastrophicDeclarativeGate(
+    config,
+    constraints,
+    toolName,
+    toolInput,
+  );
+  if (catastrophicDeclarativeGate) {
+    return recordStructuralGateBlock(toolName, toolInput, catastrophicDeclarativeGate);
+  }
+
   // Tier 1b: Planning and Trajectory (v1.26.0 - CodeRabbit Pattern).
   // Keep runtime enforcement explicit so advisory planning checks do not mask
   // higher-priority deny/approve gates in established workflows.
@@ -3303,7 +3367,7 @@ function evaluateSecretGuard(input = {}) {
   return result;
 }
 
-function evaluateUnconditionalHardFloor(input = {}) {
+function evaluateUnconditionalHardFloor(input = {}, options = {}) {
   const secretGuard = evaluateSecretGuard(input);
   if (secretGuard) return { hardFloor: secretGuard, securityScan: null };
 
@@ -3312,14 +3376,81 @@ function evaluateUnconditionalHardFloor(input = {}) {
     return { hardFloor: securityScan, securityScan };
   }
 
+  const financialHardFloor = evaluateFinancialHardFloor(input, false, options);
+  if (financialHardFloor) return { hardFloor: financialHardFloor, securityScan };
+
   return {
     hardFloor: evaluateSelfProtectHardFloor(input),
     securityScan,
   };
 }
 
-function runHardFloor(input) {
-  const { hardFloor } = evaluateUnconditionalHardFloor(input);
+function evaluateFinancialHardFloor(input = {}, consumeReservation = false, options = {}) {
+  const toolName = input.tool_name || input.toolName || 'unknown';
+  const toolInput = input.tool_input && typeof input.tool_input === 'object'
+    ? input.tool_input
+    : {};
+  const normalizedAction = normalizeProviderAction({
+    toolName,
+    toolInput,
+    usage: input.usage || toolInput.usage,
+    costUsd: input.costUsd ?? toolInput.costUsd,
+    budget: input.budget || toolInput.budget,
+  });
+  const costControl = buildCostControl(
+    normalizedAction,
+    input.budget || toolInput.budget || {}
+  );
+  const financialControl = evaluateFinancialControl({
+    toolName,
+    toolInput,
+    actionProfile: {
+      economicAction: undefined,
+    },
+    costControl,
+  }, { ...options, consumeReservation });
+  if (financialControl.mode === 'block') {
+    const result = {
+      decision: 'deny',
+      gate: 'financial-control',
+      message: financialControl.reasons.join(' '),
+      severity: 'critical',
+      financialControl,
+      reasoning: [
+        'Economic actions default to deny at the pre-tool boundary.',
+        'Learned policy and advisory memories cannot override this deterministic control.',
+      ],
+    };
+    recordStat('financial-control', 'block', null, { toolName, toolInput });
+    const auditRecord = recordAuditEvent({
+      toolName,
+      toolInput,
+      decision: 'deny',
+      gateId: 'financial-control',
+      message: result.message,
+      severity: result.severity,
+      source: 'financial-control',
+    });
+    auditToFeedback(auditRecord);
+    return result;
+  }
+  return null;
+}
+
+// Reservations are single-use. They are consumed only after every other gate
+// has reached its final allow/warn boundary, never during the preliminary hard
+// floor preview. This prevents a later workflow or learned-risk denial from
+// burning an approval for an action that did not execute.
+function finalizeFinancialAuthorization(input = {}, options = {}) {
+  return evaluateFinancialHardFloor(input, true, options);
+}
+
+function isBlockingDecision(result) {
+  return result?.decision === 'deny' || result?.decision === 'approve';
+}
+
+function runHardFloor(input, options = {}) {
+  const { hardFloor } = evaluateUnconditionalHardFloor(input, options);
   return hardFloor ? formatOutput(hardFloor) : null;
 }
 
@@ -3393,7 +3524,7 @@ function formatOutput(result, behavioralContext) {
   if (result.decision === 'deny') {
     const reminder = behavioralContext ? buildReminderOutput(behavioralContext) : {};
     const reminderSuffix = behavioralContext ? `\n\nSystem reminder:\n${behavioralContext}` : '';
-    const proCta = buildBlockActionProCta() || '';
+    const proCta = result.gate === 'financial-control' ? '' : (buildBlockActionProCta() || '');
     return JSON.stringify({
       hookSpecificOutput: {
         hookEventName: 'PreToolUse',
@@ -3707,10 +3838,18 @@ async function runAsync(input) {
   if (lessonContext && lessonContext.decision === "deny") {
     return formatOutput(applyEnforcementPosture(lessonContext));
   }
+
+  const posturedResult = applyEnforcementPosture(result);
+  if (isBlockingDecision(posturedResult)) {
+    return formatOutput(posturedResult);
+  }
+
+  const financialAuthorization = finalizeFinancialAuthorization(input);
+  if (financialAuthorization) return formatOutput(financialAuthorization);
   
   const recentContext = buildRecentCorrectiveActionsContext();
   const combinedContext = mergeContextStrings(lessonContext, recentContext, behavioralContext);
-  return formatOutput(applyEnforcementPosture(result), combinedContext);
+  return formatOutput(posturedResult, combinedContext);
 
 }
 
@@ -3746,10 +3885,18 @@ function run(input) {
   if (lessonContext && lessonContext.decision === "deny") {
     return formatOutput(applyEnforcementPosture(lessonContext));
   }
+
+  const posturedResult = applyEnforcementPosture(result);
+  if (isBlockingDecision(posturedResult)) {
+    return formatOutput(posturedResult);
+  }
+
+  const financialAuthorization = finalizeFinancialAuthorization(input);
+  if (financialAuthorization) return formatOutput(financialAuthorization);
   
   const recentContext = buildRecentCorrectiveActionsContext();
   const combinedContext = mergeContextStrings(lessonContext, recentContext, behavioralContext);
-  return formatOutput(applyEnforcementPosture(result), combinedContext);
+  return formatOutput(posturedResult, combinedContext);
 
 }
 
@@ -4037,10 +4184,40 @@ function verifyClaimEvidence(claimText, options = {}) {
     });
   }
 
+  // Universal factual claims (row counts, file lines/bytes/existence, version values)
+  // recheck the configured source of truth. Fail-closed on mismatch or missing verifier.
+  let universal = null;
+  if (options.skipUniversal !== true) {
+    try {
+      const {
+        evaluateUniversalClaimsAsGateChecks,
+      } = require('./universal-claim-evaluator');
+      universal = evaluateUniversalClaimsAsGateChecks(normalizedClaimText, {
+        cwd: options.cwd,
+        verifiers: options.verifiers,
+        configPath: options.claimVerifiersPath,
+        config: options.claimVerifiers,
+        feedbackDir: options.feedbackDir,
+        failUnconfigured: options.failUnconfigured,
+      });
+      for (const check of universal.checks) {
+        checks.push(check);
+      }
+    } catch (error) {
+      checks.push({
+        claim: 'universal_evaluator',
+        passed: false,
+        missing: ['universal_claim_evaluator'],
+        message: `Universal claim evaluator failed closed: ${error && error.message ? error.message : 'unknown error'}`,
+      });
+    }
+  }
+
   return {
-    verified: checks.every((check) => check.passed),
+    verified: checks.length === 0 ? true : checks.every((check) => check.passed),
     checks,
     goalContract,
+    universal,
   };
 }
 
@@ -4088,6 +4265,7 @@ module.exports = {
   isAutonomousRun,
   computeExecutableHash,
   formatOutput,
+  finalizeFinancialAuthorization,
   isApprovalGatesEnabled,
   runHardFloor,
   run,

package/scripts/gemini-embedding-policy.js

@@ -190,6 +190,7 @@ module.exports = {
   GEMINI_TASK_TYPES,
   buildGeminiEmbeddingRolloutPlan,
   isSymmetricTask,
+  normalizeEmbeddingKind,
   normalizeOutputDimensionality,
   normalizeTask,
   prepareEmbeddingText,

package/scripts/hook-runtime.js

@@ -92,6 +92,10 @@ function cacheUpdateHookCommand() {
   return buildPortableHookCommand('cache-update');
 }
 
+function claimStopHookCommand() {
+  return buildPortableHookCommand('claim-stop-check');
+}
+
 function statuslineCommand() {
   return buildPortableHookCommand('statusline-render');
 }
@@ -120,6 +124,7 @@ module.exports = {
   buildPortableHookCommand,
   buildCodexPortableHookCommand,
   cacheUpdateHookCommand,
+  claimStopHookCommand,
   codexCacheUpdateHookCommand,
   codexPreToolHookCommand,
   codexSessionStartHookCommand,

package/scripts/hook-stop-anti-claim.js

@@ -29,6 +29,9 @@
  */
 
 const fs = require('node:fs');
+const {
+  evaluateUniversalClaims,
+} = require('./universal-claim-evaluator');
 
 // Lie-phrase patterns. These match common "claim of completion" wording
 // the agent emits without verification. Word-boundary anchored to avoid
@@ -233,6 +236,45 @@ function readStdinSync() {
   }
 }
 
+function factualClaimBlock(text, options = {}) {
+  try {
+    const result = evaluateUniversalClaims(text, {
+      cwd: options.cwd,
+      configPath: options.configPath,
+      feedbackDir: options.feedbackDir,
+      failUnconfigured: true,
+    });
+    if (result.parsedCount === 0) return null;
+    if (result.verified) return null;
+    const failures = result.checks.filter((check) => !check.passed);
+    return {
+      decision: 'block',
+      reason: `ThumbGate factual-claim gate: ${failures.map((check) => check.message).join('; ')}. Recheck the configured source of truth and restate the observed value, or retract the claim.`,
+      verification: {
+        verified: false,
+        parsedCount: result.parsedCount,
+        failures: failures.map((check) => ({
+          status: check.status,
+          kind: check.kind,
+          verifierId: check.verifierId || null,
+          expected: check.expected,
+          actual: Object.hasOwn(check, 'actual') ? check.actual : null,
+        })),
+      },
+    };
+  } catch (error) {
+    return {
+      decision: 'block',
+      reason: `ThumbGate factual-claim gate failed closed: ${error.message}`,
+      verification: {
+        verified: false,
+        parsedCount: null,
+        failures: [{ status: 'evaluator_error' }],
+      },
+    };
+  }
+}
+
 function main() {
   const raw = readStdinSync();
   let payload = {};
@@ -242,12 +284,28 @@ function main() {
     payload = {};
   }
 
+  // Claude Code invokes a blocked Stop hook once more with this marker so the
+  // agent can correct its response. Re-blocking the same payload would hit the
+  // host's block cap instead of giving the agent a correction turn.
+  if (payload.stop_hook_active === true) return;
+
   const transcriptPath = payload.transcript_path || process.env.CLAUDE_TRANSCRIPT_PATH;
   const message = readLastAssistantTurn(transcriptPath);
-  if (!message) return; // no transcript visible; nothing to check
+  const text = message
+    ? extractText(message)
+    : String(payload.last_assistant_message || process.env.CLAUDE_RESPONSE || '');
+  if (!text.trim()) return; // no assistant response visible; nothing to check
+
+  const toolUseSummary = message ? extractToolUseSummary(message) : '';
+  const factualBlock = factualClaimBlock(text, {
+    cwd: payload.cwd || payload.workspace_root || process.cwd(),
+    configPath: process.env.THUMBGATE_CLAIM_VERIFIERS_PATH,
+  });
+  if (factualBlock) {
+    process.stdout.write(`${JSON.stringify(factualBlock)}\n`);
+    return;
+  }
 
-  const text = extractText(message);
-  const toolUseSummary = extractToolUseSummary(message);
   const claim = findClaim(text);
   if (!claim) return; // no completion claim made; silent
 
@@ -298,4 +356,6 @@ module.exports = {
   hasProof,
   extractText,
   extractToolUseSummary,
+  factualClaimBlock,
+  main,
 };