thumbgate 1.34.3 → 1.37.1

package/scripts/audit-trail.js

@@ -27,6 +27,200 @@ function getAuditLogPath() {
   return path.join(resolveFeedbackDir(), AUDIT_LOG_FILENAME);
 }
 
+/**
+ * Resolve the acting non-human identity for audit attribution. Sessions and
+ * worktree leases export THUMBGATE_SESSION_AGENT; THUMBGATE_AGENT_ID is the
+ * generic override. Null when the caller cannot be attributed — audit records
+ * must never invent an identity.
+ */
+function resolveAuditAgentId() {
+  return process.env.THUMBGATE_SESSION_AGENT
+    || process.env.THUMBGATE_AGENT_ID
+    || null;
+}
+
+// ---------------------------------------------------------------------------
+// Agent identity store — registry + observed-agent stream
+//
+// Lives here (not in org-dashboard) because the gates-engine identity gate and
+// audit attribution are public runtime surfaces, while org-dashboard stays out
+// of the npm tarball. org-dashboard re-exports these for its Pro reporting.
+// ---------------------------------------------------------------------------
+
+const REGISTRY_FILENAME = 'agent-registry.jsonl';
+const OBSERVED_FILENAME = 'observed-agents.jsonl';
+const OBSERVED_COMPACT_BYTES = 512 * 1024;
+
+function getRegistryPath() {
+  return path.join(resolveFeedbackDir(), REGISTRY_FILENAME);
+}
+
+function getObservedAgentsPath() {
+  return path.join(resolveFeedbackDir(), OBSERVED_FILENAME);
+}
+
+/**
+ * Register an agent session. Called on MCP server startup or agent bootstrap.
+ */
+function registerAgent({ agentId, source, project, branch, metadata } = {}) {
+  const id = agentId || `agent_${Date.now()}_${crypto.randomUUID().slice(0, 8)}`;
+  const record = {
+    id,
+    registeredAt: new Date().toISOString(),
+    lastSeenAt: new Date().toISOString(),
+    source: source || 'unknown',
+    project: project || path.basename(process.cwd()),
+    branch: branch || null,
+    toolCalls: 0,
+    gateBlocks: 0,
+    gateWarns: 0,
+    metadata: { lifecycleStatus: 'active', ...(metadata || {}) },
+  };
+  const registryPath = getRegistryPath();
+  ensureDir(path.dirname(registryPath));
+  fs.appendFileSync(registryPath, JSON.stringify(record) + '\n');
+  return record;
+}
+
+/**
+ * Record agent activity — called after each tool call evaluation.
+ */
+function recordAgentActivity(agentId, decision) {
+  const registryPath = getRegistryPath();
+  if (!fs.existsSync(registryPath)) return;
+  const lines = fs.readFileSync(registryPath, 'utf-8').trim().split('\n');
+  const updated = [];
+  let found = false;
+  for (const line of lines) {
+    try {
+      const record = JSON.parse(line);
+      if (record.id === agentId && !found) {
+        record.lastSeenAt = new Date().toISOString();
+        record.toolCalls = (record.toolCalls || 0) + 1;
+        if (decision === 'deny') record.gateBlocks = (record.gateBlocks || 0) + 1;
+        if (decision === 'warn') record.gateWarns = (record.gateWarns || 0) + 1;
+        found = true;
+      }
+      updated.push(JSON.stringify(record));
+    } catch {
+      updated.push(line);
+    }
+  }
+  fs.writeFileSync(registryPath, updated.join('\n') + '\n');
+}
+
+/**
+ * Load all registered agent sessions.
+ */
+function loadAgentRegistry() {
+  const registryPath = getRegistryPath();
+  if (!fs.existsSync(registryPath)) return [];
+  const raw = fs.readFileSync(registryPath, 'utf-8').trim();
+  if (!raw) return [];
+  const records = [];
+  for (const line of raw.split('\n')) {
+    try {
+      records.push(JSON.parse(line));
+    } catch {
+      // Skip corrupt rows; identity checks fail open, never crash.
+    }
+  }
+  return records;
+}
+
+/**
+ * Retire an agent identity. A retired agent that keeps acting is flagged by
+ * the gates-engine identity gate (deny under strict enforcement).
+ */
+function retireAgent(agentId, reason) {
+  const registryPath = getRegistryPath();
+  if (!fs.existsSync(registryPath)) return false;
+  const lines = fs.readFileSync(registryPath, 'utf-8').trim().split('\n');
+  const updated = [];
+  let found = false;
+  for (const line of lines) {
+    try {
+      const record = JSON.parse(line);
+      if (record.id === agentId) {
+        record.metadata = record.metadata || {};
+        record.metadata.lifecycleStatus = 'retired';
+        record.metadata.retiredAt = new Date().toISOString();
+        if (reason) record.metadata.retireReason = String(reason);
+        found = true;
+      }
+      updated.push(JSON.stringify(record));
+    } catch {
+      updated.push(line);
+    }
+  }
+  if (found) fs.writeFileSync(registryPath, updated.join('\n') + '\n');
+  return found;
+}
+
+/**
+ * Record one observation of an acting agent — the producer side of shadow-AI
+ * detection, called from the gates-engine evaluation path on every attributed
+ * tool call. Appends are plain (never lost to a busy lock); compaction runs
+ * only under the cross-process ledger lock so a concurrent agent's append can
+ * never be truncated by the read-aggregate-rewrite window.
+ */
+function recordObservedAgent(agentId) {
+  const id = String(agentId || '').trim();
+  if (!id) return null;
+  const observedPath = getObservedAgentsPath();
+  ensureDir(path.dirname(observedPath));
+  const event = { id, seenAt: new Date().toISOString() };
+  fs.appendFileSync(observedPath, JSON.stringify(event) + '\n');
+  try {
+    if (fs.statSync(observedPath).size > OBSERVED_COMPACT_BYTES) {
+      const { withFileLedgerLock } = require('./file-ledger-lock');
+      withFileLedgerLock(observedPath + '.lock', () => {
+        const compacted = loadObservedAgents()
+          .map((row) => JSON.stringify(row))
+          .join('\n');
+        fs.writeFileSync(observedPath, compacted + '\n');
+      });
+    }
+  } catch {
+    // Busy lock or read error: skip compaction, never drop the observation.
+  }
+  return event;
+}
+
+/**
+ * Aggregate observation events into one row per agent id:
+ * { id, firstSeenAt, lastSeenAt, observations }.
+ */
+function loadObservedAgents() {
+  const observedPath = getObservedAgentsPath();
+  if (!fs.existsSync(observedPath)) return [];
+  const byId = new Map();
+  const raw = fs.readFileSync(observedPath, 'utf-8').trim();
+  if (!raw) return [];
+  for (const line of raw.split('\n')) {
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const id = String(event.id || '').trim();
+    if (!id) continue;
+    const seenAt = event.seenAt || event.lastSeenAt || new Date().toISOString();
+    const row = byId.get(id) || {
+      id,
+      firstSeenAt: event.firstSeenAt || seenAt,
+      lastSeenAt: seenAt,
+      observations: 0,
+    };
+    if (seenAt < row.firstSeenAt) row.firstSeenAt = seenAt;
+    if (seenAt > row.lastSeenAt) row.lastSeenAt = seenAt;
+    row.observations += Number(event.observations) > 0 ? Number(event.observations) : 1;
+    byId.set(id, row);
+  }
+  return [...byId.values()];
+}
+
 
 // ---------------------------------------------------------------------------
 // Core audit record
@@ -53,6 +247,7 @@ function recordAuditEvent(params = {}) {
     timestamp: new Date().toISOString(),
     toolName: params.toolName || 'unknown',
     toolInput: sanitizeToolInput(params.toolInput || {}),
+    agentId: params.agentId || resolveAuditAgentId(),
     decision: params.decision || 'allow',
     gateId: params.gateId || null,
     message: params.message || null,
@@ -61,6 +256,13 @@ function recordAuditEvent(params = {}) {
     source: params.source || 'gates-engine',
   };
 
+  // Typed override payload (see scripts/override-audit.js). Carried verbatim so
+  // an override is filterable by decision === 'override' rather than having to
+  // be inferred from toolName, which cannot distinguish it from a normal call.
+  if (params.override && typeof params.override === 'object') {
+    record.override = params.override;
+  }
+
   // Safe stringify: never let circular/toxic tool inputs crash the gate path
   // (Antithesis-style invariant: evaluation + audit must not throw).
   let line;
@@ -353,6 +555,16 @@ module.exports = {
   recordAuditEvent,
   auditToFeedback,
   readAuditLog,
+  registerAgent,
+  recordAgentActivity,
+  loadAgentRegistry,
+  retireAgent,
+  recordObservedAgent,
+  loadObservedAgents,
+  getRegistryPath,
+  getObservedAgentsPath,
+  REGISTRY_FILENAME,
+  OBSERVED_FILENAME,
   auditStats,
   latencyStats,
   skillAdherence,

package/scripts/auto-promote-gates.js

@@ -206,13 +206,31 @@ function extractExecutableAction(entry) {
   const ctx = String(entry.context || entry.whatWentWrong || '').trim();
   if (ctx.length < 4) return null;
 
+  // Strong signal: known tool prefixes — accept immediately.
+  const known = /^(?:sudo\s+)?(?:kubectl|git|npm|npx|yarn|pnpm|python|python3|node|curl|wget|docker|podman|rm|mv|cp|chmod|chown|psql|mysql|mongo|terraform|pulumi|aws|gcloud|az|helm|ssh|scp|rsync|make|cargo|go|ruby|perl|bash|sh|zsh)\b/i.test(ctx);
+  if (known && ctx.length <= 240) return ctx;
+
+  // Reject agent-narration prose before the weak "looks like a command" heuristic.
+  // "Agent (grok) auto-sent …" was previously accepted because it starts with a
+  // single token + spaces, then became an inert force-gate pattern (AGENT-259).
+  if (/^(?:agent|the|user|ceo|claude|grok|codex|gemini|assistant|operator)\b/i.test(ctx)) {
+    return null;
+  }
+  if (/\b(?:without\s+(?:human\s+)?review|thumbs?-?down|auto-sent|always-approve)\b/i.test(ctx)) {
+    return null;
+  }
+  // Parenthetical asides ("Agent (grok, always-approve)") are prose, not argv.
+  if (/\([^)]{0,40}\b(?:grok|claude|codex|always-approve|agent)\b/i.test(ctx)) {
+    return null;
+  }
+
   // Looks like a shell / CLI invocation (not free-form prose).
   const looksExecutable = /^(?:sudo\s+)?(?:~\/|\.\/|\/)?(?:[A-Za-z0-9._+-]+\/)*[A-Za-z0-9._+-]+(?:\s|$)/.test(ctx)
     && /\s|^[a-z0-9._+-]+(?:\s|$)/i.test(ctx)
-    && !/\s+(?:broke|failed|wrong|should|never|please|the agent)\b/i.test(ctx.slice(0, 80));
-  // Strong signal: known tool prefixes
-  const known = /^(?:sudo\s+)?(?:kubectl|git|npm|npx|yarn|pnpm|python|python3|node|curl|wget|docker|podman|rm|mv|cp|chmod|chown|psql|mysql|mongo|terraform|pulumi|aws|gcloud|az|helm|ssh|scp|rsync|make|cargo|go|ruby|perl|bash|sh|zsh)\b/i.test(ctx);
-  if (known || (looksExecutable && /[\s-]/.test(ctx) && ctx.length <= 200)) {
+    && !/\s+(?:broke|failed|wrong|should|never|please|the agent|auto-sent|emailed)\b/i.test(ctx.slice(0, 100));
+  // Weak path: require a flag or path-like token so "Agent wrote a bad summary" fails.
+  const hasCliShape = /(?:\s-{1,2}[A-Za-z][\w-]*|\/[A-Za-z0-9._-]{2,}|\.(?:js|ts|py|sh|json|yml|yaml)\b)/.test(ctx);
+  if (looksExecutable && hasCliShape && ctx.length <= 200) {
     return ctx;
   }
   return null;
@@ -307,6 +325,64 @@ function contextToPattern(context) {
   return raw.slice(0, 120).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/**
+ * Known incident classes that appear as English prose in force-gate / feedback
+ * but map to a deterministic tool-call surface. Without this, force-promote of
+ * "agent emailed X without review" stores the sentence as a regex and never
+ * matches any tool call (AGENT-259, June 2026 + Aug 2026 recurrence).
+ */
+function deriveSurfacePattern(context) {
+  const text = String(context || '');
+  if (!text.trim()) return null;
+
+  const emailish = /\b(gmail|e-?mail|smtp|sendmail|msmtp|mailx|nodemailer|smtplib|messages\/send|send_message|send_draft|send-mail|outbound\s+email|cold\s+outreach)\b/i.test(text);
+  const sendish = /\b(send|sent|sending|emailed|mail(ed)?)\b/i.test(text);
+  if (emailish && sendish) {
+    // Mirrors config/gates/default.json outbound-email-send + the live
+    // ~/.thumbgate/bin/outbound-email-guard.js surface set.
+    return '(?:(?:^|[_.])send[_-]?(?:message|mail|email|now|draft)s?\\b|emailer[_-]?messages?[_-]?send|users\\/[^/\\s"\']+\\/messages\\/send|\\bmessages\\/send\\b|messages\\s*\\(\\s*\\)\\s*\\.\\s*send\\s*\\(|\\bsendmail\\b|\\bmsmtp\\b|\\bsmtplib\\b|\\bnodemailer\\b)';
+  }
+
+  if (/\bforce[- ]?push\b|git\s+push\s+(?:-f|--force)\b/i.test(text)) {
+    return 'git\\s+push\\s+(--force|-f)';
+  }
+
+  if (/\b(rm\s+-rf\s+\/|sudo\s+rm\s+-rf)\b/i.test(text)) {
+    return '(?:sudo\\s+)?rm\\s+-rf\\s+/';
+  }
+
+  return null;
+}
+
+/**
+ * True when a gate pattern is essentially an English sentence — many words,
+ * no executable tokens — and therefore cannot fire against tool-call text.
+ */
+function isInertProsePattern(pattern) {
+  if (!pattern || typeof pattern !== 'string') return true;
+  // Intentional multi-alternative surface matchers (email send, force-push classes).
+  if (/\(\?:/.test(pattern) && pattern.includes('|')) return false;
+  // Unescape common contextToPattern escapes so we can inspect the words.
+  const unescaped = pattern
+    .replace(/\\([.*+?^${}()|[\]\\])/g, '$1')
+    .replace(/\\\\/g, '\\');
+  const words = (unescaped.match(/[A-Za-z]{3,}/g) || []);
+  if (words.length < 6) return false;
+  // Short CLI / known surface tokens only — a long English sentence that merely
+  // *mentions* "gmail" is still inert (it will never equal a tool-call string).
+  const trimmed = unescaped.trim();
+  const looksLikeCli =
+    /^(?:sudo\s+)?(?:kubectl|git|npm|npx|yarn|pnpm|python|python3|node|curl|wget|docker|podman|rm|bash|sh|zsh)\b/i.test(trimmed)
+    && trimmed.length <= 160;
+  const looksLikeSurfaceToken =
+    words.length <= 8
+    && /(?:send_message|send_draft|messages\/send|sendmail|force-push|git\s+push\s+(?:-f|--force))/i.test(trimmed);
+  if (looksLikeCli || looksLikeSurfaceToken) return false;
+  return true;
+}
+
+
+
 /**
  * A gate that cannot match the very context that produced it is inert — it
  * shows up in the dashboard as an active blocking rule while enforcing nothing.
@@ -322,39 +398,51 @@ function gateMatchesOwnContext(gate, context) {
 }
 
 function buildGateRule(group, actionOverride) {
-  const action = actionOverride || (group.count === 'MANUAL' ? group.manualAction || 'block' : (group.count >= BLOCK_THRESHOLD ? 'block' : 'warn'));
+  // Tests and callers may pass partial groups; never crash on missing fields.
+  const g = group && typeof group === 'object' ? group : {};
+  const action = actionOverride || (g.count === 'MANUAL' ? g.manualAction || 'block' : (g.count >= BLOCK_THRESHOLD ? 'block' : 'warn'));
   const severity = action === 'block' ? 'critical' : action === 'approve' ? 'high' : 'medium';
-  const executable = (group.latestExecutable || extractExecutableAction({ context: group.latestContext }) || group.latestContext || '').slice(0, 120);
-  const context = executable;
-  const kind = group.key.startsWith('diagnosis:')
+  const fromExecutable = (g.latestExecutable
+    || extractExecutableAction({ context: g.latestContext })
+    || '').slice(0, 120);
+  // Prefer real executable text; else a derived surface regex (email send, force-push).
+  // NEVER fall back to free-form English prose — that produced permanently inert gates.
+  const surfacePattern = g.surfacePattern || deriveSurfacePattern(g.latestContext || g.key || '');
+  const pattern = fromExecutable
+    ? contextToPattern(fromExecutable)
+    : (surfacePattern || null);
+  const context = (fromExecutable || g.latestContext || g.key || '').slice(0, 120);
+  const kind = String(g.key || '').startsWith('diagnosis:')
     ? 'repeated diagnosis'
-    : group.key.startsWith('constraint:')
+    : String(g.key || '').startsWith('constraint:')
       ? 'repeated constraint violation'
-      : 'repeated executable action';
+      : (fromExecutable ? 'repeated executable action' : 'derived surface guard');
 
-  const occurrencesText = group.count === 'MANUAL' ? 'manual' : `${group.count} occurrences`;
+  const occurrencesText = g.count === 'MANUAL' ? 'manual' : `${g.count == null ? 0 : g.count} occurrences`;
   const suggestedMessage = `Auto-promoted ${kind}: "${context}" (${occurrencesText} in ${WINDOW_DAYS} days)`;
 
   // TTL: auto-promoted rules expire after the configured window unless
   // refreshed by a fresh fire. Manual force-promote bypasses TTL — operator
   // says "permanent" by going through the force path.
   const nowMs = Date.now();
-  const isManual = group.count === 'MANUAL';
+  const isManual = g.count === 'MANUAL';
   const expiresAt = isManual ? null : new Date(nowMs + getRuleTtlMs()).toISOString();
 
   return {
-    id: patternToGateId(group.key),
-    trigger: `auto:${group.key}`,
-    // Derived from the executable action, NOT from tag keys — see contextToPattern.
-    pattern: contextToPattern(executable),
+    id: patternToGateId(String(g.key || 'unknown')),
+    trigger: `auto:${g.key || 'unknown'}`,
+    // Derived from executable action OR known surface class — never raw prose.
+    pattern,
     action,
     message: suggestedMessage,
     severity,
-    occurrences: group.count,
+    // Always numeric — string 'MANUAL' concatenated into gate-stats totals (0MANUAL…).
+    occurrences: g.count === 'MANUAL' ? 1 : Number(g.count) || 0,
     promotedAt: new Date().toISOString(),
     expiresAt,
     lastFiredAt: null,
-    source: group.source || 'auto-promote',
+    source: g.source || 'auto-promote',
+    ...(surfacePattern && !fromExecutable ? { surfaceDerived: true } : {}),
   };
 }
 
@@ -430,21 +518,51 @@ function recordGateFire(data, gateId, now = Date.now()) {
 
 function forcePromote(context, action = 'block') {
   if (!context) throw new Error('context is required for force-promote');
+  let executable = extractExecutableAction({ context });
+  // If extractExecutableAction returned narration that would become inert prose,
+  // drop it and fall through to surface derivation (email send, force-push, …).
+  if (executable && isInertProsePattern(contextToPattern(executable))) {
+    executable = null;
+  }
+  const surfacePattern = deriveSurfacePattern(context);
+  // Prefer a known surface class over a weak "command-shaped" string when both exist
+  // and the command is not a known CLI prefix — prevents dual wrong-pattern promotion.
+  if (executable && surfacePattern && !/^(?:sudo\s+)?(?:kubectl|git|npm|npx|curl|python|python3|node|bash|sh|zsh|rm)\b/i.test(executable)) {
+    executable = null;
+  }
+  if (!executable && !surfacePattern) {
+    throw new Error(
+      'force-promote refused: context is prose without a matchable tool surface. '
+      + 'Pass an executable command (e.g. "git push --force") or describe a known '
+      + 'class (email send / Gmail messages/send, force-push, rm -rf /).',
+    );
+  }
+
   const data = loadAutoGates();
   const gateId = patternToGateId(context);
-  
+
   // Remove existing if any
   data.gates = data.gates.filter(g => g.id !== gateId);
-  
+
   const gate = buildGateRule({
     key: context,
     latestContext: context,
+    latestExecutable: executable || '',
+    surfacePattern: surfacePattern || undefined,
     count: 'MANUAL',
     manualAction: action,
-    source: 'force-promote'
+    source: 'force-promote',
   });
+
+  if (!gate.pattern || isInertProsePattern(gate.pattern)) {
+    throw new Error(
+      'force-promote refused: derived pattern is inert prose and would never fire. '
+      + `pattern=${JSON.stringify(gate.pattern)}`,
+    );
+  }
+
   data.gates.unshift(gate);
-  
+
   if (data.gates.length > MAX_AUTO_GATES) {
     data.gates = data.gates.slice(0, MAX_AUTO_GATES);
   }
@@ -454,12 +572,20 @@ function forcePromote(context, action = 'block') {
     gateId,
     context,
     action,
+    pattern: gate.pattern,
+    surfaceDerived: Boolean(gate.surfaceDerived),
     promotedAt: new Date().toISOString(),
-    source: 'force-promote'
+    source: 'force-promote',
   });
 
   saveAutoGates(data);
-  return { gateId, action, totalGates: data.gates.length };
+  return {
+    gateId,
+    action,
+    pattern: gate.pattern,
+    surfaceDerived: Boolean(gate.surfaceDerived),
+    totalGates: data.gates.length,
+  };
 }
 
 function promote(feedbackLogPath, options) {
@@ -472,10 +598,22 @@ function promote(feedbackLogPath, options) {
   // path rather than carrying a near-stale expiresAt.
   const { data: expiredData, expired } = expireGates(loadAutoGates());
   const data = expiredData;
-  if (expired.length > 0) {
+  // Drop permanently inert prose gates left by older force-promote / promotion bugs.
+  const inertRemoved = [];
+  data.gates = (data.gates || []).filter((g) => {
+    if (g && isInertProsePattern(g.pattern)) {
+      inertRemoved.push(g);
+      return false;
+    }
+    return true;
+  });
+  if (expired.length > 0 || inertRemoved.length > 0) {
     saveAutoGates(data);
   }
-  const promotions = expired.map((e) => ({ type: 'expired', gateId: e.id, expiredAt: e.expiresAt }));
+  const promotions = [
+    ...expired.map((e) => ({ type: 'expired', gateId: e.id, expiredAt: e.expiresAt })),
+    ...inertRemoved.map((e) => ({ type: 'quarantined-inert-prose', gateId: e.id, pattern: e.pattern })),
+  ];
 
   for (const group of Object.values(groups)) {
     if (group.count < WARN_THRESHOLD) continue;
@@ -520,7 +658,9 @@ function promote(feedbackLogPath, options) {
     // Never persist a gate that cannot match the context that produced it. Such a
     // gate renders in the dashboard as an active blocking rule while enforcing
     // nothing, which reads as "the agent learned" when it did not.
-    if (!gateMatchesOwnContext(gate, group.latestContext)) {
+    // Surface-derived patterns (email send, force-push) intentionally do NOT match
+    // the English prose incident text — they match the tool surface instead.
+    if (!gate.surfaceDerived && !gateMatchesOwnContext(gate, group.latestContext)) {
       promotions.push({
         type: 'skipped-unmatchable',
         gateId: gate.id,
@@ -529,6 +669,15 @@ function promote(feedbackLogPath, options) {
       });
       continue;
     }
+    if (!gate.pattern || isInertProsePattern(gate.pattern)) {
+      promotions.push({
+        type: 'skipped-inert-prose',
+        gateId: gate.id,
+        reason: 'pattern is English prose and would never match a tool call',
+        occurrences: group.count,
+      });
+      continue;
+    }
 
     // Self-Harness stage 3: before a feedback rule goes live as a hard block,
     // regression-test it against prior allowed actions. If it would have blocked
@@ -619,6 +768,8 @@ module.exports = {
   patternToGateId,
   buildGateRule,
   contextToPattern,
+  deriveSurfacePattern,
+  isInertProsePattern,
   gateMatchesOwnContext,
   regressionCheck,
   getAuditTrailPath,

package/scripts/billing.js

@@ -110,7 +110,7 @@ const CONFIG = {
   },
   RESEND_API_KEY: process.env.RESEND_API_KEY || process.env.THUMBGATE_RESEND_API_KEY || '',
   TRIAL_EMAIL_FROM: process.env.THUMBGATE_TRIAL_EMAIL_FROM || process.env.RESEND_FROM_EMAIL || process.env.RESEND_FROM || 'onboarding@resend.dev',
-  TRIAL_EMAIL_REPLY_TO: process.env.THUMBGATE_TRIAL_EMAIL_REPLY_TO || 'igor.ganapolsky@gmail.com',
+  TRIAL_EMAIL_REPLY_TO: process.env.THUMBGATE_TRIAL_EMAIL_REPLY_TO || 'support@thumbgate.ai',
   CREDIT_PACKS: {}
 };