thumbgate 1.34.3 → 1.37.1

package/src/miminions-adapter.js

@@ -0,0 +1,106 @@
+"use strict";
+
+/**
+ * MiMinions Adapter
+ *
+ * Bridges MiMinions WorkflowRun / WorkflowTrace schemas (Pydantic-AI)
+ * into ThumbGate reliability telemetry, pre-action WriteGuard interdiction,
+ * and DPO feedback loops.
+ */
+
+const { classifyMcpTool, scrubSensitiveData, scanForDestructivePatterns, RISK_TIERS } = require("./mcp-writeguard");
+
+/**
+ * Validates and wraps a MiMinions tool invocation before execution.
+ *
+ * @param {Object} toolCall - { tool_name, args, kwargs }
+ * @param {Object} [options] - Configuration overrides
+ * @returns {Object} Evaluation verdict { allowed, tier, scrubbedKwargs, reason }
+ */
+function guardMiMinionsToolCall(toolCall, options = {}) {
+  const toolName = toolCall.tool_name || toolCall.toolName || "unknown_tool";
+  const tier = classifyMcpTool(toolName, options.toolOverrides);
+  const rawKwargs = toolCall.kwargs || {};
+  const scrubbedKwargs = scrubSensitiveData(rawKwargs);
+
+  // Scan for destructive patterns if privileged
+  const destructiveFindings = scanForDestructivePatterns(toolName, scrubbedKwargs);
+  if (destructiveFindings.length > 0) {
+    return {
+      allowed: false,
+      tier,
+      decision: "blocked",
+      reasons: destructiveFindings,
+      scrubbedKwargs,
+    };
+  }
+
+  if (tier === RISK_TIERS.ADMIN && !options.allowAdmin) {
+    return {
+      allowed: false,
+      tier,
+      decision: "escalated",
+      reasons: ["Admin tool calls require explicit operator approval"],
+      scrubbedKwargs,
+    };
+  }
+
+  return {
+    allowed: true,
+    tier,
+    decision: "allowed",
+    reasons: [],
+    scrubbedKwargs,
+  };
+}
+
+/**
+ * Converts a ThumbGate task outcome / receipt into a MiMinions-compatible WorkflowRun object.
+ *
+ * @param {Object} receipt - ThumbGate task receipt
+ * @returns {Object} MiMinions WorkflowRun JSON schema
+ */
+function exportToMiMinionsWorkflowRun(receipt) {
+  const agentName = receipt.agentName || receipt.agentId || "ThumbGate-Agent";
+  const trace = [];
+
+  // Agent prompt record
+  trace.push({
+    type: "agent",
+    id: "run_" + (receipt.taskId || "task_0"),
+    created_at: receipt.createdAt || new Date().toISOString(),
+    prompt: receipt.prompt || "",
+    output: receipt.result || receipt.summary || null,
+  });
+
+  // Tool execution records
+  if (Array.isArray(receipt.toolCalls)) {
+    receipt.toolCalls.forEach((tc, idx) => {
+      trace.push({
+        type: "tool",
+        tool_name: tc.tool || tc.name || "unknown",
+        args: tc.args || [],
+        kwargs: scrubSensitiveData(tc.parameters || tc.kwargs || {}),
+        result: tc.result || null,
+        error: tc.error || null,
+        order: idx + 1,
+        timestamp: tc.timestamp || new Date().toISOString(),
+        status: tc.status || (tc.error ? "error" : "success"),
+        execution_time_ms: tc.latencyMs || tc.executionTimeMs || null,
+      });
+    });
+  }
+
+  return {
+    schema_version: 2,
+    id: "wf_" + (receipt.workflowId || receipt.taskId || "run"),
+    created_at: receipt.createdAt || new Date().toISOString(),
+    agent_name: agentName,
+    trace,
+  };
+}
+
+module.exports = {
+  guardMiMinionsToolCall,
+  exportToMiMinionsWorkflowRun,
+};

package/src/pipeline-compass.js

@@ -0,0 +1,104 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { wiringReport } = require('../scripts/mcp-wiring-doctor');
+const { getFeedbackPaths } = require('../scripts/feedback-paths');
+
+const AXES = [
+  { id: 'design', name: 'Design', meaning: 'Interfaces wired (MCP / hooks)' },
+  { id: 'implement', name: 'Implement', meaning: 'Lessons store writable' },
+  { id: 'data', name: 'Data', meaning: 'Feedback rows captured' },
+  { id: 'promote', name: 'Promote', meaning: 'Prevention rules exist' },
+  { id: 'evaluate', name: 'Evaluate', meaning: 'Local summary or stats exist' },
+  { id: 'deploy', name: 'Deploy', meaning: 'Dashboard or proof surface present' },
+];
+
+function countJsonlLines(filePath) {
+  try {
+    if (!filePath || !fs.existsSync(filePath)) return 0;
+    return fs.readFileSync(filePath, 'utf8').split('\n').filter((line) => line.trim()).length;
+  } catch {
+    return 0;
+  }
+}
+
+function fileNonEmpty(filePath) {
+  try {
+    return Boolean(filePath && fs.existsSync(filePath) && fs.statSync(filePath).size > 0);
+  } catch {
+    return false;
+  }
+}
+
+function getPipelineCompass(options = {}) {
+  const projectRoot = path.resolve(options.projectRoot || process.cwd());
+  const env = options.env || process.env;
+  const wiring = wiringReport(projectRoot, env);
+  const paths = getFeedbackPaths({
+    projectDir: projectRoot,
+    env,
+    feedbackDir: options.feedbackDir,
+  });
+
+  const feedbackRows = countJsonlLines(paths.FEEDBACK_LOG_PATH);
+  const memoryRows = countJsonlLines(paths.MEMORY_LOG_PATH);
+  const hasRules = fileNonEmpty(paths.PREVENTION_RULES_PATH);
+  const hasSummary = fileNonEmpty(paths.SUMMARY_PATH);
+  const dashboardHtml = path.join(projectRoot, 'public', 'dashboard.html');
+  const localDashboard = fileNonEmpty(dashboardHtml)
+    || fs.existsSync(path.join(projectRoot, 'bin', 'dashboard-cli.js'));
+
+  const axes = {
+    design: wiring.overall !== 'error',
+    // Require a real writable lessons store — existence alone is not enough
+    // (mode-0555 dirs exist but reject feedback appends with EACCES).
+    implement: Boolean(wiring.lessonsStore && wiring.lessonsStore.writable),
+    data: feedbackRows > 0,
+    promote: hasRules || memoryRows > 0,
+    evaluate: hasSummary || feedbackRows > 0,
+    deploy: localDashboard || wiring.overall === 'ok',
+  };
+
+  const scores = AXES.map((axis) => ({
+    ...axis,
+    pass: Boolean(axes[axis.id]),
+  }));
+  const passed = scores.filter((axis) => axis.pass).length;
+
+  return {
+    motto: 'Pipeline first, algorithms second.',
+    source: 'TradeMaster-style 6-module loop mapped onto existing ThumbGate surfaces. Not an RL trading platform.',
+    projectRoot,
+    wiring: wiring.overall,
+    feedbackRows,
+    memoryRows,
+    axes: scores,
+    passed,
+    total: AXES.length,
+    ready: wiring.overall !== 'error' && axes.design,
+  };
+}
+
+function formatPipelineCompass(report) {
+  const lines = [
+    `ThumbGate pipeline compass (${report.passed}/${report.total})`,
+    report.motto,
+    '',
+  ];
+  for (const axis of report.axes) {
+    lines.push(`${axis.pass ? '✓' : '·'} ${axis.name.padEnd(10)} ${axis.meaning}`);
+  }
+  lines.push('');
+  lines.push(`Feedback rows: ${report.feedbackRows}  Memory rows: ${report.memoryRows}  Wiring: ${report.wiring}`);
+  if (!report.ready) {
+    lines.push('Next: npx thumbgate init && npx thumbgate doctor  (pipeline before more gates)');
+  }
+  return lines.join('\n');
+}
+
+module.exports = {
+  AXES,
+  getPipelineCompass,
+  formatPipelineCompass,
+};

package/src/ppl-alert-pipeline.js

@@ -0,0 +1,284 @@
+'use strict';
+
+/**
+ * PPL (Piped Processing Language) Engine for Agent Observability & Pre-Action Alerting.
+ *
+ * Implements a lightweight, zero-dependency Unix pipeline processing model:
+ *   source | filter <expr> | stats <agg> by <field> | where <expr> | eval <expr> | alert <params>
+ *
+ * Designed to prevent alert-rule sprawl, false-positive fatigue, and telemetry ingestion bottlenecks.
+ */
+
+class PPLPipeline {
+  constructor(stages = []) {
+    this.stages = stages;
+  }
+
+  static parse(pplString) {
+    if (typeof pplString !== 'string' || !pplString.trim()) {
+      throw new Error('PPL pipeline string must be a non-empty string');
+    }
+
+    const stageDefs = pplString
+      .split('|')
+      .map((s) => s.trim())
+      .filter(Boolean);
+
+    const stages = [];
+
+    for (const rawStage of stageDefs) {
+      const parts = rawStage.split(/\s+/);
+      const op = parts[0].toLowerCase();
+      const rest = rawStage.slice(parts[0].length).trim();
+
+      if (op === 'filter' || op === 'where') {
+        stages.push({ type: 'filter', expr: rest });
+      } else if (op === 'stats') {
+        stages.push(PPLPipeline._parseStats(rest));
+      } else if (op === 'eval') {
+        stages.push(PPLPipeline._parseEval(rest));
+      } else if (op === 'dedup') {
+        stages.push({ type: 'dedup', field: rest.trim() });
+      } else if (op === 'head' || op === 'limit') {
+        stages.push({ type: 'limit', count: Number.parseInt(rest, 10) || 10 });
+      } else {
+        throw new Error(`Unsupported PPL operator: ${op}`);
+      }
+    }
+
+    return new PPLPipeline(stages);
+  }
+
+  static _parseStats(rest) {
+    const byIndex = rest.toLowerCase().indexOf(' by ');
+    let aggStr = rest;
+    let byField = null;
+
+    if (byIndex !== -1) {
+      aggStr = rest.slice(0, byIndex).trim();
+      byField = rest.slice(byIndex + 4).trim();
+    }
+
+    const aggs = [];
+    const aggTokens = aggStr.split(',').map((s) => s.trim());
+
+    for (const token of aggTokens) {
+      const funcMatch = /^([a-z0-9_]+)\((.*?)\)(?:\s+as\s+([a-z0-9_]+))?$/i.exec(token);
+      if (funcMatch) {
+        aggs.push({
+          func: funcMatch[1].toLowerCase(),
+          field: funcMatch[2].trim() || null,
+          alias: funcMatch[3] ? funcMatch[3].trim() : `${funcMatch[1].toLowerCase()}_${funcMatch[2] || 'all'}`,
+        });
+      }
+    }
+
+    return { type: 'stats', aggs, byField };
+  }
+
+  static _parseEval(rest) {
+    const eqIndex = rest.indexOf('=');
+    if (eqIndex === -1) {
+      throw new Error(`Invalid eval syntax: ${rest}`);
+    }
+    return { type: 'eval', target: rest.slice(0, eqIndex).trim(), expr: rest.slice(eqIndex + 1).trim() };
+  }
+
+  execute(records = []) {
+    let current = Array.isArray(records) ? [...records] : [];
+
+    for (const stage of this.stages) {
+      switch (stage.type) {
+        case 'filter':
+          current = current.filter((r) => PPLPipeline._evalPredicate(r, stage.expr));
+          break;
+        case 'stats':
+          current = PPLPipeline._execStats(current, stage);
+          break;
+        case 'eval':
+          current = current.map((r) => PPLPipeline._execEval(r, stage));
+          break;
+        case 'dedup':
+          current = PPLPipeline._execDedup(current, stage.field);
+          break;
+        case 'limit':
+          current = current.slice(0, stage.count);
+          break;
+        default:
+          break;
+      }
+    }
+
+    return current;
+  }
+
+  static _evalPredicate(record, expr) {
+    const tokens = /^([a-z0-9_.]+)\s*(==|!=|>=|<=|>|<|contains)\s*([\s\S]+)$/i.exec(expr);
+    if (!tokens) return true;
+
+    const [, field, op, rawVal] = tokens;
+    const actual = PPLPipeline._getProp(record, field);
+    let target = rawVal.trim().replace(/^['"]|['"]$/g, '');
+
+    if (!Number.isNaN(Number(target)) && target !== '') {
+      target = Number(target);
+    }
+
+    switch (op) {
+      case '==':
+        return actual === target;
+      case '!=':
+        return actual !== target;
+      case '>':
+        return Number(actual) > Number(target);
+      case '>=':
+        return Number(actual) >= Number(target);
+      case '<':
+        return Number(actual) < Number(target);
+      case '<=':
+        return Number(actual) <= Number(target);
+      case 'contains':
+        return String(actual || '').includes(String(target));
+      default:
+        return true;
+    }
+  }
+
+  static _execEval(record, stage) {
+    const res = { ...record };
+    const exprTokens = /^([a-z0-9_.]+)\s*([+\-*/><=!]+)\s*([\s\S]+)$/i.exec(stage.expr);
+    if (exprTokens) {
+      const [, left, op, right] = exprTokens;
+      const leftVal = PPLPipeline._getProp(record, left);
+      let rightVal = right.trim().replace(/^['"]|['"]$/g, '');
+      if (!Number.isNaN(Number(rightVal))) rightVal = Number(rightVal);
+
+      if (op === '>') res[stage.target] = Number(leftVal) > Number(rightVal);
+      else if (op === '>=') res[stage.target] = Number(leftVal) >= Number(rightVal);
+      else if (op === '<') res[stage.target] = Number(leftVal) < Number(rightVal);
+      else if (op === '<=') res[stage.target] = Number(leftVal) <= Number(rightVal);
+      else if (op === '==') res[stage.target] = leftVal === rightVal;
+      else if (op === '+') res[stage.target] = Number(leftVal) + Number(rightVal);
+      else if (op === '-') res[stage.target] = Number(leftVal) - Number(rightVal);
+    } else {
+      res[stage.target] = stage.expr;
+    }
+    return res;
+  }
+
+  static _execStats(records, stage) {
+    const groups = new Map();
+
+    for (const r of records) {
+      const key = stage.byField ? String(PPLPipeline._getProp(r, stage.byField) || 'null') : '__all__';
+      if (!groups.has(key)) {
+        groups.set(key, []);
+      }
+      groups.get(key).push(r);
+    }
+
+    const results = [];
+
+    for (const [key, rows] of groups.entries()) {
+      const rowRes = {};
+      if (stage.byField) {
+        rowRes[stage.byField] = key === 'null' ? null : key;
+      }
+
+      for (const agg of stage.aggs) {
+        if (agg.func === 'count') {
+          rowRes[agg.alias] = rows.length;
+        } else if (agg.func === 'avg') {
+          const sum = rows.reduce((s, r) => s + (Number(PPLPipeline._getProp(r, agg.field)) || 0), 0);
+          rowRes[agg.alias] = rows.length > 0 ? sum / rows.length : 0;
+        } else if (agg.func === 'sum') {
+          rowRes[agg.alias] = rows.reduce((s, r) => s + (Number(PPLPipeline._getProp(r, agg.field)) || 0), 0);
+        } else if (agg.func === 'p95') {
+          const vals = rows
+            .map((r) => Number(PPLPipeline._getProp(r, agg.field)))
+            .filter((v) => !Number.isNaN(v))
+            .sort((a, b) => a - b);
+          if (vals.length === 0) {
+            rowRes[agg.alias] = 0;
+          } else {
+            const idx = Math.floor(vals.length * 0.95);
+            rowRes[agg.alias] = vals[Math.min(idx, vals.length - 1)];
+          }
+        }
+      }
+      results.push(rowRes);
+    }
+
+    return results;
+  }
+
+  static _execDedup(records, field) {
+    const seen = new Set();
+    const out = [];
+    for (const r of records) {
+      const val = PPLPipeline._getProp(r, field);
+      if (!seen.has(val)) {
+        seen.add(val);
+        out.push(r);
+      }
+    }
+    return out;
+  }
+
+  static _getProp(obj, pathStr) {
+    if (!obj || !pathStr) return undefined;
+    const parts = pathStr.split('.');
+    let cur = obj;
+    for (const p of parts) {
+      if (cur == null) return undefined;
+      cur = cur[p];
+    }
+    return cur;
+  }
+}
+
+/**
+ * Unified Alert Manager with deduping window.
+ */
+class UnifiedAlertManager {
+  constructor({ dedupWindowMs = 60000 } = {}) {
+    this.dedupWindowMs = dedupWindowMs;
+    this.lastAlertTime = new Map();
+  }
+
+  evaluateAlert(pipeline, records = [], { alertThresholdField, severity = 'high', alertName = 'unnamed-alert' } = {}) {
+    const matched = pipeline.execute(records);
+    const triggered = [];
+
+    const now = Date.now();
+
+    for (const row of matched) {
+      const isBreach = alertThresholdField ? Boolean(row[alertThresholdField]) : true;
+      if (isBreach) {
+        const entityKey = `${alertName}:${JSON.stringify(row)}`;
+        const lastSent = this.lastAlertTime.get(entityKey) || 0;
+        if (now - lastSent >= this.dedupWindowMs) {
+          this.lastAlertTime.set(entityKey, now);
+          triggered.push({
+            alertName,
+            severity,
+            timestamp: now,
+            data: row,
+          });
+        }
+      }
+    }
+
+    return {
+      triggered: triggered.length > 0,
+      alerts: triggered,
+      evaluatedRows: records.length,
+      matchedRows: matched.length,
+    };
+  }
+}
+
+module.exports = {
+  PPLPipeline,
+  UnifiedAlertManager,
+};

package/src/rendezvous-router.js

@@ -0,0 +1,90 @@
+/**
+ * Rendezvous (Highest Random Weight) Hashing Router
+ *
+ * Inspired by Cursor Continuity's stateless repository routing (https://cursor.com/blog/git-at-any-scale).
+ * Enables deterministic, zero-lock multi-agent worktree and task assignment across
+ * distributed agent fleets without central routing tables or relational databases.
+ *
+ * @module rendezvous-router
+ */
+
+const crypto = require('node:crypto');
+
+/**
+ * Computes a 64-bit deterministic hash weight for a (key, node) pair.
+ *
+ * @param {string} key - The repository path, task ID, or session key
+ * @param {string} node - The worker node, worktree path, or agent identity
+ * @returns {number} Float weight in range [0, 1)
+ */
+function computeRendezvousWeight(key, node) {
+  const hash = crypto.createHash('sha256').update(`${key}:${node}`).digest();
+  const intVal = hash.readUInt32BE(0);
+  return intVal / 0xffffffff;
+}
+
+/**
+ * Selects the top-ranked node for a given key using Rendezvous (HRW) hashing.
+ *
+ * @param {string} key - Key to route (e.g. repo path, task id)
+ * @param {string[]} nodes - Available candidate nodes/worktrees
+ * @returns {string|null} The selected node, or null if nodes is empty
+ */
+function getRendezvousNode(key, nodes) {
+  if (!Array.isArray(nodes) || nodes.length === 0) return null;
+  if (nodes.length === 1) return nodes[0];
+
+  let bestNode = null;
+  let maxWeight = -1;
+
+  for (const node of nodes) {
+    const weight = computeRendezvousWeight(key, node);
+    if (weight > maxWeight) {
+      maxWeight = weight;
+      bestNode = node;
+    }
+  }
+
+  return bestNode;
+}
+
+/**
+ * Returns a ranked list of all nodes for a given key, ordered from highest to lowest weight.
+ * Used for graceful fallback when the primary node is degraded/unhealthy.
+ *
+ * @param {string} key - Key to route
+ * @param {string[]} nodes - Available candidate nodes
+ * @returns {string[]} Ordered list of nodes
+ */
+function getRankedRendezvousNodes(key, nodes) {
+  if (!Array.isArray(nodes) || nodes.length === 0) return [];
+  if (nodes.length === 1) return [...nodes];
+
+  return [...nodes]
+    .map((node) => ({ node, weight: computeRendezvousWeight(key, node) }))
+    .sort((a, b) => b.weight - a.weight)
+    .map((item) => item.node);
+}
+
+/**
+ * Routes an agent session to an isolated worktree deterministically.
+ *
+ * @param {string} repoPath - Base repository path
+ * @param {string} sessionId - Active agent session ID
+ * @param {string[]} availableWorktrees - List of worktree directory names or paths
+ * @returns {string|null} Assigned worktree path
+ */
+function routeSessionWorktree(repoPath, sessionId, availableWorktrees) {
+  if (!repoPath || !sessionId || !Array.isArray(availableWorktrees) || availableWorktrees.length === 0) {
+    return null;
+  }
+  const key = `${repoPath}#${sessionId}`;
+  return getRendezvousNode(key, availableWorktrees);
+}
+
+module.exports = {
+  computeRendezvousWeight,
+  getRendezvousNode,
+  getRankedRendezvousNodes,
+  routeSessionWorktree,
+};