thumbgate 1.37.1 → 1.37.3

package/server.json

@@ -8,13 +8,13 @@
     "source": "github",
     "url": "https://github.com/IgorGanapolsky/ThumbGate"
   },
-  "version": "1.37.1",
+  "version": "1.37.3",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "thumbgate",
-      "version": "1.37.1",
+      "version": "1.37.3",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {

package/skills/article-syndication-pipeline/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: article-syndication-pipeline
+description: Technical article syndication pipeline for cross-posting Dev.to articles to CoderLegion and other developer platforms with canonical URL preservation, UTM parameter attribution, and contributor onboarding compliance.
+---
+
+# ✍️ Article Syndication & Contributor Pipeline
+
+This skill guides the autonomous syndication of ThumbGate technical discoveries, security postmortems, and engineering deep dives across developer platforms (Dev.to, CoderLegion, Hashnode, Medium).
+
+---
+
+## 🎯 Architecture & Operating Directives
+
+1. **Canonical SEO Integrity:**
+   - Always preserve the primary origin as the canonical URL (e.g. `https://dev.to/igorganapolsky/...`).
+   - Syndicated copies on CoderLegion or elsewhere must link back to avoid search engine duplicate-content penalties.
+2. **First-Party Revenue Attribution:**
+   - All inbound links to `thumbgate.ai` must include UTM campaign tags (`utm_source=coderlegion`, `utm_medium=community`, `utm_campaign=guest-post`).
+   - Conversion links (Pro license checkout) must route through `/go/pro` (`https://thumbgate.ai/go/pro?utm_source=...`) to ensure server-side redirect logging.
+3. **CoderLegion Contributor Compliance:**
+   - URL import endpoint: `https://coderlegion.com/import-post`.
+   - Supports 2 imported Dev.to articles with full attribution.
+   - Contributor checklist: `https://coderlegion.com/guest-blog-checklists`.
+   - All imported posts undergo editorial review before appearing on the main feed.
+
+---
+
+## 🛠️ Step-by-Step Workflow
+
+1. **Verify Original Article:**
+   Verify original URL exists, returns HTTP 200, and has correct canonical tags.
+2. **Fetch via Platform Parser:**
+   Submit `import_url` to `https://coderlegion.com/import-post`.
+3. **Review & Confirm Metadata:**
+   Confirm title, tags (`ai`, `security`, `architecture`, `opensource`), and backlink to canonical source.
+4. **Publish & Track:**
+   Submit publication step and record post URL in session log and Comet browser tab.

package/skills/comet-session-logger/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: comet-session-logger
+description: Live session logger and observability dashboard driver for Comet browser. Ensures every PR, deployment status check, CoderLegion/Dev.to publication, and Railway production health metric is actively logged and visualized in Comet tabs.
+---
+
+# ☄️ Comet Session Logger & Visual HUD
+
+This skill governs the automated logging, tab orchestration, and visual tracking of all ThumbGate agentic tasks inside the **Comet** browser on macOS.
+
+---
+
+## 🎯 Purpose & Directives
+
+1. **CEO Visual Observability:** The CEO monitors agent progress via open tabs in Comet. Every major milestone must be reflected in Comet tabs without disrupting existing work.
+2. **Deterministic Tab Management:** Uses macOS AppleScript (`osascript`) to inspect, activate, create, or update Comet tabs.
+3. **Fail-Safe & Non-Destructive:** Never closes existing tabs; always reuses matching URLs or opens clean dedicated monitoring tabs.
+
+---
+
+## 🧭 Standard Tab Targets
+
+| Surface | Target URL | Trigger Milestone |
+|---------|------------|-------------------|
+| **Pull Requests** | `https://github.com/IgorGanapolsky/ThumbGate/pull/<NUM>` | After creating or advancing a PR |
+| **CI / Checks** | `https://github.com/IgorGanapolsky/ThumbGate/actions` | During workflow verification |
+| **Production Health** | `https://thumbgate-production.up.railway.app/health` | After deployment gate verification |
+| **Railway Console** | `https://railway.com/project/thumbgate-production` | When inspecting infrastructure |
+| **CoderLegion** | `https://coderlegion.com/import-post` | When onboarding or syndicating articles |
+| **Dev.to Dashboard** | `https://dev.to/dashboard` | When tracking article reach & analytics |
+
+---
+
+## 🛠️ AppleScript Orchestration Helpers
+
+```bash
+# Check existing Comet tabs
+osascript -e '
+tell application "Comet"
+    set outList to ""
+    repeat with w in windows
+        repeat with t in tabs of w
+            set outList to outList & (URL of t) & " | " & (title of t) & linefeed
+        end repeat
+    end repeat
+    return outList
+end tell'
+
+# Open or focus a specific URL in Comet
+open_comet_url() {
+  local target_url="$1"
+  osascript -e "
+  tell application \"Comet\"
+      activate
+      tell front window
+          make new tab with properties {URL:\"${target_url}\"}
+      end tell
+  end tell"
+}
+```

package/skills/thumbgate-daily-discoveries/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: thumbgate-daily-discoveries
+description: Autonomous daily publishing engine and monitoring skill for ThumbGate news and technical discoveries. Generates high-density engineering posts with full UTM attribution, synchronizes to Obsidian, schedules dual cron/launchd runs at 9:00 AM EST, and tracks publication ledgers.
+---
+
+# 📰 ThumbGate Daily Technical Discoveries & News Engine
+
+This skill automates the daily harvesting, synthesis, UTM attribution, and multi-channel publication of ThumbGate engineering discoveries and release news.
+
+---
+
+## 🎯 Architecture & Operating Principles
+
+1. **Daily Cadence (9:00 AM EST):** Runs once per calendar day. Avoids spam while establishing consistent technical authority.
+2. **Dual Scheduling Redundancy:**
+   - Primary: macOS crontab (`0 9 * * * /bin/bash scripts/thumbgate-daily-discoveries-publish.sh ...`)
+   - Fallback: macOS LaunchAgent (`~/Library/LaunchAgents/com.thumbgate.daily-publish.plist`)
+   - Note: GitHub Actions `schedule:` is strictly limited to `codeql.yml` per repo hygiene tests.
+3. **Full UTM Attribution & Tracked Redirects:**
+   - All outbound links to `thumbgate.ai` must use `buildUTMLink` from `scripts/social-analytics/utm.js`.
+   - Outbound pro/checkout links must route through `/go/pro` (`serveTrackedLinkRedirect` in `src/api/server.js`) to capture first-party funnel telemetry.
+4. **Multi-Surface Staging & Sync:**
+   - Staged locally at `docs/marketing/daily-discoveries/YYYY-MM-DD-<slug>.md`.
+   - Synchronized to the CEO's Obsidian Vault at `~/Documents/Igor/Research/Daily-Discoveries/`.
+   - Logged idempotently to `.thumbgate/daily-discoveries-ledger.jsonl`.
+   - Dispatches to Dev.to / Zernio if API keys are configured.
+
+---
+
+## 🛠️ CLI Commands & Usage
+
+```bash
+# Preview today's technical discovery without making mutations or network calls
+node scripts/thumbgate-daily-discoveries-publish.js --dry-run
+
+# Output structured JSON report
+node scripts/thumbgate-daily-discoveries-publish.js --json
+
+# Force publish/restage today's discovery even if already logged in ledger
+node scripts/thumbgate-daily-discoveries-publish.js --force
+
+# Shell wrapper (used by crontab / launchd)
+./scripts/thumbgate-daily-discoveries-publish.sh
+
+# Run test suite
+node --test tests/thumbgate-daily-discoveries-publish.test.js
+```
+
+---
+
+## 📋 Pre-Flight Verification Checklist
+
+- [ ] Verify `node --test tests/thumbgate-daily-discoveries-publish.test.js` passes.
+- [ ] Verify outbound links contain valid UTM parameters (`utm_source=daily_discoveries`, `utm_campaign=daily_technical_discoveries`).
+- [ ] Verify `launchctl list | grep thumbgate` reports exit code 0.
+- [ ] Verify `crontab -l | grep thumbgate` contains the 9:00 AM daily trigger.
+- [ ] Check `.thumbgate/daily-discoveries-ledger.jsonl` for recent execution receipts.

package/src/index.js

@@ -12,6 +12,12 @@ const {
   isNamedIdentity,
 } = require('./hermes-platform-protocol');
 const { HermesSyncPlane } = require('./hermes-sync-plane');
+const {
+  IdeaBrowserConnector,
+  ToolTier,
+  DEFAULT_READ_ONLY_TOOLS,
+  DEFAULT_MUTATING_TOOLS,
+} = require('./integrations/ideabrowser-connector');
 
 // The package entry point is the production surface for `thumbgate`.
 // The hosted-Hermes identity/lifecycle/approval gates are exported here so
@@ -29,4 +35,8 @@ module.exports = Object.assign({}, feedbackLoop, {
   THREAD_MODES,
   FORBIDDEN_IDENTITIES,
   isNamedIdentity,
+  IdeaBrowserConnector,
+  ToolTier,
+  DEFAULT_READ_ONLY_TOOLS,
+  DEFAULT_MUTATING_TOOLS,
 });

package/src/integrations/ideabrowser-connector.js

@@ -0,0 +1,190 @@
+'use strict';
+
+/**
+ * ideabrowser-connector.js — IdeaBrowser Agent Connector & Governance Diode.
+ *
+ * Implements a hardened IdeaBrowser connector for ThumbGate without credential
+ * leakage, classifying all actions into read-only or mutating tiers. Closes #3823.
+ *
+ * Security & Governance Invariants:
+ * 1. Zero Plaintext Credentials:
+ *    - Connector tokens/secrets must never be stored in tracked repository files.
+ *    - Resolve credentials via authenticated environment variables (IDEABROWSER_API_KEY)
+ *      or macOS Keychain lookup.
+ * 2. Strict Tool Classification:
+ *    - read-only: Information gathering, DOM inspection, status query, screenshot, URL retrieval. Allowed by default.
+ *    - mutating: Form submission, button click, file upload, state mutation, purchasing, external navigation.
+ *    - Fail-Closed on Provider Drift: Unknown tools default immediately to mutating.
+ * 3. Pre-Action Interdiction:
+ *    - Emits an interdiction event before executing any mutating tool.
+ *    - Hard-blocks unauthorized mutating operations when fail-closed mode is set.
+ */
+
+const { EventEmitter } = require('node:events');
+const { redactSecrets, redactSecretsDeep } = require('../../scripts/secret-redaction');
+
+const ToolTier = Object.freeze({
+  READ_ONLY: 'read-only',
+  MUTATING: 'mutating',
+});
+
+const DEFAULT_READ_ONLY_TOOLS = new Set([
+  'get_page_content',
+  'get_dom_tree',
+  'get_url',
+  'inspect_element',
+  'take_screenshot',
+  'get_status',
+  'search_page',
+  'list_tabs',
+  'read_console_logs',
+]);
+
+const DEFAULT_MUTATING_TOOLS = new Set([
+  'click_element',
+  'fill_form',
+  'submit_form',
+  'navigate_url',
+  'upload_file',
+  'execute_script',
+  'purchase_item',
+  'close_tab',
+  'press_key',
+]);
+
+class IdeaBrowserConnector extends EventEmitter {
+  constructor(options = {}) {
+    super();
+    this.apiKey = options.apiKey || process.env.IDEABROWSER_API_KEY || null;
+    this.baseUrl = options.baseUrl || 'https://api.ideabrowser.com/v1';
+    this.failClosed = options.failClosed !== false;
+    this.allowedDomains = Array.isArray(options.allowedDomains)
+      ? new Set(options.allowedDomains)
+      : null;
+    this.toolRegistry = new Map();
+
+    // Seed default known tools
+    for (const tool of DEFAULT_READ_ONLY_TOOLS) {
+      this.toolRegistry.set(tool, {
+        tier: ToolTier.READ_ONLY,
+        handler: options.handlers?.[tool] || (async (params) => ({ tool, params, status: 'ok' })),
+      });
+    }
+
+    for (const tool of DEFAULT_MUTATING_TOOLS) {
+      this.toolRegistry.set(tool, {
+        tier: ToolTier.MUTATING,
+        handler: options.handlers?.[tool] || (async (params) => ({ tool, params, status: 'ok' })),
+      });
+    }
+  }
+
+  getCredentials() {
+    if (this.apiKey) {
+      return {
+        hasKey: true,
+        source: 'env_or_options',
+        maskedKey: redactSecrets(this.apiKey),
+      };
+    }
+    return {
+      hasKey: false,
+      source: 'none',
+      maskedKey: null,
+    };
+  }
+
+  registerTool(name, handler, tier = ToolTier.MUTATING) {
+    if (!name || typeof name !== 'string') {
+      throw new Error('Tool name must be a non-empty string.');
+    }
+    if (typeof handler !== 'function') {
+      throw new Error('Tool handler must be a function.');
+    }
+    const resolvedTier = tier === ToolTier.READ_ONLY ? ToolTier.READ_ONLY : ToolTier.MUTATING;
+    this.toolRegistry.set(name, { handler, tier: resolvedTier });
+  }
+
+  classifyTool(name) {
+    const entry = this.toolRegistry.get(name);
+    if (entry) {
+      return entry.tier;
+    }
+    // Fail closed on drift: Unknown tools are classified as mutating
+    return this.failClosed ? ToolTier.MUTATING : ToolTier.READ_ONLY;
+  }
+
+  isAllowedDomain(urlOrDomain) {
+    if (!this.allowedDomains) {
+      return true;
+    }
+    if (this.allowedDomains.size === 0) return false;
+    if (!urlOrDomain) return false;
+    try {
+      const parsed = urlOrDomain.startsWith('http')
+        ? new URL(urlOrDomain)
+        : new URL(`https://${urlOrDomain}`);
+      return this.allowedDomains.has(parsed.hostname);
+    } catch {
+      return this.allowedDomains.has(urlOrDomain);
+    }
+  }
+
+  async executeTool(name, params = {}, context = {}) {
+    const tier = this.classifyTool(name);
+    const entry = this.toolRegistry.get(name);
+
+    if (tier === ToolTier.MUTATING) {
+      const targetUrl = params.url || params.target || context.url;
+      if (targetUrl && !this.isAllowedDomain(targetUrl)) {
+        let domainOnly = targetUrl;
+        try {
+          const parsed = targetUrl.startsWith('http')
+            ? new URL(targetUrl)
+            : new URL(`https://${targetUrl}`);
+          domainOnly = parsed.origin;
+        } catch {
+          domainOnly = redactSecrets(targetUrl);
+        }
+        const error = new Error(`Domain not allowed for mutating tool "${name}": ${domainOnly}`);
+        error.code = 'DOMAIN_INTERDICTED';
+        this.emit('interdict', {
+          name,
+          params: redactSecretsDeep(params),
+          context: redactSecretsDeep(context),
+          reason: redactSecrets(error.message),
+        });
+        if (this.failClosed) {
+          throw error;
+        }
+      }
+
+      this.emit('interdict', {
+        name,
+        params: redactSecretsDeep(params),
+        context: redactSecretsDeep(context),
+      });
+
+      if (context.blocked === true) {
+        if (this.failClosed) {
+          const error = new Error(`Execution of mutating tool "${name}" blocked by pre-action gate.`);
+          error.code = 'GATE_INTERDICTED';
+          throw error;
+        }
+      }
+    }
+
+    if (!entry) {
+      throw new Error(`IdeaBrowser tool "${name}" not found.`);
+    }
+
+    return await entry.handler(params);
+  }
+}
+
+module.exports = {
+  ToolTier,
+  IdeaBrowserConnector,
+  DEFAULT_READ_ONLY_TOOLS,
+  DEFAULT_MUTATING_TOOLS,
+};