thumbgate 1.5.0 → 1.5.1

package/scripts/auto-wire-hooks.js

@@ -45,6 +45,23 @@ const CLAUDE_HOOKS = {
   },
 };
 
+const CODEX_HOOKS = {
+  PreToolUse: {
+    matcher: 'Bash',
+    hooks: [{ type: 'command', command: preToolHookCommand() }],
+  },
+  UserPromptSubmit: {
+    hooks: [{ type: 'command', command: userPromptHookCommand() }],
+  },
+  PostToolUse: {
+    matcher: 'mcp__thumbgate__feedback_stats|mcp__thumbgate__dashboard',
+    hooks: [{ type: 'command', command: cacheUpdateHookCommand() }],
+  },
+  SessionStart: {
+    hooks: [{ type: 'command', command: sessionStartHookCommand() }],
+  },
+};
+
 // --- Agent detection ---
 
 function detectAgent(flagAgent) {
@@ -338,49 +355,82 @@ function codexConfigPath() {
   return path.join(getHome(), '.codex', 'config.json');
 }
 
+function writeJsonFile(filePath, payload, dryRun) {
+  if (dryRun) {
+    return;
+  }
+
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(payload, null, 2) + '\n');
+}
+
+function upsertCodexHook(configHooks, lifecycle, hookDef, legacyPattern) {
+  const hookCommand = hookDef.hooks[0].command;
+  const pruned = pruneLegacyHookEntries(configHooks[lifecycle], hookCommand, legacyPattern);
+  configHooks[lifecycle] = pruned.hooks;
+
+  const added = [];
+  if (pruned.removed) {
+    added.push({ lifecycle, command: `${hookCommand} (replaced legacy ThumbGate hook)` });
+  }
+
+  if (hookAlreadyPresent(configHooks[lifecycle], hookCommand)) {
+    return added;
+  }
+
+  const entry = { hooks: hookDef.hooks };
+  if (hookDef.matcher) {
+    entry.matcher = hookDef.matcher;
+  }
+
+  configHooks[lifecycle] = configHooks[lifecycle] || [];
+  configHooks[lifecycle].push(entry);
+  added.push({ lifecycle, command: hookCommand });
+  return added;
+}
+
+function syncCodexStatusLine(config, desiredStatusLine) {
+  if (config.statusLine && config.statusLine.command === desiredStatusLine) {
+    return false;
+  }
+
+  config.statusLine = { type: 'command', command: desiredStatusLine };
+  return true;
+}
+
 function wireCodexHooks(options) {
   const configPath = options.settingsPath || codexConfigPath();
   const dryRun = options.dryRun || false;
+  const desiredStatusLine = statuslineCommand();
 
   let config = loadJsonFile(configPath) || {};
   config.hooks = config.hooks || {};
 
   const added = [];
-  const preToolCmd = preToolHookCommand();
-  const userPromptCmd = userPromptHookCommand();
-
-  const preToolPruned = pruneLegacyHookEntries(config.hooks.PreToolUse, preToolCmd, /(generate-pretool-hook\.sh|\bgate-check\b)/);
-  config.hooks.PreToolUse = preToolPruned.hooks;
-  const userPromptPruned = pruneLegacyHookEntries(config.hooks.UserPromptSubmit, userPromptCmd, /(hook-auto-capture\.sh|hook-auto-capture\b)/);
-  config.hooks.UserPromptSubmit = userPromptPruned.hooks;
-
-  if (!hookAlreadyPresent(config.hooks.PreToolUse, preToolCmd)) {
-    config.hooks.PreToolUse = config.hooks.PreToolUse || [];
-    config.hooks.PreToolUse.push({
-      matcher: 'Bash',
-      hooks: [{ type: 'command', command: preToolCmd }],
-    });
-    added.push({ lifecycle: 'PreToolUse', command: preToolCmd });
-  }
+  const legacyPatterns = {
+    PreToolUse: /(generate-pretool-hook\.sh|\bgate-check\b)/,
+    UserPromptSubmit: /(hook-auto-capture\.sh|hook-auto-capture\b)/,
+    PostToolUse: /(hook-thumbgate-cache-updater|cache-update\b)/,
+    SessionStart: /(thumbgate_session_start\.sh|session-start\b)/,
+  };
 
-  if (!hookAlreadyPresent(config.hooks.UserPromptSubmit, userPromptCmd)) {
-    config.hooks.UserPromptSubmit = config.hooks.UserPromptSubmit || [];
-    config.hooks.UserPromptSubmit.push({
-      hooks: [{ type: 'command', command: userPromptCmd }],
-    });
-    added.push({ lifecycle: 'UserPromptSubmit', command: userPromptCmd });
+  for (const [lifecycle, hookDef] of Object.entries(CODEX_HOOKS)) {
+    added.push(...upsertCodexHook(config.hooks, lifecycle, hookDef, legacyPatterns[lifecycle]));
   }
 
   if (added.length === 0) {
+    if (syncCodexStatusLine(config, desiredStatusLine)) {
+      writeJsonFile(configPath, config, dryRun);
+      return { changed: true, settingsPath: configPath, added: [{ lifecycle: 'statusLine', command: desiredStatusLine }] };
+    }
     return { changed: false, settingsPath: configPath, added: [] };
   }
 
-  if (!dryRun) {
-    const dir = path.dirname(configPath);
-    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
-  }
+  syncCodexStatusLine(config, desiredStatusLine);
+  writeJsonFile(configPath, config, dryRun);
 
+  added.push({ lifecycle: 'statusLine', command: desiredStatusLine });
   return { changed: true, settingsPath: configPath, added };
 }
 

package/scripts/bot-detection.js

@@ -0,0 +1,165 @@
+'use strict';
+
+/**
+ * bot-detection.js — Cheap heuristic to detect crawlers, link-preview
+ * fetchers, and LLM scrapers hitting the checkout endpoint.
+ *
+ * Why this matters:
+ *   GET /checkout/pro immediately creates a live Stripe Checkout session
+ *   and 302s to Stripe. Every bot that follows that redirect spawns a
+ *   session that will never complete. Result: the funnel shows "100+
+ *   sessions opened, 0 completed" — which looks like product failure but
+ *   is actually bot noise.
+ *
+ * The fix: if the requester is probably a bot, serve an HTML interstitial
+ * that does NOT create a Stripe session. A real user on an interstitial
+ * page clicks through (or the page JS-redirects them). A bot sees HTML
+ * and moves on without dirtying the funnel.
+ *
+ * Heuristics (all cheap string checks):
+ *   1. User-Agent matches a known bot/crawler/preview pattern.
+ *   2. User-Agent is missing entirely (raw curl/Node fetch defaults).
+ *   3. Accept header lacks text/html (most browsers send it; bots don't).
+ *   4. Purpose / Sec-Purpose = 'prefetch' (Chrome's link prefetch).
+ *   5. Sec-Fetch-Mode indicates preflight/prefetch rather than navigate.
+ *
+ * We intentionally err on the side of classifying ambiguous traffic as
+ * "bot" — the downside (user sees an extra click) is tiny compared to
+ * the upside (clean conversion data).
+ */
+
+const BOT_PATTERNS = [
+  // Search engine crawlers
+  /\bgooglebot\b/i,
+  /\bbingbot\b/i,
+  /\byandex(?:bot|images)\b/i,
+  /\bbaiduspider\b/i,
+  /\bduckduckbot\b/i,
+  /\bapplebot\b/i,
+  // LLM / AI crawlers — these started exploding in 2024+
+  /\bgptbot\b/i,
+  /\bchatgpt-user\b/i,
+  /\boai-searchbot\b/i,
+  /\bperplexitybot\b/i,
+  /\banthropic-ai\b/i,
+  /\bclaude(?:bot|-web)\b/i,
+  /\bccbot\b/i,
+  /\bcohere-ai\b/i,
+  /\bbytespider\b/i,
+  /\bmeta-externalagent\b/i,
+  /\bimagesiftbot\b/i,
+  /\bdiffbot\b/i,
+  // Link-preview fetchers
+  /\bfacebookexternalhit\b/i,
+  /\bfacebot\b/i,
+  /\blinkedinbot\b/i,
+  /\btwitterbot\b/i,
+  /\bslackbot(?:-linkexpanding)?\b/i,
+  /\btelegrambot\b/i,
+  /\bwhatsapp\b/i,
+  /\bdiscordbot\b/i,
+  /\bskypeuripreview\b/i,
+  /\bpinterest(?:bot|\/)/i,
+  /\bredditbot\b/i,
+  /\bembedly\b/i,
+  /\biframely\b/i,
+  // Generic bot/crawler/spider markers
+  /\bbot\b/i,
+  /\bcrawler\b/i,
+  /\bcrawl\b/i,
+  /\bspider\b/i,
+  /\brobot\b/i,
+  /\bheadless(?:chrome|browser)?\b/i,
+  /\bphantomjs\b/i,
+  /\bpuppeteer\b/i,
+  /\bplaywright\b/i,
+  /\bselenium\b/i,
+  // HTTP clients (not browsers)
+  /\bcurl\//i,
+  /\bwget\//i,
+  /\bnode-fetch\b/i,
+  /\bgot\s*\(/i,
+  /\bpython-requests\b/i,
+  /\bpython-urllib\b/i,
+  /\baxios\b/i,
+  /\bokhttp\b/i,
+  /\blibwww-perl\b/i,
+  /\bjava\//i,
+  /\bgo-http-client\b/i,
+  /\bruby\b/i,
+  // API/test tools
+  /\bpostman(?:runtime)?\b/i,
+  /\binsomnia\b/i,
+  /\bhttpie\b/i,
+  // Uptime/monitoring/security scanners
+  /\buptimerobot\b/i,
+  /\bbetteruptime\b/i,
+  /\bpingdom\b/i,
+  /\bstatuscake\b/i,
+  /\bnewrelic\b/i,
+  /\bdatadog\b/i,
+  /\bahrefs\b/i,
+  /\bsemrush\b/i,
+  /\bmj12bot\b/i,
+  /\bdotbot\b/i,
+  /\bsocket(?:bot|-io)\b/i,
+  /\bgitguardian\b/i,
+  /\bsnyk\b/i,
+  // Perf/audit
+  /\blighthouse\b/i,
+  /\bspeedcurve\b/i,
+  /\bpagespeed\b/i,
+];
+
+function normalizeHeader(value) {
+  if (Array.isArray(value)) return value.join(',');
+  return typeof value === 'string' ? value : '';
+}
+
+/**
+ * @param {import('http').IncomingHttpHeaders | Record<string,string>} headers
+ * @returns {{ isBot: boolean, reason: string | null }}
+ */
+function classifyRequester(headers = {}) {
+  const ua = normalizeHeader(headers['user-agent'] || headers['User-Agent']).trim();
+  if (!ua) {
+    return { isBot: true, reason: 'missing_user_agent' };
+  }
+  for (const pattern of BOT_PATTERNS) {
+    if (pattern.test(ua)) {
+      return { isBot: true, reason: `ua_match:${pattern.source}` };
+    }
+  }
+
+  const purpose = normalizeHeader(headers.purpose || headers['sec-purpose']).toLowerCase();
+  if (purpose.includes('prefetch')) {
+    return { isBot: true, reason: 'prefetch_purpose' };
+  }
+
+  const secFetchMode = normalizeHeader(headers['sec-fetch-mode']).toLowerCase();
+  if (secFetchMode && secFetchMode !== 'navigate' && secFetchMode !== 'cors' && secFetchMode !== 'same-origin') {
+    return { isBot: true, reason: `sec_fetch_mode:${secFetchMode}` };
+  }
+
+  const accept = normalizeHeader(headers.accept || headers.Accept).toLowerCase();
+  // Real browsers navigating to a page send an Accept header that includes
+  // text/html. Bots frequently send */* or application/json or nothing.
+  if (accept && !accept.includes('text/html') && !accept.includes('*/*')) {
+    return { isBot: true, reason: 'accept_no_html' };
+  }
+  if (!accept) {
+    return { isBot: true, reason: 'missing_accept' };
+  }
+
+  return { isBot: false, reason: null };
+}
+
+function isProbablyBot(headers) {
+  return classifyRequester(headers).isBot;
+}
+
+module.exports = {
+  classifyRequester,
+  isProbablyBot,
+  BOT_PATTERNS,
+};

package/scripts/cli-feedback.js

@@ -78,8 +78,12 @@ function formatCliOutput(result) {
   // Header
   if (result.feedbackResult && result.feedbackResult.accepted !== false) {
     lines.push(`${isDown ? R : G}${BD}${isDown ? '👎 Thumbs down recorded' : '👍 Thumbs up recorded'}${RST}`);
-    if (result.feedbackResult.id) {
-      lines.push(`${D}  ID: ${result.feedbackResult.id}${RST}`);
+    const feedbackId = (result.feedbackResult.feedbackEvent && result.feedbackResult.feedbackEvent.id) || result.feedbackResult.id;
+    if (feedbackId) {
+      lines.push(`${D}  ID: ${feedbackId}${RST}`);
+      // Echo feedback ID to stderr so it's visible directly in the terminal,
+      // not hidden behind Claude Code's "ctrl+o to expand" MCP call collapse.
+      process.stderr.write(`✅ Feedback captured (${feedbackId})\n`);
     }
   } else {
     lines.push(`${R}Feedback not accepted: ${(result.feedbackResult && result.feedbackResult.reason) || 'unknown'}${RST}`);

package/scripts/commercial-offer.js

@@ -5,16 +5,16 @@ const PRO_ANNUAL_PAYMENT_LINK = 'https://buy.stripe.com/3cI8wPfCYaPs2dzdKz3sI07'
 
 const PRO_MONTHLY_PRICE_ID = 'price_1THQY7GGBpd520QYHoS7RG0J';
 const PRO_ANNUAL_PRICE_ID = 'price_1THQZ7GGBpd520QYxzDRnxhB';
-const TEAM_MONTHLY_PRICE_ID = 'price_1TKLUhGGBpd520QYr5pgEZit';
+const TEAM_MONTHLY_PRICE_ID = 'price_1TMIagGGBpd520QY1fUOawZt';
 
 const PRO_MONTHLY_PRICE_DOLLARS = 19;
 const PRO_ANNUAL_PRICE_DOLLARS = 149;
-const TEAM_MONTHLY_PRICE_DOLLARS = 99;
-const TEAM_ANNUAL_PRICE_DOLLARS = 1188;
+const TEAM_MONTHLY_PRICE_DOLLARS = 49;
+const TEAM_ANNUAL_PRICE_DOLLARS = 588;
 const TEAM_MIN_SEATS = 3;
 
 const PRO_PRICE_LABEL = '$19/mo or $149/yr (individual)';
-const TEAM_PRICE_LABEL = '$99/seat/mo — Agent governance for engineering teams';
+const TEAM_PRICE_LABEL = '$49/seat/mo — Agent governance for engineering teams';
 
 function normalizePlanId(value) {
   const text = String(value || '').trim().toLowerCase();

package/scripts/dashboard.js

@@ -262,6 +262,93 @@ function computePreventionImpact(feedbackDir, gateStats) {
   };
 }
 
+// ---------------------------------------------------------------------------
+// Feedback time series (daily up/down for charts)
+// ---------------------------------------------------------------------------
+
+function computeFeedbackTimeSeries(entries, dayCount = 30) {
+  const today = new Date();
+  today.setHours(0, 0, 0, 0);
+  const days = [];
+
+  for (let offset = dayCount - 1; offset >= 0; offset -= 1) {
+    const day = new Date(today);
+    day.setDate(today.getDate() - offset);
+    const dayKey = toLocalDayKey(day);
+    days.push({ dayKey, up: 0, down: 0, lessons: 0 });
+  }
+
+  const dayMap = new Map(days.map((d) => [d.dayKey, d]));
+
+  for (const entry of entries) {
+    if (!entry.timestamp) continue;
+    const dayKey = toLocalDayKey(entry.timestamp);
+    const bucket = dayMap.get(dayKey);
+    if (!bucket) continue;
+    const signal = String(entry.signal || entry.feedback || '').toLowerCase();
+    if (['up', 'positive', 'thumbs_up'].includes(signal)) bucket.up += 1;
+    else if (['down', 'negative', 'thumbs_down'].includes(signal)) bucket.down += 1;
+  }
+
+  return { dayCount, days };
+}
+
+function isAuditTrailEntry(entry) {
+  return Array.isArray(entry.tags) && entry.tags.includes('audit-trail');
+}
+
+// ---------------------------------------------------------------------------
+// Lesson pipeline (feedback → lesson → gate conversion)
+// ---------------------------------------------------------------------------
+
+function computeLessonPipeline(feedbackDir, entries, gateStats) {
+  const memoryLogPath = path.join(feedbackDir, 'memory-log.jsonl');
+  const memories = readJSONL(memoryLogPath);
+
+  const totalFeedback = entries.length;
+  const totalNegative = entries.filter((e) => {
+    const s = String(e.signal || e.feedback || '').toLowerCase();
+    return ['down', 'negative', 'thumbs_down'].includes(s);
+  }).length;
+  const totalPositive = totalFeedback - totalNegative;
+
+  const totalLessons = memories.filter((m) => m.category === 'error' || m.category === 'learning').length;
+  const errorLessons = memories.filter((m) => m.category === 'error').length;
+  const learningLessons = memories.filter((m) => m.category === 'learning').length;
+
+  const autoGatesPath = getAutoGatesPath();
+  const autoGates = readJsonFile(autoGatesPath);
+  const promotedGates = autoGates && Array.isArray(autoGates.gates) ? autoGates.gates.length : 0;
+
+  const feedbackToLessonRate = totalFeedback > 0
+    ? Math.round((totalLessons / totalFeedback) * 100) : 0;
+  const lessonToGateRate = totalLessons > 0
+    ? Math.min(100, Math.round((promotedGates / totalLessons) * 100)) : 0;
+  const totalBlocked = gateStats.blocked || 0;
+
+  // Populate lesson counts onto the time series if available
+  const lessonsByDay = new Map();
+  for (const m of memories) {
+    if (!m.timestamp) continue;
+    const dayKey = toLocalDayKey(m.timestamp);
+    if (dayKey) lessonsByDay.set(dayKey, (lessonsByDay.get(dayKey) || 0) + 1);
+  }
+
+  return {
+    stages: [
+      { id: 'feedback', label: 'Feedback Signals', count: totalFeedback, detail: `${totalPositive} up / ${totalNegative} down` },
+      { id: 'lessons', label: 'Lessons Distilled', count: totalLessons, detail: `${errorLessons} mistakes / ${learningLessons} good patterns` },
+      { id: 'gates', label: 'Gates Promoted', count: promotedGates, detail: `${lessonToGateRate}% of lessons become gates` },
+      { id: 'blocked', label: 'Actions Blocked', count: totalBlocked, detail: `Repeat mistakes prevented` },
+    ],
+    rates: {
+      feedbackToLesson: feedbackToLessonRate,
+      lessonToGate: lessonToGateRate,
+    },
+    lessonsByDay,
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Session trend (last N sessions)
 // ---------------------------------------------------------------------------
@@ -761,11 +848,61 @@ function resolveTeamWindowHours(analyticsWindow) {
 // Full dashboard data
 // ---------------------------------------------------------------------------
 
+function collectAllFeedbackEntries(feedbackDir) {
+  const entries = [];
+  const seen = new Set();
+
+  function mergeFrom(logPath) {
+    if (!fs.existsSync(logPath)) return;
+    for (const entry of readJSONL(logPath)) {
+      const id = entry.id || entry.feedbackId;
+      if (id && seen.has(id)) continue;
+      if (id) seen.add(id);
+      entries.push(entry);
+    }
+  }
+
+  // Primary: the passed feedbackDir (global ~/.thumbgate)
+  mergeFrom(path.join(feedbackDir, 'feedback-log.jsonl'));
+
+  // Project-local .thumbgate directories (e.g. repo/.thumbgate/feedback-log.jsonl)
+  // The MCP server may write to a project-scoped dir that differs from the global one.
+  const projectsDir = path.join(feedbackDir, 'projects');
+  if (fs.existsSync(projectsDir)) {
+    try {
+      for (const project of fs.readdirSync(projectsDir)) {
+        mergeFrom(path.join(projectsDir, project, 'feedback-log.jsonl'));
+      }
+    } catch { /* ignore read errors */ }
+  }
+
+  // Also check the project root's .thumbgate if feedbackDir is global
+  // The MCP server often resolves to PROJECT_ROOT/.thumbgate for project-scoped feedback
+  // Skip this merge when feedbackDir is a temp/test directory (not ~/.thumbgate)
+  const homeThumbgate = path.join(process.env.HOME || '/tmp', '.thumbgate');
+  const projectLocalDir = path.join(PROJECT_ROOT, '.thumbgate');
+  if (
+    path.resolve(feedbackDir) === path.resolve(homeThumbgate) &&
+    projectLocalDir !== feedbackDir &&
+    fs.existsSync(projectLocalDir)
+  ) {
+    mergeFrom(path.join(projectLocalDir, 'feedback-log.jsonl'));
+  }
+
+  // Sort by timestamp for consistent ordering
+  entries.sort((a, b) => {
+    const ta = a.timestamp ? new Date(a.timestamp).getTime() : 0;
+    const tb = b.timestamp ? new Date(b.timestamp).getTime() : 0;
+    return ta - tb;
+  });
+
+  return entries;
+}
+
 function generateDashboard(feedbackDir, options = {}) {
   const analyticsWindow = resolveAnalyticsWindow(options.analyticsWindow || options);
-  const feedbackLogPath = path.join(feedbackDir, 'feedback-log.jsonl');
   const diagnosticLogPath = path.join(feedbackDir, 'diagnostic-log.jsonl');
-  const entries = readJSONL(feedbackLogPath);
+  const entries = collectAllFeedbackEntries(feedbackDir);
   const diagnosticEntries = readJSONL(diagnosticLogPath);
   const billingSummary = options.billingSummary || getBillingSummary(analyticsWindow);
 
@@ -831,6 +968,14 @@ function generateDashboard(feedbackDir, options = {}) {
     },
   };
 
+  const feedbackTimeSeries = computeFeedbackTimeSeries(entries, 30);
+  const lessonPipeline = computeLessonPipeline(feedbackDir, entries, gateStats);
+
+  // Merge lesson counts into feedbackTimeSeries days
+  for (const day of feedbackTimeSeries.days) {
+    day.lessons = lessonPipeline.lessonsByDay.get(day.dayKey) || 0;
+  }
+
   const team = generateOrgDashboard({
     windowHours: resolveTeamWindowHours(analyticsWindow),
     authContext: options.authContext,
@@ -872,6 +1017,11 @@ function generateDashboard(feedbackDir, options = {}) {
     templateLibrary,
     liveMetrics,
     predictive,
+    feedbackTimeSeries,
+    lessonPipeline: {
+      stages: lessonPipeline.stages,
+      rates: lessonPipeline.rates,
+    },
   };
 }