thumbgate 0.9.11 → 0.9.13

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "plugins": [
     {
       "name": "thumbgate",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "Pre-action gates that block AI coding agents from repeating known mistakes. Captures feedback, auto-promotes failures into prevention rules, and enforces them via PreToolUse hooks.",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "author": {
     "name": "Igor Ganapolsky"
   },

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://github.com/IgorGanapolsky/thumbgate",
   "transport": "stdio",

package/adapters/README.md

@@ -3,7 +3,7 @@
 - `chatgpt/openapi.yaml`: import into GPT Actions.
 - `gemini/function-declarations.json`: Gemini function-calling definitions.
 - `mcp/server-stdio.js`: underlying local MCP stdio server implementation.
-- `claude/.mcp.json`: example Claude Code MCP config using `npx --yes --package thumbgate@0.9.11 thumbgate serve`.
+- `claude/.mcp.json`: example Claude Code MCP config using `npx --yes --package thumbgate@0.9.13 thumbgate serve`.
 - `codex/config.toml`: example Codex MCP profile section using the same version-pinned portable launcher.
 - `amp/skills/thumbgate-feedback/SKILL.md`: Amp skill template.
 - `opencode/opencode.json`: portable OpenCode MCP profile using the same version-pinned portable launcher.

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@0.9.11", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@0.9.13", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@0.9.11", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@0.9.13", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/codex/config.toml

@@ -1,9 +1,9 @@
 # Codex MCP profile (copy into ~/.codex/config.toml or merge section)
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.11", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@0.9.13", "thumbgate", "serve"]
 
 # Hard PreToolUse hook for Codex
 [hooks.pre_tool_use]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.11", "thumbgate", "gate-check"]
+args = ["--yes", "--package", "thumbgate@0.9.13", "thumbgate", "gate-check"]

package/adapters/mcp/server-stdio.js

@@ -111,7 +111,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '0.9.11' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '0.9.13' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@0.9.11",
+        "thumbgate@0.9.13",
         "thumbgate",
         "serve"
       ],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
-  "version": "0.9.11",
-  "description": "ThumbGate \u2014 Make your AI coding agent self-improving. Every mistake becomes a prevention rule that physically blocks the agent from repeating it. Feedback-driven enforcement via PreToolUse hooks, Thompson Sampling for adaptive gates, SQLite+FTS5 lesson DB, and LanceDB vector search. Your agent gets smarter with every session.",
+  "version": "0.9.13",
+  "description": "ThumbGate — Make your AI coding agent self-improving. Every mistake becomes a prevention rule that physically blocks the agent from repeating it. Feedback-driven enforcement via PreToolUse hooks, Thompson Sampling for adaptive gates, SQLite+FTS5 lesson DB, and LanceDB vector search. Your agent gets smarter with every session.",
   "homepage": "https://thumbgate-production.up.railway.app",
   "repository": {
     "type": "git",

package/plugins/claude-codex-bridge/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-bridge",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "Run Codex review, adversarial review, and second-pass handoffs from Claude Code while keeping ThumbGate reliability memory in the loop.",
   "author": {
     "name": "Igor Ganapolsky",

package/plugins/claude-codex-bridge/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "--yes",
         "--package",
-        "thumbgate@0.9.11",
+        "thumbgate@0.9.13",
         "thumbgate",
         "serve"
       ]

package/plugins/codex-profile/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-profile",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "ThumbGate for Codex: pre-action gates, skill packs, hallucination detection, PII scanning, progressive disclosure (82% token savings), and MCP-backed reliability memory.",
   "author": {
     "name": "Igor Ganapolsky",

package/plugins/codex-profile/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "--yes",
         "--package",
-        "thumbgate@0.9.11",
+        "thumbgate@0.9.13",
         "thumbgate",
         "serve"
       ]

package/plugins/codex-profile/INSTALL.md

@@ -31,7 +31,7 @@ The following block is appended to `~/.codex/config.toml`:
 ```toml
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.11", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@0.9.13", "thumbgate", "serve"]
 ```
 
 The repo-local Codex app plugin ships the same runtime path through `plugins/codex-profile/.mcp.json`, so the manual config and plugin metadata stay aligned.

package/plugins/codex-profile/README.md

@@ -29,7 +29,7 @@ That profile launches:
 ```toml
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.11", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@0.9.13", "thumbgate", "serve"]
 ```
 
 ## Why this exists

package/plugins/cursor-marketplace/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "thumbgate",
   "displayName": "ThumbGate",
   "description": "👍👎 Thumbs down a mistake — your AI agent won't repeat it. Thumbs up good work — it remembers the pattern.",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "author": {
     "name": "Igor Ganapolsky"
   },

package/plugins/opencode-profile/INSTALL.md

@@ -25,7 +25,7 @@ The portable profile adds this MCP server entry:
   "mcp": {
     "thumbgate": {
       "type": "local",
-      "command": ["npx", "--yes", "--package", "thumbgate@0.9.11", "thumbgate", "serve"],
+      "command": ["npx", "--yes", "--package", "thumbgate@0.9.13", "thumbgate", "serve"],
       "enabled": true
     }
   }

package/public/index.html

@@ -554,7 +554,7 @@ __GA_BOOTSTRAP__
 <!-- HOW IT WORKS -->
 <section class="how-it-works" id="how-it-works">
   <div class="container">
-    <div class="section-label">New in v0.9.11</div>
+    <div class="section-label">New in v0.9.13</div>
     <h2 class="section-title">Three steps to stop repeated AI failures</h2>
     <div class="steps">
       <div class="step">

package/scripts/hook-runtime.js

@@ -6,7 +6,7 @@ const {
   isSourceCheckout,
   publishedCliAvailable,
 } = require('./mcp-config');
-const { runPublishedCliHelp, publishedCliArgs } = require('./published-cli');
+const { publishedCliShellCommand } = require('./published-cli');
 
 const PKG_ROOT = path.join(__dirname, '..');
 const featureSupportCache = new Map();
@@ -28,15 +28,7 @@ function publishedHookCommandsAvailable(version) {
     return featureSupportCache.get(version);
   }
 
-  let available = false;
-  try {
-    const helpText = runPublishedCliHelp(version, { timeout: 8000 });
-    available = ['gate-check', 'cache-update', 'statusline-render', 'hook-auto-capture', 'session-start']
-      .every((command) => helpText.includes(command));
-  } catch {
-    available = false;
-  }
-
+  const available = true;
   featureSupportCache.set(version, available);
   return available;
 }
@@ -44,12 +36,12 @@ function publishedHookCommandsAvailable(version) {
 function resolveCliBaseCommand() {
   const version = packageVersion();
   if (publishedHookCommandsAvailable(version)) {
-    return `npx ${publishedCliArgs(version).map(shellQuote).join(' ')}`;
+    return publishedCliShellCommand(version);
   }
   if (isSourceCheckout(PKG_ROOT)) {
     return `node ${shellQuote(path.join(PKG_ROOT, 'bin', 'cli.js'))}`;
   }
-  return `npx -y thumbgate@${version}`;
+  return publishedCliShellCommand(version);
 }
 
 function buildPortableHookCommand(subcommand) {

package/scripts/install-mcp.js

@@ -30,8 +30,6 @@ function resolveMcpServerConfig(flags = {}) {
   });
 }
 
-const MCP_SERVER_CONFIG = resolveMcpServerConfig();
-
 function parseFlags(argv) {
   const flags = {};
   for (const arg of argv) {
@@ -155,7 +153,6 @@ function installMcp(flags) {
 module.exports = {
   MCP_SERVER_KEY,
   LEGACY_MCP_SERVER_KEYS,
-  MCP_SERVER_CONFIG,
   resolveMcpServerConfig,
   resolveSettingsPath,
   loadSettings,

package/scripts/mcp-config.js

@@ -3,7 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const { execFileSync } = require('child_process');
-const { publishedCliArgs, runPublishedCliHelp } = require('./published-cli');
+const { publishedCliShellCommand } = require('./published-cli');
 const DEFAULT_PKG_ROOT = path.join(__dirname, '..');
 const cliAvailabilityCache = new Map();
 
@@ -101,8 +101,8 @@ function resolveLocalServerPath(pkgRoot, scope = 'project') {
 
 function portableMcpEntry(pkgVersion) {
   return {
-    command: 'npx',
-    args: publishedCliArgs(pkgVersion, ['serve']),
+    command: 'sh',
+    args: ['-lc', publishedCliShellCommand(pkgVersion, ['serve'])],
   };
 }
 
@@ -163,33 +163,26 @@ function publishedCliOverride() {
 }
 
 function publishedCliAvailable(pkgVersion) {
-  if (!isVersionPublished(pkgVersion)) {
-    return false;
-  }
   const override = publishedCliOverride();
   if (override !== null) {
     return override;
   }
-  if (cliAvailabilityCache.has(pkgVersion)) {
-    return cliAvailabilityCache.get(pkgVersion);
+  if (!isVersionPublished(pkgVersion)) {
+    return false;
   }
-
-  let available = false;
-  try {
-    runPublishedCliHelp(pkgVersion, { timeout: 8000 });
-    available = true;
-  } catch (_) {
-    available = false;
+  if (!cliAvailabilityCache.has(pkgVersion)) {
+    cliAvailabilityCache.set(pkgVersion, true);
   }
-
-  cliAvailabilityCache.set(pkgVersion, available);
-  return available;
+  return cliAvailabilityCache.get(pkgVersion);
 }
 
 function resolveMcpEntry({ pkgRoot, pkgVersion, scope = 'project', targetDir = pkgRoot }) {
   if (!isSourceCheckout(pkgRoot)) {
     return portableMcpEntry(pkgVersion);
   }
+  if (scope === 'home' && publishedCliAvailable(pkgVersion)) {
+    return portableMcpEntry(pkgVersion);
+  }
   if (scope === 'project' && !isSameCheckoutFamily(pkgRoot, targetDir) && publishedCliAvailable(pkgVersion)) {
     return portableMcpEntry(pkgVersion);
   }

package/scripts/post-everywhere.js

@@ -183,6 +183,32 @@ async function postToDevTo(parsed, dryRun) {
   return devto.publishArticle({ title, body_markdown: body, tags: parsed.tags });
 }
 
+async function postToTikTok(parsed, dryRun) {
+  const text = parsed.body || '';
+  if (!text) throw new Error('TikTok post requires body');
+
+  if (dryRun) {
+    console.log(`[dry-run] TikTok: "${text.slice(0, 100)}..." (${text.length} chars)`);
+    return { dryRun: true };
+  }
+
+  const tiktok = getPublisher('tiktok');
+  return tiktok.publishPost({ text });
+}
+
+async function postToYouTube(parsed, dryRun) {
+  const { title, body } = parsed;
+  if (!title || !body) throw new Error('YouTube post requires title and body');
+
+  if (dryRun) {
+    console.log(`[dry-run] YouTube: "${title}" (${body.length} chars)`);
+    return { dryRun: true };
+  }
+
+  const youtube = getPublisher('youtube');
+  return youtube.publishPost({ title, description: body });
+}
+
 // ---------------------------------------------------------------------------
 // Main orchestrator
 // ---------------------------------------------------------------------------
@@ -192,6 +218,8 @@ const DISPATCHERS = {
   x: postToX,
   linkedin: postToLinkedIn,
   devto: postToDevTo,
+  tiktok: postToTikTok,
+  youtube: postToYouTube,
 };
 
 async function postEverywhere(filePath, { platforms, dryRun } = {}) {
@@ -211,7 +239,7 @@ async function postEverywhere(filePath, { platforms, dryRun } = {}) {
   // Determine which platforms to post to.
   // Default excludes devto — high-volume Dev.to posting is counterproductive (0 engagement on 427 posts).
   // Use --platforms=devto explicitly for monthly cross-posts only.
-  const DEFAULT_PLATFORMS = ['reddit', 'x', 'linkedin'];
+  const DEFAULT_PLATFORMS = ['reddit', 'x', 'linkedin', 'tiktok', 'youtube'];
   const targetPlatforms = platforms || (parsed.platform ? [parsed.platform] : DEFAULT_PLATFORMS);
 
   // Preserve original body/comment so each platform gets a fresh UTM tag

package/scripts/published-cli.js

@@ -5,14 +5,39 @@ const os = require('os');
 const path = require('path');
 const { execFileSync } = require('child_process');
 
-function publishedCliArgs(pkgVersion, commandArgs = []) {
-  return ['--yes', '--package', `thumbgate@${pkgVersion}`, 'thumbgate', ...commandArgs];
+function shellQuote(value) {
+  return JSON.stringify(String(value));
+}
+
+function runtimePrefixDir(prefixDir) {
+  return prefixDir || path.join(os.homedir(), '.thumbgate', 'runtime');
+}
+
+function publishedCliArgs(pkgVersion, commandArgs = [], options = {}) {
+  return [
+    'exec',
+    '--prefix',
+    runtimePrefixDir(options.prefixDir),
+    '--yes',
+    '--package',
+    `thumbgate@${pkgVersion}`,
+    '--',
+    'thumbgate',
+    ...commandArgs,
+  ];
+}
+
+function publishedCliShellCommand(pkgVersion, commandArgs = [], options = {}) {
+  const prefixDir = runtimePrefixDir(options.prefixDir);
+  return `mkdir -p ${shellQuote(prefixDir)} && exec npm ${publishedCliArgs(pkgVersion, commandArgs, { prefixDir }).map(shellQuote).join(' ')}`;
 }
 
 function runPublishedCli(pkgVersion, commandArgs = [], options = {}) {
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'thumbgate-published-cli-'));
+  const prefixDir = path.join(tmpDir, 'runtime');
   try {
-    return execFileSync('npx', publishedCliArgs(pkgVersion, commandArgs), {
+    fs.mkdirSync(prefixDir, { recursive: true });
+    return execFileSync('npm', publishedCliArgs(pkgVersion, commandArgs, { prefixDir }), {
       encoding: 'utf8',
       stdio: ['ignore', 'pipe', 'ignore'],
       timeout: options.timeout || 8000,
@@ -29,6 +54,8 @@ function runPublishedCliHelp(pkgVersion, options = {}) {
 
 module.exports = {
   publishedCliArgs,
+  publishedCliShellCommand,
+  runtimePrefixDir,
   runPublishedCli,
   runPublishedCliHelp,
 };

package/scripts/social-analytics/poll-all.js

@@ -9,6 +9,9 @@ const { initDb } = require('./store');
 
 const POLLERS = [
   { name: 'github', module: './pollers/github', envRequired: ['GITHUB_TOKEN'] },
+  // Direct Instagram Graph API poller. Requires INSTAGRAM_ACCESS_TOKEN + INSTAGRAM_USER_ID.
+  // When those are absent, Instagram engagement data is still captured via the Zernio poller
+  // below (getConnectedAccounts returns Instagram accounts when Zernio is connected to IG).
   { name: 'instagram', module: './pollers/instagram', envRequired: ['INSTAGRAM_ACCESS_TOKEN', 'INSTAGRAM_USER_ID'] },
   { name: 'tiktok', module: './pollers/tiktok', envRequired: ['TIKTOK_ACCESS_TOKEN'] },
   { name: 'linkedin', module: './pollers/linkedin', envRequired: ['LINKEDIN_ACCESS_TOKEN', 'LINKEDIN_PERSON_URN'] },
@@ -16,7 +19,10 @@ const POLLERS = [
   { name: 'reddit', module: './pollers/reddit', envRequired: ['REDDIT_CLIENT_ID', 'REDDIT_CLIENT_SECRET', 'REDDIT_USERNAME', 'REDDIT_PASSWORD'] },
   { name: 'threads', module: './pollers/threads', envRequired: ['THREADS_ACCESS_TOKEN', 'THREADS_USER_ID'] },
   { name: 'youtube', module: './pollers/youtube', envRequired: ['YOUTUBE_API_KEY', 'YOUTUBE_CHANNEL_ID'] },
-  { name: 'plausible', module: './pollers/plausible', envRequired: ['PLAUSIBLE_API_KEY', 'PLAUSIBLE_SITE_ID'] },
+  // PLAUSIBLE_SITE_ID defaults to thumbgate-production.up.railway.app if not set.
+  { name: 'plausible', module: './pollers/plausible', envRequired: ['PLAUSIBLE_API_KEY'] },
+  // Zernio covers all connected social accounts (including Instagram) via its unified API.
+  // Instagram posts published via Zernio will have their engagement metrics captured here.
   { name: 'zernio', module: './pollers/zernio', envRequired: ['ZERNIO_API_KEY'] },
 ];
 
@@ -37,10 +43,19 @@ async function pollAll(options = {}) {
 
     try {
       const mod = require(poller.module);
-      const fn = mod[`poll${poller.name.charAt(0).toUpperCase()}${poller.name.slice(1)}`]
-        || mod.pollGitHub || mod.pollInstagram || mod.pollTikTok
-        || mod.pollLinkedIn || mod.pollX || mod.pollReddit
-        || mod.pollThreads || mod.pollPlausible || mod.pollZernio;
+      // Resolve the poll function by trying the simple title-case name first, then
+      // known capitalization variants (pollGitHub, pollTikTok, pollLinkedIn, pollYouTube),
+      // and finally any exported function whose name starts with "poll" as a last resort.
+      const baseName = poller.name.charAt(0).toUpperCase() + poller.name.slice(1);
+      const KNOWN_VARIANTS = {
+        github:   'pollGitHub',
+        tiktok:   'pollTikTok',
+        linkedin: 'pollLinkedIn',
+        youtube:  'pollYouTube',
+      };
+      const fn = mod[`poll${baseName}`]
+        || (KNOWN_VARIANTS[poller.name] && mod[KNOWN_VARIANTS[poller.name]])
+        || Object.values(mod).find((v) => typeof v === 'function' && v.name && v.name.startsWith('poll'));
 
       if (!fn) {
         console.log(`⚠  ${poller.name}: no poll function found in module`);

package/scripts/social-analytics/pollers/plausible.js

@@ -23,10 +23,9 @@ const PLAUSIBLE_BASE = 'https://plausible.io/api/v1';
  */
 async function plausibleQuery(endpoint, params = {}) {
   const apiKey = process.env.PLAUSIBLE_API_KEY;
-  const siteId = process.env.PLAUSIBLE_SITE_ID;
+  const siteId = process.env.PLAUSIBLE_SITE_ID || 'thumbgate-production.up.railway.app';
 
   if (!apiKey) throw new Error('PLAUSIBLE_API_KEY is not set');
-  if (!siteId) throw new Error('PLAUSIBLE_SITE_ID is not set');
 
   const qs = new URLSearchParams({ site_id: siteId, ...params });
   const url = `${PLAUSIBLE_BASE}${endpoint}?${qs.toString()}`;
@@ -153,9 +152,8 @@ async function getFunnelMetrics(period = '7d') {
  * @returns {Promise<object>} Summary of stored results.
  */
 async function pollPlausible(db) {
-  const siteId = process.env.PLAUSIBLE_SITE_ID;
+  const siteId = process.env.PLAUSIBLE_SITE_ID || 'thumbgate-production.up.railway.app';
   if (!process.env.PLAUSIBLE_API_KEY) throw new Error('PLAUSIBLE_API_KEY is not set');
-  if (!siteId) throw new Error('PLAUSIBLE_SITE_ID is not set');
 
   const period = '7d';
   const fetchedAt = new Date().toISOString();

package/scripts/social-analytics/publish-thumbgate-launch.js

@@ -146,6 +146,8 @@ function buildCampaignEntries() {
           buildLandingUrl('linkedin', 'campaign_proof_pack'),
         ].join(' '),
         instagram: `${THUMBGATE_CAPTION}\n\nProof-backed workflow hardening.\n\n${buildLandingUrl('instagram', 'campaign_proof_pack')}`,
+        tiktok: `Your AI agent has amnesia. Give it memory that survives restarts.\n\nThumbGate: proof-backed workflow hardening for coding agents.\n\n#AIAgents #DeveloperTools #ClaudeCode #ThumbGate`,
+        youtube: `Your AI agent has amnesia. Give it memory that survives restarts.\n\nThumbGate turns thumbs-down feedback into prevention rules that block mistakes permanently.\n\n${buildLandingUrl('youtube', 'campaign_proof_pack')}`,
       },
     },
     {
@@ -166,6 +168,8 @@ function buildCampaignEntries() {
           'ThumbGate keeps the feedback loop local, durable, and enforceable.',
           buildLandingUrl('instagram', 'campaign_free_local'),
         ].join('\n\n'),
+        tiktok: `Free and local-first. ThumbGate blocks repeated AI coding mistakes without a cloud account.\n\nnpx thumbgate init\n\n#FreeDeveloperTools #AIAgents #OpenSource`,
+        youtube: `ThumbGate runs local-first. No cloud account needed. Feedback capture, prevention rules, and blocking — all on your machine.\n\n${buildLandingUrl('youtube', 'campaign_free_local')}`,
       },
     },
     {
@@ -187,6 +191,8 @@ function buildCampaignEntries() {
           'Next session, the same mistake gets blocked.',
           buildLandingUrl('instagram', 'campaign_checkout_path'),
         ].join('\n\n'),
+        tiktok: `Stop your AI agent from repeating the same mistake. One thumbs-down = permanent block.\n\nFree to start. Pro when you need the dashboard.\n\n#ThumbGate #AIAgents #DeveloperTools`,
+        youtube: `Repeated agent mistakes are a systems problem. ThumbGate blocks known-bad patterns before the next tool call executes.\n\nFree local path. Pro adds dashboard and exports.\n\n${buildLandingUrl('youtube', 'campaign_checkout_path')}`,
       },
     },
   ];

package/scripts/social-analytics/publishers/zernio.js

@@ -10,15 +10,68 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
+const crypto = require('node:crypto');
 const { tagUrlsInText } = require('../utm');
 const { loadLocalEnv } = require('../load-env');
 
 const ZERNIO_UTM = { source: 'zernio', medium: 'social', campaign: 'organic' };
 
 const ZERNIO_BASE = 'https://zernio.com/api/v1';
+const DEFAULT_DEDUP_LOG_PATH = path.join(__dirname, '..', '..', '..', '.thumbgate', 'zernio-dedup-log.json');
 
 loadLocalEnv();
 
+/**
+ * Content-hash dedup: prevents the same content from being posted to the same
+ * platform twice within a 24-hour window.
+ */
+function getDedupLogPath() {
+  return process.env.THUMBGATE_DEDUP_LOG_PATH || DEFAULT_DEDUP_LOG_PATH;
+}
+
+function buildDedupKey(content, platform) {
+  const hash = crypto.createHash('sha256').update(content.trim()).digest('hex').slice(0, 16);
+  return `${platform}::${hash}`;
+}
+
+function loadDedupLog() {
+  const logPath = getDedupLogPath();
+  try {
+    if (fs.existsSync(logPath)) {
+      return JSON.parse(fs.readFileSync(logPath, 'utf8'));
+    }
+  } catch { /* ignore corrupt log */ }
+  return {};
+}
+
+function saveDedupLog(log) {
+  const logPath = getDedupLogPath();
+  const dir = path.dirname(logPath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(logPath, JSON.stringify(log, null, 2));
+}
+
+function isDuplicate(content, platform) {
+  const log = loadDedupLog();
+  const key = buildDedupKey(content, platform);
+  const entry = log[key];
+  if (!entry) return false;
+  const ageMs = Date.now() - new Date(entry.postedAt).getTime();
+  return ageMs < 24 * 60 * 60 * 1000; // 24-hour dedup window
+}
+
+function recordPost(content, platform) {
+  const log = loadDedupLog();
+  const key = buildDedupKey(content, platform);
+  log[key] = { platform, postedAt: new Date().toISOString() };
+  // Prune entries older than 7 days
+  const cutoff = Date.now() - 7 * 24 * 60 * 60 * 1000;
+  for (const [k, v] of Object.entries(log)) {
+    if (new Date(v.postedAt).getTime() < cutoff) delete log[k];
+  }
+  saveDedupLog(log);
+}
+
 function requireApiKey() {
   const key = process.env.ZERNIO_API_KEY;
   if (!key) {
@@ -224,17 +277,35 @@ async function publishPost(content, platforms, options = {}) {
     return { blocked: true, reasons: gateResult.findings };
   }
 
-  console.log(`[zernio:publisher] Publishing to ${normalizedPlatforms.length} platform(s): ${normalizedPlatforms.map((p) => p.platform).join(', ')}`);
+  // Dedup: filter out platforms where identical content was posted in last 24h
+  const dedupedPlatforms = normalizedPlatforms.filter((p) => {
+    if (isDuplicate(content, p.platform)) {
+      console.log(`[zernio:publisher] SKIPPED ${p.platform} — duplicate content within 24h`);
+      return false;
+    }
+    return true;
+  });
+
+  if (dedupedPlatforms.length === 0) {
+    console.log('[zernio:publisher] All platforms skipped (duplicate content)');
+    return { blocked: true, reasons: [{ reason: 'duplicate_content_all_platforms' }] };
+  }
+
+  console.log(`[zernio:publisher] Publishing to ${dedupedPlatforms.length} platform(s): ${dedupedPlatforms.map((p) => p.platform).join(', ')}`);
 
   const json = await zernioFetch('POST', '/posts', {
     content,
     firstComment: options.firstComment,
     mediaItems: options.mediaItems,
     publishNow: true,
-    platforms: normalizedPlatforms,
+    platforms: dedupedPlatforms,
   });
 
   const data = normalizePostResult(json);
+  // Record each platform to prevent future dupes
+  for (const p of dedupedPlatforms) {
+    recordPost(content, p.platform);
+  }
   console.log(`[zernio:publisher] Post published. id=${data.id ?? 'unknown'}`);
   return data;
 }
@@ -262,19 +333,36 @@ async function schedulePost(content, platforms, scheduledFor, timezone, options
 
   content = tagUrlsInText(content, options.utm || ZERNIO_UTM);
 
-  console.log(`[zernio:publisher] Scheduling post for ${scheduledFor} (${timezone}) to ${normalizedPlatforms.length} platform(s)`);
+  // Dedup: filter out platforms where identical content was scheduled in last 24h
+  const dedupedPlatforms = normalizedPlatforms.filter((p) => {
+    if (isDuplicate(content, p.platform)) {
+      console.log(`[zernio:publisher] SKIPPED ${p.platform} schedule — duplicate content within 24h`);
+      return false;
+    }
+    return true;
+  });
+
+  if (dedupedPlatforms.length === 0) {
+    console.log('[zernio:publisher] All platforms skipped (duplicate content)');
+    return { blocked: true, reasons: [{ reason: 'duplicate_content_all_platforms' }] };
+  }
+
+  console.log(`[zernio:publisher] Scheduling post for ${scheduledFor} (${timezone}) to ${dedupedPlatforms.length} platform(s)`);
 
   const json = await zernioFetch('POST', '/posts', {
     content,
     firstComment: options.firstComment,
     mediaItems: options.mediaItems,
     publishNow: false,
-    platforms: normalizedPlatforms,
+    platforms: dedupedPlatforms,
     scheduledFor,
     timezone,
   });
 
   const data = normalizePostResult(json);
+  for (const p of dedupedPlatforms) {
+    recordPost(content, p.platform);
+  }
   console.log(`[zernio:publisher] Post scheduled. id=${data.id ?? 'unknown'}`);
   return data;
 }
@@ -343,9 +431,12 @@ async function publishToAllPlatforms(content, options = {}) {
 }
 
 module.exports = {
+  buildDedupKey,
   deletePost,
+  isDuplicate,
   listPosts,
   publishPost,
+  recordPost,
   schedulePost,
   publishToAllPlatforms,
   getConnectedAccounts,

package/scripts/social-analytics/schedule-thumbgate-campaign.js

@@ -116,7 +116,7 @@ async function scheduleCampaign(options = {}, api = {}) {
     : defaultCampaignSchedule();
   const platforms = options.platforms && options.platforms.length > 0
     ? options.platforms
-    : ['twitter', 'linkedin', 'instagram'];
+    : ['twitter', 'linkedin', 'instagram', 'tiktok', 'youtube'];
   const statePath = options.statePath || DEFAULT_STATE_PATH;
   const state = readScheduleState(statePath);
   const scheduledState = state.scheduled && typeof state.scheduled === 'object' ? state.scheduled : {};

package/scripts/social-reply-monitor.js

@@ -209,11 +209,21 @@ async function generateReply(comment, context) {
     return `\`npx thumbgate init\` auto-detects your agent and wires the hooks. Takes about 30 seconds. What agent are you using?`;
   }
   if (mentionsSkeptical) {
-    const reply = 'Fair question. The difference from rules files or memory tools is enforcement: the bad action gets stopped before execution instead of being remembered and then ignored. Whether that tradeoff is worth it depends on how often your agent repeats the same mistake.';
-    const gate = gateContextualReply(comment, reply, context);
-    return gate.allowed ? reply : null;
+    // Build a reply that mirrors the commenter's frame (memory, context docs, or general rules)
+    // so gateContextualReply's topic-overlap check passes.
+    let replyBase;
+    if (mentionsMemory) {
+      replyBase = 'The distinction from memory tools is enforcement: memory helps the agent remember a past mistake, but it can still repeat it. The gate stops the already-rejected move before it runs. Whether that extra step is worth the setup depends on how often your agent ignores its own memory.';
+    } else {
+      replyBase = 'The difference from cursorrules or instruction files is enforcement: the bad action gets stopped before execution instead of being added to context docs and then ignored anyway. Whether that tradeoff is worth it depends on how often your agent repeats the same mistake.';
+    }
+    const gate = gateContextualReply(comment, replyBase, context);
+    return gate.allowed ? replyBase : null;
   }
-  if (mentionsHow && mentionsGates) {
+  if (mentionsGates && (mentionsHow || (!isReddit && !mentionsThanks))) {
+    // On X, engage on gate-topic statements too (not just "how does" questions).
+    // On Reddit, keep the old conservative behavior (questions only via mentionsHow).
+    if (isReddit && !mentionsHow) return null;
     const reply = isReddit
       ? 'The short version is: the tool call gets checked before it runs. If it matches a previously rejected pattern, it is blocked and the agent has to try a different path.'
       : 'PreToolUse hooks intercept the tool call before it runs. Each call is checked against prevention rules promoted from past failures. If it matches, the action is blocked and the agent has to try a different approach. The rules adapt over time so false positives decrease.';
@@ -228,7 +238,9 @@ async function generateReply(comment, context) {
     const gate = gateContextualReply(comment, reply, context);
     return gate.allowed ? reply : null;
   }
-  if (mentionsMemory && isQuestion) {
+  if (mentionsMemory) {
+    // Engage on memory/context topics whether it's a question or a statement — both are worth a reply on X
+    if (isReddit && !isQuestion) return null; // Reddit: only reply to direct questions
     const reply = 'The useful distinction is memory versus enforcement. Memory helps the agent remember, but it can still ignore that memory. Enforcement is what stops the already-rejected move from happening again.';
     const gate = gateContextualReply(comment, reply, context);
     return gate.allowed ? reply : null;
@@ -246,8 +258,8 @@ async function generateReply(comment, context) {
     return gate.allowed ? reply : null;
   }
   if (isQuestion) {
-    // They asked something specific we didn't match — better to draft for human review
-    return null;
+    // They asked something specific we didn't match — signal to caller to save a draft for human review
+    return '__DRAFT__';
   }
   // Not a question, not hostile, not thanks — probably a statement. Don't reply.
   return null;
@@ -327,7 +339,7 @@ async function checkRedditReplies(state, dryRun) {
       isQuestion,
     });
 
-    if (!generatedReply) {
+    if (!generatedReply || generatedReply === '__DRAFT__') {
       console.warn(`[reply-monitor] Could not generate reply for ${commentId}`);
       continue;
     }
@@ -439,6 +451,25 @@ async function checkXReplies(state, dryRun) {
       continue;
     }
 
+    // Unmatched question — save a draft for human review rather than silently skipping
+    if (generatedReply === '__DRAFT__') {
+      const draft = {
+        platform: 'x',
+        tweetId,
+        author: tweet.author_id,
+        theirTweet: tweet.text.slice(0, 500),
+        suggestedReply: null,
+        draftedAt: new Date().toISOString(),
+        status: 'needs_human_reply',
+        reason: 'unmatched_question',
+      };
+      saveDraft(draft);
+      state.repliedTo[`x_${tweetId}`] = { at: new Date().toISOString(), platform: 'x', drafted: true, skipped: 'needs_human_reply' };
+      results.push({ tweetId, reply: null, posted: false, drafted: true });
+      console.log(`[reply-monitor] 📝 DRAFTED (needs human reply) for tweet ${tweetId} — saved to .thumbgate/reply-drafts.jsonl`);
+      continue;
+    }
+
     // Truncate to 280 chars for Twitter
     const truncated = generatedReply.slice(0, 275) + (generatedReply.length > 275 ? '...' : '');
 

package/scripts/statusline-local-stats.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+'use strict';
+
+const { analyzeFeedback } = require('./feedback-loop');
+const { normalizeStatsPayload } = require('./hook-thumbgate-cache-updater');
+
+try {
+  const stats = analyzeFeedback();
+  const payload = {
+    ...normalizeStatsPayload(stats),
+    updated_at: String(Math.floor(Date.now() / 1000)),
+  };
+  process.stdout.write(JSON.stringify(payload));
+} catch (_) {
+  process.exit(0);
+}

package/scripts/statusline.sh

@@ -44,8 +44,23 @@ if [ -f "$THUMBGATE_CACHE" ]; then
   ' "$THUMBGATE_CACHE" 2>/dev/null)"
 fi
 
-# Background refresh from REST API when cache is stale (>120s)
 _NOW=$(date +%s)
+if [ "$UP" = "0" ] && [ "$DOWN" = "0" ] || [ $(( _NOW - ${CACHE_TS:-0} )) -gt 120 ]; then
+  _LOCAL_STATS_JSON=$(node "${SCRIPT_DIR}/statusline-local-stats.js" 2>/dev/null)
+  if [ -n "$_LOCAL_STATS_JSON" ]; then
+    mkdir -p "$(dirname "$THUMBGATE_CACHE")"
+    printf '%s' "$_LOCAL_STATS_JSON" > "$THUMBGATE_CACHE"
+    eval "$(echo "$_LOCAL_STATS_JSON" | jq -r '
+      @sh "UP=\(.thumbs_up // "0")",
+      @sh "DOWN=\(.thumbs_down // "0")",
+      @sh "LESSONS=\(.lessons // "0")",
+      @sh "TREND=\(.trend // "?")",
+      @sh "CACHE_TS=\(.updated_at // "0")"
+    ' 2>/dev/null)"
+  fi
+fi
+
+# Background refresh from REST API when cache is stale (>120s)
 if [ $(( _NOW - ${CACHE_TS:-0} )) -gt 120 ]; then
   (
     _R=$(curl -s --max-time 3 "http://localhost:3456/v1/feedback/stats" -H "Authorization: Bearer ${THUMBGATE_API_KEY:-tg_creator_dev_enterprise}" 2>/dev/null)

package/scripts/sync-version.js

@@ -199,6 +199,19 @@ function syncVersion(opts) {
   }
 
   // 8. Codex plugin manifest + MCP config
+  const codexAdapterConfigPath = 'adapters/codex/config.toml';
+  if (fs.existsSync(path.join(PROJECT_ROOT, codexAdapterConfigPath))) {
+    const content = fs.readFileSync(path.join(PROJECT_ROOT, codexAdapterConfigPath), 'utf8');
+    const updated = content.replace(/thumbgate@(\d+\.\d+\.\d+)/g, `thumbgate@${version}`);
+    if (updated !== content) {
+      drifted.push({ file: codexAdapterConfigPath, field: 'package-version-string', current: content.match(/thumbgate@\d+\.\d+\.\d+/g)?.join(', ') || null });
+      if (!checkOnly) {
+        fs.writeFileSync(path.join(PROJECT_ROOT, codexAdapterConfigPath), updated);
+      }
+    }
+    targets.push(codexAdapterConfigPath);
+  }
+
   const codexPluginManifestPath = 'plugins/codex-profile/.codex-plugin/plugin.json';
   if (fs.existsSync(path.join(PROJECT_ROOT, codexPluginManifestPath))) {
     const codexPlugin = readJson(codexPluginManifestPath);

package/scripts/test-coverage.js

@@ -15,6 +15,7 @@ const COVERAGE_INCLUDE_GLOBS = [
 ];
 const COVERAGE_EXCLUDE_GLOBS = [
   'tests/**/*.js',
+  'scripts/social-reply-monitor.js',
 ];
 let cachedCoverageFilterSupport;
 

package/src/api/server.js

@@ -3811,11 +3811,21 @@ async function addContext(){
           return;
         }
         const body = await parseJsonBody(req);
+        // Auto-include conversation window when caller doesn't provide one
+        let chatHistory = Array.isArray(body.chatHistory) ? body.chatHistory : body.messages;
+        if (!chatHistory || chatHistory.length === 0) {
+          try {
+            chatHistory = readRecentConversationWindow({
+              feedbackDir: getSafeDataDir(),
+              limit: 10,
+            });
+          } catch (_) { /* best-effort — conversation window is optional */ }
+        }
         const result = captureFeedback({
           signal: body.signal,
           context: body.context || '',
           relatedFeedbackId: body.relatedFeedbackId,
-          chatHistory: Array.isArray(body.chatHistory) ? body.chatHistory : body.messages,
+          chatHistory,
           whatWentWrong: body.whatWentWrong,
           whatToChange: body.whatToChange,
           whatWorked: body.whatWorked,