thumbgate 0.9.12 → 0.9.14

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "plugins": [
     {
       "name": "thumbgate",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "Pre-action gates that block AI coding agents from repeating known mistakes. Captures feedback, auto-promotes failures into prevention rules, and enforces them via PreToolUse hooks.",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "author": {
     "name": "Igor Ganapolsky"
   },

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://github.com/IgorGanapolsky/thumbgate",
   "transport": "stdio",

package/README.md

@@ -7,7 +7,9 @@ Make your AI coding agent self-improving. One thumbs-down creates a gate that pe
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 [![Try Free](https://img.shields.io/badge/Pro-Try%20Free%20→-635bff?style=for-the-badge&logo=stripe&logoColor=white)](https://thumbgate-production.up.railway.app/checkout/pro?utm_source=github&utm_medium=readme&utm_campaign=badge_cta)
 
-**[Pro Page](https://thumbgate-production.up.railway.app/pro?utm_source=github&utm_medium=readme&utm_campaign=pro_page)** · **[Live Dashboard](https://thumbgate-production.up.railway.app/dashboard?utm_source=github&utm_medium=readme&utm_campaign=top_cta)** · **[Pricing](https://thumbgate-production.up.railway.app/#pricing?utm_source=github&utm_medium=readme&utm_campaign=top_cta)** · **[Setup Guide](https://thumbgate-production.up.railway.app/guide?utm_source=github&utm_medium=readme&utm_campaign=top_cta)**
+**[Pro Page](https://thumbgate-production.up.railway.app/pro?utm_source=github&utm_medium=readme&utm_campaign=pro_page)** · **[Live Dashboard](https://thumbgate-production.up.railway.app/dashboard?utm_source=github&utm_medium=readme&utm_campaign=top_cta)** · **[Pricing](https://thumbgate-production.up.railway.app/?utm_source=github&utm_medium=readme&utm_campaign=top_cta#pricing)** · **[Setup Guide](https://thumbgate-production.up.railway.app/guide?utm_source=github&utm_medium=readme&utm_campaign=top_cta)**
+
+**Popular buyer questions:** **[How to stop repeated AI agent mistakes](https://thumbgate-production.up.railway.app/guides/stop-repeated-ai-agent-mistakes?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Cursor guardrails](https://thumbgate-production.up.railway.app/guides/cursor-agent-guardrails?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Codex CLI guardrails](https://thumbgate-production.up.railway.app/guides/codex-cli-guardrails?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Gemini CLI memory + enforcement](https://thumbgate-production.up.railway.app/guides/gemini-cli-feedback-memory?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)**
 
 ### Get Started
 
@@ -15,7 +17,7 @@ Make your AI coding agent self-improving. One thumbs-down creates a gate that pe
 
 [![Sign up for ThumbGate Pro](https://img.shields.io/badge/>>%20Start%20Free%20→%20ThumbGate%20Pro-635bff?style=for-the-badge)](https://thumbgate-production.up.railway.app/checkout/pro?utm_source=github&utm_medium=readme&utm_campaign=get_started)
 
-Free for individual developers. Pro adds team dashboards, DPO export, and unlimited lesson search. [See pricing →](https://thumbgate-production.up.railway.app/#pricing?utm_source=github&utm_medium=readme&utm_campaign=pricing_link)
+Free for individual developers. Pro adds team dashboards, DPO export, and unlimited lesson search. [See pricing →](https://thumbgate-production.up.railway.app/?utm_source=github&utm_medium=readme&utm_campaign=pricing_link#pricing)
 
 **Paid path for individual operators:** [ThumbGate Pro](https://thumbgate-production.up.railway.app/pro?utm_source=github&utm_medium=readme&utm_campaign=pro_page) is the buyer-ready page for the personal local dashboard, DPO export, and review-ready evidence. It makes the paid upgrade legible before checkout while the self-hosted path below stays optimized for open source evaluation.
 
@@ -142,7 +144,7 @@ Free includes unlimited feedback captures, 5 daily lesson searches, unlimited re
 
 It does not update model weights. It's context engineering — enforcement that gets smarter every session.
 
-**[Get Pro](https://thumbgate-production.up.railway.app/checkout/pro?utm_source=github&utm_medium=readme&utm_campaign=thumbgate)** | **[Start Team Rollout](https://thumbgate-production.up.railway.app/#workflow-sprint-intake?utm_source=github&utm_medium=readme&utm_campaign=team_rollout)** | **[Live Dashboard](https://thumbgate-production.up.railway.app/dashboard?utm_source=github&utm_medium=readme&utm_campaign=thumbgate)**
+**[Get Pro](https://thumbgate-production.up.railway.app/checkout/pro?utm_source=github&utm_medium=readme&utm_campaign=thumbgate)** | **[Start Team Rollout](https://thumbgate-production.up.railway.app/?utm_source=github&utm_medium=readme&utm_campaign=team_rollout#workflow-sprint-intake)** | **[Live Dashboard](https://thumbgate-production.up.railway.app/dashboard?utm_source=github&utm_medium=readme&utm_campaign=thumbgate)**
 
 ## Tech Stack
 

package/adapters/README.md

@@ -3,7 +3,7 @@
 - `chatgpt/openapi.yaml`: import into GPT Actions.
 - `gemini/function-declarations.json`: Gemini function-calling definitions.
 - `mcp/server-stdio.js`: underlying local MCP stdio server implementation.
-- `claude/.mcp.json`: example Claude Code MCP config using `npx --yes --package thumbgate@0.9.12 thumbgate serve`.
+- `claude/.mcp.json`: example Claude Code MCP config using `npx --yes --package thumbgate@0.9.14 thumbgate serve`.
 - `codex/config.toml`: example Codex MCP profile section using the same version-pinned portable launcher.
 - `amp/skills/thumbgate-feedback/SKILL.md`: Amp skill template.
 - `opencode/opencode.json`: portable OpenCode MCP profile using the same version-pinned portable launcher.

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@0.9.12", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@0.9.14", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@0.9.12", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@0.9.14", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/codex/config.toml

@@ -1,9 +1,9 @@
 # Codex MCP profile (copy into ~/.codex/config.toml or merge section)
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.12", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@0.9.14", "thumbgate", "serve"]
 
 # Hard PreToolUse hook for Codex
 [hooks.pre_tool_use]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.12", "thumbgate", "gate-check"]
+args = ["--yes", "--package", "thumbgate@0.9.14", "thumbgate", "gate-check"]

package/adapters/mcp/server-stdio.js

@@ -111,7 +111,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '0.9.12' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '0.9.14' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@0.9.12",
+        "thumbgate@0.9.14",
         "thumbgate",
         "serve"
       ],

package/bin/cli.js

@@ -63,6 +63,37 @@ function appendLocalTelemetry(payload) {
   } catch (_) { /* telemetry is best-effort */ }
 }
 
+function syncActiveProjectContext(options = {}) {
+  try {
+    // Tests and explicitly scoped CLI calls may pin a feedback root directly.
+    // In that case, do not inject a project selection that would cause later
+    // reads/writes to escape the requested directory.
+    if (
+      !options.force &&
+      process.env.THUMBGATE_FEEDBACK_DIR &&
+      !process.env.THUMBGATE_PROJECT_DIR &&
+      !process.env.CLAUDE_PROJECT_DIR
+    ) {
+      return null;
+    }
+    const {
+      resolveProjectDir,
+      writeActiveProjectState,
+    } = require(path.join(PKG_ROOT, 'scripts', 'feedback-paths'));
+    const projectDir = resolveProjectDir({
+      cwd: CWD,
+      env: process.env,
+      includeStored: options.includeStored !== false,
+    });
+    if (!projectDir) return null;
+    process.env.THUMBGATE_PROJECT_DIR = projectDir;
+    writeActiveProjectState(projectDir, { env: process.env });
+    return projectDir;
+  } catch (_) {
+    return null;
+  }
+}
+
 function telemetryPing(installId) {
   if (process.env.THUMBGATE_NO_TELEMETRY === '1') return;
   const payloadObject = {
@@ -1178,12 +1209,14 @@ async function gateCheck() {
 }
 
 function cacheUpdate() {
+  syncActiveProjectContext();
   const payload = readStdinText();
   const { updateCacheFromEvent } = require(path.join(PKG_ROOT, 'scripts', 'hook-thumbgate-cache-updater'));
   updateCacheFromEvent(payload ? JSON.parse(payload) : {});
 }
 
 function statuslineRender() {
+  syncActiveProjectContext();
   const payload = readStdinText();
   const output = execFileSync('bash', [path.join(PKG_ROOT, 'scripts', 'statusline.sh')], {
     encoding: 'utf8',
@@ -1194,6 +1227,7 @@ function statuslineRender() {
 }
 
 function hookAutoCapture() {
+  syncActiveProjectContext();
   const prompt = process.env.CLAUDE_USER_PROMPT || process.env.THUMBGATE_USER_PROMPT || readStdinText().trim();
   const { evaluatePromptGuard } = require(path.join(PKG_ROOT, 'scripts', 'prompt-guard'));
   const { processInlineFeedback, formatCliOutput } = require(path.join(PKG_ROOT, 'scripts', 'cli-feedback'));
@@ -1233,6 +1267,7 @@ function hookAutoCapture() {
 }
 
 function sessionStart() {
+  syncActiveProjectContext();
   const { analyzeFeedback } = require(path.join(PKG_ROOT, 'scripts', 'feedback-loop'));
   const { refreshStatuslineCache } = require(path.join(PKG_ROOT, 'scripts', 'hook-thumbgate-cache-updater'));
   refreshStatuslineCache(analyzeFeedback());

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
-  "version": "0.9.12",
-  "description": "ThumbGate \u2014 Make your AI coding agent self-improving. Every mistake becomes a prevention rule that physically blocks the agent from repeating it. Feedback-driven enforcement via PreToolUse hooks, Thompson Sampling for adaptive gates, SQLite+FTS5 lesson DB, and LanceDB vector search. Your agent gets smarter with every session.",
+  "version": "0.9.14",
+  "description": "ThumbGate — Make your AI coding agent self-improving. Every mistake becomes a prevention rule that physically blocks the agent from repeating it. Feedback-driven enforcement via PreToolUse hooks, Thompson Sampling for adaptive gates, SQLite+FTS5 lesson DB, and LanceDB vector search. Your agent gets smarter with every session.",
   "homepage": "https://thumbgate-production.up.railway.app",
   "repository": {
     "type": "git",

package/plugins/claude-codex-bridge/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-bridge",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "Run Codex review, adversarial review, and second-pass handoffs from Claude Code while keeping ThumbGate reliability memory in the loop.",
   "author": {
     "name": "Igor Ganapolsky",

package/plugins/claude-codex-bridge/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "--yes",
         "--package",
-        "thumbgate@0.9.12",
+        "thumbgate@0.9.14",
         "thumbgate",
         "serve"
       ]

package/plugins/codex-profile/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-profile",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "description": "ThumbGate for Codex: pre-action gates, skill packs, hallucination detection, PII scanning, progressive disclosure (82% token savings), and MCP-backed reliability memory.",
   "author": {
     "name": "Igor Ganapolsky",

package/plugins/codex-profile/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "--yes",
         "--package",
-        "thumbgate@0.9.12",
+        "thumbgate@0.9.14",
         "thumbgate",
         "serve"
       ]

package/plugins/codex-profile/INSTALL.md

@@ -31,7 +31,7 @@ The following block is appended to `~/.codex/config.toml`:
 ```toml
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.12", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@0.9.14", "thumbgate", "serve"]
 ```
 
 The repo-local Codex app plugin ships the same runtime path through `plugins/codex-profile/.mcp.json`, so the manual config and plugin metadata stay aligned.

package/plugins/codex-profile/README.md

@@ -29,7 +29,7 @@ That profile launches:
 ```toml
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.12", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@0.9.14", "thumbgate", "serve"]
 ```
 
 ## Why this exists

package/plugins/cursor-marketplace/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "thumbgate",
   "displayName": "ThumbGate",
   "description": "👍👎 Thumbs down a mistake — your AI agent won't repeat it. Thumbs up good work — it remembers the pattern.",
-  "version": "0.9.12",
+  "version": "0.9.14",
   "author": {
     "name": "Igor Ganapolsky"
   },

package/plugins/opencode-profile/INSTALL.md

@@ -25,7 +25,7 @@ The portable profile adds this MCP server entry:
   "mcp": {
     "thumbgate": {
       "type": "local",
-      "command": ["npx", "--yes", "--package", "thumbgate@0.9.12", "thumbgate", "serve"],
+      "command": ["npx", "--yes", "--package", "thumbgate@0.9.14", "thumbgate", "serve"],
       "enabled": true
     }
   }

package/public/index.html

@@ -520,8 +520,8 @@ __GA_BOOTSTRAP__
 
 <section class="seo-pages" id="compare-guides">
   <div class="container">
-    <div class="section-label">Learn More</div>
-    <h2 class="section-title">How ThumbGate compares and when to use it</h2>
+    <div class="section-label">Popular Buyer Questions</div>
+    <h2 class="section-title">How buyers discover ThumbGate in search and AI answers</h2>
     <div class="seo-grid">
       <a class="seo-card" href="/compare/speclock">
         <div class="seo-kicker">Comparison</div>
@@ -547,6 +547,30 @@ __GA_BOOTSTRAP__
         <p>Why structured feedback memory matters more when it becomes a live gate that blocks your agent from repeating mistakes.</p>
         <div class="card-arrow">Read the integration guide →</div>
       </a>
+      <a class="seo-card" href="/guides/stop-repeated-ai-agent-mistakes">
+        <div class="seo-kicker">Problem Guide</div>
+        <h3>How to Stop AI Agents From Repeating Mistakes</h3>
+        <p>The shortest path from “I already corrected this once” to a pre-action gate that blocks the repeat before the next tool call lands.</p>
+        <div class="card-arrow">See the fix →</div>
+      </a>
+      <a class="seo-card" href="/guides/cursor-agent-guardrails">
+        <div class="seo-kicker">Cursor</div>
+        <h3>Cursor Guardrails That Block Repeat Failures</h3>
+        <p>Why Cursor users need more than prompts when the same risky refactor, shell step, or git action keeps coming back.</p>
+        <div class="card-arrow">Read the Cursor guide →</div>
+      </a>
+      <a class="seo-card" href="/guides/codex-cli-guardrails">
+        <div class="seo-kicker">Codex</div>
+        <h3>Codex CLI Guardrails That Actually Enforce</h3>
+        <p>Turn operator feedback into searchable lessons, linked prevention rules, and a runtime stop before Codex repeats the mistake.</p>
+        <div class="card-arrow">Read the Codex guide →</div>
+      </a>
+      <a class="seo-card" href="/guides/gemini-cli-feedback-memory">
+        <div class="seo-kicker">Gemini</div>
+        <h3>Gemini CLI Memory That Leads to Enforcement</h3>
+        <p>Why Gemini CLI buyers start with memory and convert when they see how memory becomes real pre-action gates.</p>
+        <div class="card-arrow">Read the Gemini guide →</div>
+      </a>
     </div>
   </div>
 </section>
@@ -554,7 +578,7 @@ __GA_BOOTSTRAP__
 <!-- HOW IT WORKS -->
 <section class="how-it-works" id="how-it-works">
   <div class="container">
-    <div class="section-label">New in v0.9.12</div>
+    <div class="section-label">New in v0.9.14</div>
     <h2 class="section-title">Three steps to stop repeated AI failures</h2>
     <div class="steps">
       <div class="step">

package/public/learn.html

@@ -57,6 +57,30 @@
         "position": 5,
         "url": "https://thumbgate-production.up.railway.app/learn/ai-agent-persistent-memory",
         "name": "How to Give Your AI Coding Agent Persistent Memory Across Sessions"
+      },
+      {
+        "@type": "ListItem",
+        "position": 6,
+        "url": "https://thumbgate-production.up.railway.app/guides/stop-repeated-ai-agent-mistakes",
+        "name": "How to Stop AI Coding Agents From Repeating Mistakes"
+      },
+      {
+        "@type": "ListItem",
+        "position": 7,
+        "url": "https://thumbgate-production.up.railway.app/guides/cursor-agent-guardrails",
+        "name": "Cursor Guardrails That Block Repeated Mistakes"
+      },
+      {
+        "@type": "ListItem",
+        "position": 8,
+        "url": "https://thumbgate-production.up.railway.app/guides/codex-cli-guardrails",
+        "name": "Codex CLI Guardrails That Actually Enforce"
+      },
+      {
+        "@type": "ListItem",
+        "position": 9,
+        "url": "https://thumbgate-production.up.railway.app/guides/gemini-cli-feedback-memory",
+        "name": "Gemini CLI Feedback Memory That Leads to Enforcement"
       }
     ]
   }
@@ -86,6 +110,7 @@
   h2 { font-size: 1.5rem; margin: 2.5rem 0 1rem; color: var(--cyan); }
   p { color: var(--text); margin-bottom: 0.75rem; }
   .hero-sub { color: var(--muted); font-size: 1.1rem; max-width: 600px; margin-bottom: 2rem; }
+  .section-intro { color: var(--muted); margin-bottom: 1rem; }
 
   .article-grid { display: grid; grid-template-columns: 1fr; gap: 24px; margin-top: 2rem; }
   .article-card {
@@ -202,6 +227,42 @@
     </a>
   </div>
 
+  <h2>Popular buyer questions</h2>
+  <p class="section-intro">These are the high-intent guides for buyers who already know the pain and want to understand where ThumbGate fits fast.</p>
+  <div class="article-grid">
+    <a href="/guides/stop-repeated-ai-agent-mistakes" class="article-card">
+      <h3>How to Stop AI Coding Agents From Repeating Mistakes</h3>
+      <p>The fastest explanation of why memory alone is not enough when your agent keeps making the same bad move twice.</p>
+      <span class="article-tag">Repeat Failures</span>
+      <span class="article-tag">Guardrails</span>
+      <span class="article-tag">Buyer Guide</span>
+    </a>
+
+    <a href="/guides/cursor-agent-guardrails" class="article-card">
+      <h3>Cursor Guardrails That Block Repeated Mistakes</h3>
+      <p>For Cursor users who need to keep speed while adding a runtime enforcement layer that does more than prompt politely.</p>
+      <span class="article-tag">Cursor</span>
+      <span class="article-tag">Guardrails</span>
+      <span class="article-tag">Integration</span>
+    </a>
+
+    <a href="/guides/codex-cli-guardrails" class="article-card">
+      <h3>Codex CLI Guardrails That Actually Enforce</h3>
+      <p>Why operators looking for Codex CLI guardrails are really looking for a feedback-to-enforcement loop they can trust.</p>
+      <span class="article-tag">Codex</span>
+      <span class="article-tag">CLI</span>
+      <span class="article-tag">Reliability</span>
+    </a>
+
+    <a href="/guides/gemini-cli-feedback-memory" class="article-card">
+      <h3>Gemini CLI Feedback Memory That Leads to Enforcement</h3>
+      <p>A memory-first buyer path for Gemini CLI users who will eventually care about gates, proof, and operational control.</p>
+      <span class="article-tag">Gemini</span>
+      <span class="article-tag">Memory</span>
+      <span class="article-tag">Enforcement</span>
+    </a>
+  </div>
+
   <div class="cta-section">
     <h2 style="color:var(--text);font-size:1.3rem;margin:0 0 8px;">Ready to try it?</h2>
     <p>One command. Works with Claude Code, Cursor, Codex, Gemini, Amp, and any MCP agent.</p>

package/scripts/feedback-history-distiller.js

@@ -79,7 +79,13 @@ function readJsonlTail(filePath, limit = DEFAULT_HISTORY_LIMIT) {
 }
 
 function resolveFeedbackDir(feedbackDir) {
-  return resolveSharedFeedbackDir({ feedbackDir });
+  if (feedbackDir) {
+    return resolveSharedFeedbackDir({ feedbackDir });
+  }
+  const env = { ...process.env };
+  delete env.INIT_CWD;
+  delete env.PWD;
+  return resolveSharedFeedbackDir({ env });
 }
 
 function getConversationPaths(feedbackDir) {

package/scripts/feedback-loop.js

@@ -146,8 +146,8 @@ function updateStatuslineWithLesson({ accepted, signal, memoryId, feedbackId, le
   } catch { /* statusline update is best-effort */ }
 }
 
-function getFeedbackPaths() {
-  return resolveFeedbackPaths();
+function getFeedbackPaths(options = {}) {
+  return resolveFeedbackPaths(options);
 }
 
 function getContextFsModule() {
@@ -1673,8 +1673,8 @@ function writePreventionRules(filePath, minOccurrences = 2) {
   return { path: outPath, markdown };
 }
 
-function feedbackSummary(recentN = 20) {
-  const { FEEDBACK_LOG_PATH } = getFeedbackPaths();
+function feedbackSummary(recentN = 20, options = {}) {
+  const { FEEDBACK_LOG_PATH } = getFeedbackPaths(options);
   const entries = readJSONL(FEEDBACK_LOG_PATH);
   if (entries.length === 0) {
     return '## Feedback Summary\nNo feedback recorded yet.';
@@ -1794,6 +1794,10 @@ function runTests() {
   const tmpDir = fs.mkdtempSync(path.join(require('os').tmpdir(), 'thumbgate-loop-test-'));
   const localFeedbackLog = path.join(tmpDir, 'feedback-log.jsonl');
   process.env.THUMBGATE_FEEDBACK_DIR = tmpDir;
+  const savedInitCwd = process.env.INIT_CWD;
+  process.env.INIT_CWD = savedInitCwd || process.cwd();
+
+  assert(getFeedbackPaths().FEEDBACK_DIR === tmpDir, 'explicit feedback dir wins over npm INIT_CWD');
 
   appendJSONL(localFeedbackLog, { signal: 'positive', tags: ['testing'], skill: 'verify' });
   appendJSONL(localFeedbackLog, { signal: 'negative', tags: ['testing'], skill: 'verify' });
@@ -1845,6 +1849,8 @@ function runTests() {
 
   fs.rmSync(tmpDir, { recursive: true, force: true });
   delete process.env.THUMBGATE_FEEDBACK_DIR;
+  if (savedInitCwd === undefined) delete process.env.INIT_CWD;
+  else process.env.INIT_CWD = savedInitCwd;
   console.log(`\nResults: ${passed} passed, ${failed} failed\n`);
   process.exit(failed > 0 ? 1 : 0);
 }