thumbgate 0.9.14 → 1.0.0

package/plugins/codex-profile/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-profile",
-  "version": "0.9.14",
+  "version": "1.0.0",
   "description": "ThumbGate for Codex: pre-action gates, skill packs, hallucination detection, PII scanning, progressive disclosure (82% token savings), and MCP-backed reliability memory.",
   "author": {
     "name": "Igor Ganapolsky",

package/plugins/codex-profile/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "--yes",
         "--package",
-        "thumbgate@0.9.14",
+        "thumbgate@1.0.0",
         "thumbgate",
         "serve"
       ]

package/plugins/codex-profile/INSTALL.md

@@ -31,7 +31,7 @@ The following block is appended to `~/.codex/config.toml`:
 ```toml
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.14", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@1.0.0", "thumbgate", "serve"]
 ```
 
 The repo-local Codex app plugin ships the same runtime path through `plugins/codex-profile/.mcp.json`, so the manual config and plugin metadata stay aligned.

package/plugins/codex-profile/README.md

@@ -29,7 +29,7 @@ That profile launches:
 ```toml
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@0.9.14", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@1.0.0", "thumbgate", "serve"]
 ```
 
 ## Why this exists

package/plugins/cursor-marketplace/.cursor-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "thumbgate",
   "displayName": "ThumbGate",
   "description": "👍👎 Thumbs down a mistake — your AI agent won't repeat it. Thumbs up good work — it remembers the pattern.",
-  "version": "0.9.14",
+  "version": "1.0.0",
   "author": {
     "name": "Igor Ganapolsky"
   },

package/plugins/opencode-profile/INSTALL.md

@@ -25,7 +25,7 @@ The portable profile adds this MCP server entry:
   "mcp": {
     "thumbgate": {
       "type": "local",
-      "command": ["npx", "--yes", "--package", "thumbgate@0.9.14", "thumbgate", "serve"],
+      "command": ["npx", "--yes", "--package", "thumbgate@1.0.0", "thumbgate", "serve"],
       "enabled": true
     }
   }

package/public/blog.html

@@ -4,6 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>ThumbGate Blog — Agent Governance Engineering</title>
+    <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
     <meta
       name="description"
       content="Technical breakdowns, release notes, and agent governance insights from the ThumbGate team."

package/public/dashboard.html

@@ -8,7 +8,7 @@
 <link rel="canonical" href="https://thumbgate-production.up.railway.app/dashboard">
 <meta name="robots" content="noindex">
 <!-- Privacy-friendly analytics by Plausible -->
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <style>
   *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
   :root {

package/public/guide.html

@@ -5,7 +5,7 @@
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>How to Stop AI Coding Agents From Repeating Mistakes — ThumbGate Guide</title>
 <!-- Privacy-friendly analytics by Plausible -->
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <meta name="description" content="The complete guide to preventing AI coding agent mistakes with pre-action gates, history-aware lesson distillation, and automatic prevention rules.">
 <meta name="keywords" content="AI agent mistakes, Claude Code force push, AI coding agent memory, MCP server guardrails, pre-action gates, vibe coding safety, PreToolUse hooks, ThumbGate, SpecLock alternative, Mem0 alternative">
 <meta property="og:title" content="How to Stop AI Coding Agents From Repeating Mistakes">

package/public/index.html

@@ -27,7 +27,7 @@ __GOOGLE_SITE_VERIFICATION_META__
 <meta name="keywords" content="ThumbGate, thumbgate, self-improving AI agents, AI agent self-improvement, AI agent learning, AI agent memory, pre-action gates, human-in-the-loop, MCP server, Claude Code, Cursor, Codex, Gemini, Amp, OpenCode, vibe coding safety, SpecLock alternative, Mem0 alternative, AI coding agent feedback loop, PreToolUse hooks, prevention rules, feedback enforcement, context engineering">
 
 <!-- Privacy-friendly analytics by Plausible -->
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 __GA_BOOTSTRAP__
 
 <script>
@@ -578,7 +578,7 @@ __GA_BOOTSTRAP__
 <!-- HOW IT WORKS -->
 <section class="how-it-works" id="how-it-works">
   <div class="container">
-    <div class="section-label">New in v0.9.14</div>
+    <div class="section-label">New in v1.0.0</div>
     <h2 class="section-title">Three steps to stop repeated AI failures</h2>
     <div class="steps">
       <div class="step">
@@ -835,7 +835,7 @@ __GA_BOOTSTRAP__
       <a href="https://www.linkedin.com/in/igorganapolsky" target="_blank" rel="noopener">LinkedIn</a>
       <a href="/blog">Blog</a>
     </div>
-    <span class="footer-copy">© 2026 Max Smith KDP LLC · MIT License · v0.9.10</span>
+    <span class="footer-copy">© 2026 Max Smith KDP LLC · MIT License · v1.0.0</span>
   </div>
 </footer>
 

package/public/learn/agent-harness-pattern.html

@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>The Agent Harness Pattern: Why Your AI Needs a Seatbelt — ThumbGate</title>
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <meta name="description" content="Tsinghua researchers formalized agent harnesses as first-class objects with contracts, verification gates, and durable state. ThumbGate implements this pattern today.">
 <meta name="keywords" content="agent harness pattern, natural language agent harness, NLAH, AI agent safety, pre-action gates, verification gates, agent contracts, ThumbGate, MCP hooks">
 <meta property="og:title" content="The Agent Harness Pattern: Why Your AI Needs a Seatbelt">

package/public/learn/ai-agent-persistent-memory.html

@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>How to Give Your AI Coding Agent Persistent Memory Across Sessions — ThumbGate</title>
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <meta name="description" content="AI coding agents forget everything when a session ends. Learn how to give Claude Code, Cursor, Codex, and Gemini persistent memory using an MCP memory server that survives restarts.">
 <meta name="keywords" content="ai agent memory, persistent memory, claude code memory, cursor agent memory, MCP memory server, session persistence, agent context, episodic memory, semantic memory">
 <meta property="og:title" content="How to Give Your AI Coding Agent Persistent Memory Across Sessions">

package/public/learn/mcp-pre-action-gates-explained.html

@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>MCP Pre-Action Gates Explained — ThumbGate</title>
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <meta name="description" content="What pre-action gates are, how they work in the Model Context Protocol, and why enforcement beats prompt rules for AI coding agent safety.">
 <meta name="keywords" content="MCP pre-action gates, PreToolUse hooks, Model Context Protocol, AI agent enforcement, Claude Code hooks, MCP server guardrails, tool call interception, ThumbGate">
 <meta property="og:title" content="MCP Pre-Action Gates Explained">

package/public/learn/stop-ai-agent-force-push.html

@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>How to Stop AI Agents From Force-Pushing to Main — ThumbGate</title>
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <meta name="description" content="Your AI coding agent just force-pushed to main. Again. Here is how to make that physically impossible with a pre-action gate in two minutes.">
 <meta name="keywords" content="AI agent force push, Claude Code force push prevention, git push force main, AI coding agent git safety, pre-action gates, ThumbGate">
 <meta property="og:title" content="How to Stop AI Agents From Force-Pushing to Main">

package/public/learn/vibe-coding-safety-net.html

@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>The Vibe Coding Safety Net You Are Missing — ThumbGate</title>
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <meta name="description" content="Vibe coding is fast until your AI agent deletes a production table or rewrites a file you did not ask it to touch. Add guardrails without slowing down.">
 <meta name="keywords" content="vibe coding safety, vibe coding guardrails, AI coding mistakes, Claude Code safety net, Cursor agent guardrails, AI agent enforcement, ThumbGate">
 <meta property="og:title" content="The Vibe Coding Safety Net You Are Missing">

package/public/learn.html

@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>Learn — AI Agent Safety, Pre-Action Gates, and Vibe Coding Guardrails</title>
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <meta name="description" content="Practical guides for stopping AI coding agent mistakes. Learn about pre-action gates, MCP guardrails, feedback-driven enforcement, and vibe coding safety for Claude Code, Cursor, Codex, and more.">
 <meta name="keywords" content="AI agent safety, pre-action gates, vibe coding guardrails, Claude Code mistakes, Cursor agent memory, MCP server hooks, AI coding agent feedback, ThumbGate guides">
 <meta property="og:title" content="Learn — AI Agent Safety Guides by ThumbGate">

package/public/lessons.html

@@ -4,7 +4,7 @@
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <title>ThumbGate — Lessons Learned</title>
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 <style>
   *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
   :root {

package/public/pro.html

@@ -13,7 +13,7 @@ __GOOGLE_SITE_VERIFICATION_META__
 <link rel="canonical" href="__APP_ORIGIN__/pro">
 <meta name="keywords" content="ThumbGate Pro, AI agent reliability, pre-action gates, DPO export, local dashboard, review-ready evidence, Claude Code reliability, Codex reliability, Cursor reliability">
 
-<script defer data-domain="thumbgate-production.up.railway.app" data-api="/api/event" src="/js/analytics.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 __GA_BOOTSTRAP__
 
 <script>

package/scripts/agent-security-hardening.js

@@ -84,10 +84,10 @@ function getCredentialAudit({ periodHours = 24 } = {}) {
 
 // MCP profile tool allowlists (loaded from config or defaults)
 const PROFILE_ALLOWLISTS = {
-  essential: new Set(['capture_feedback', 'recall', 'search_lessons', 'search_thumbgate', 'prevention_rules', 'enforcement_matrix', 'feedback_stats', 'estimate_uncertainty', 'org_dashboard', 'set_task_scope', 'get_scope_state', 'set_branch_governance', 'get_branch_governance', 'approve_protected_action', 'check_operational_integrity']),
-  readonly: new Set(['recall', 'feedback_summary', 'search_lessons', 'verify_claim', 'gate_stats', 'search_thumbgate', 'feedback_stats', 'estimate_uncertainty', 'org_dashboard', 'get_scope_state', 'get_branch_governance', 'check_operational_integrity']),
-  locked: new Set(['feedback_summary', 'search_lessons', 'diagnose_failure', 'list_intents', 'plan_intent', 'list_harnesses', 'verify_claim', 'get_scope_state', 'get_branch_governance', 'check_operational_integrity']),
-  commerce: new Set(['capture_feedback', 'recall', 'search_thumbgate', 'commerce_recall', 'track_action', 'verify_claim', 'feedback_stats', 'set_task_scope', 'get_scope_state', 'set_branch_governance', 'get_branch_governance', 'approve_protected_action', 'check_operational_integrity']),
+  essential: new Set(['capture_feedback', 'recall', 'search_lessons', 'search_thumbgate', 'prevention_rules', 'enforcement_matrix', 'feedback_stats', 'estimate_uncertainty', 'org_dashboard', 'set_task_scope', 'get_scope_state', 'set_branch_governance', 'get_branch_governance', 'approve_protected_action', 'check_operational_integrity', 'workflow_sentinel']),
+  readonly: new Set(['recall', 'feedback_summary', 'search_lessons', 'verify_claim', 'gate_stats', 'search_thumbgate', 'feedback_stats', 'estimate_uncertainty', 'org_dashboard', 'get_scope_state', 'get_branch_governance', 'check_operational_integrity', 'workflow_sentinel']),
+  locked: new Set(['feedback_summary', 'search_lessons', 'diagnose_failure', 'list_intents', 'plan_intent', 'list_harnesses', 'verify_claim', 'get_scope_state', 'get_branch_governance', 'check_operational_integrity', 'workflow_sentinel']),
+  commerce: new Set(['capture_feedback', 'recall', 'search_thumbgate', 'commerce_recall', 'track_action', 'verify_claim', 'feedback_stats', 'set_task_scope', 'get_scope_state', 'set_branch_governance', 'get_branch_governance', 'approve_protected_action', 'check_operational_integrity', 'workflow_sentinel']),
 };
 
 /**

package/scripts/async-job-runner.js

@@ -132,11 +132,54 @@ function serializeJobForState(job) {
     skill: job.skill || null,
     partnerProfile: job.partnerProfile || null,
     autoImprove: job.autoImprove !== false,
+    verificationMode: job.verificationMode === 'none' ? 'none' : 'standard',
+    recordFeedback: job.recordFeedback !== false,
     jobFilePath: job.jobFilePath || null,
     stages,
   };
 }
 
+function queueJob(job) {
+  const normalizedJob = {
+    ...job,
+    id: job.id || generateJobId(),
+    tags: Array.isArray(job.tags) ? job.tags : [],
+    autoImprove: job.autoImprove !== false,
+    verificationMode: job.verificationMode === 'none' ? 'none' : 'standard',
+    recordFeedback: job.recordFeedback !== false,
+    stages: normalizeStages(job),
+  };
+  const previousState = readJobState(normalizedJob.id);
+  const currentStage = normalizedJob.stages[0] ? normalizedJob.stages[0].name : null;
+  return writeJobState({
+    jobId: normalizedJob.id,
+    status: 'queued',
+    createdAt: previousState && previousState.createdAt ? previousState.createdAt : nowIso(),
+    startedAt: previousState && previousState.startedAt ? previousState.startedAt : null,
+    resumedAt: null,
+    updatedAt: nowIso(),
+    endedAt: null,
+    tags: normalizedJob.tags,
+    skill: normalizedJob.skill || null,
+    partnerProfile: normalizedJob.partnerProfile || null,
+    autoImprove: normalizedJob.autoImprove,
+    verificationMode: normalizedJob.verificationMode,
+    recordFeedback: normalizedJob.recordFeedback,
+    totalStages: normalizedJob.stages.length,
+    nextStageIndex: 0,
+    currentStage,
+    currentContext: '',
+    checkpoints: [],
+    stageHistory: [],
+    jobFilePath: normalizedJob.jobFilePath || null,
+    jobSpec: serializeJobForState(normalizedJob),
+    lastError: null,
+    stopReason: null,
+    improvementExperimentId: null,
+    verification: null,
+  });
+}
+
 function readJobState(jobId) {
   if (!jobId) return null;
   return readJson(getJobRuntimePaths(jobId).statePath);
@@ -618,6 +661,8 @@ function executeJob(job, options = {}) {
     id: job.id || generateJobId(),
     tags: Array.isArray(job.tags) ? job.tags : [],
     autoImprove: job.autoImprove !== false,
+    verificationMode: job.verificationMode === 'none' ? 'none' : 'standard',
+    recordFeedback: job.recordFeedback !== false,
     stages: normalizeStages(job),
   };
   const previousState = options.previousState || readJobState(normalizedJob.id);
@@ -643,6 +688,8 @@ function executeJob(job, options = {}) {
     skill: normalizedJob.skill || null,
     partnerProfile: normalizedJob.partnerProfile || null,
     autoImprove: normalizedJob.autoImprove,
+    verificationMode: normalizedJob.verificationMode,
+    recordFeedback: normalizedJob.recordFeedback,
     totalStages: normalizedJob.stages.length,
     nextStageIndex,
     currentStage: normalizedJob.stages[nextStageIndex] ? normalizedJob.stages[nextStageIndex].name : 'verification',
@@ -733,7 +780,7 @@ function executeJob(job, options = {}) {
 
       clearJobControl(normalizedJob.id);
 
-      const feedback = error && error.code === 'JOB_CANCELLED'
+      const feedback = (error && error.code === 'JOB_CANCELLED') || normalizedJob.recordFeedback === false
         ? null
         : captureFeedback({
           signal: 'down',
@@ -756,48 +803,60 @@ function executeJob(job, options = {}) {
     }
   }
 
-  const verification = runVerificationLoop({
-    context: currentContext,
-    tags: normalizedJob.tags,
-    skill: normalizedJob.skill,
-    partnerProfile: normalizedJob.partnerProfile,
-    onRetry: normalizedJob.onRetry,
-    maxRetries: normalizedJob.maxRetries,
-  });
+  const verification = normalizedJob.verificationMode === 'none'
+    ? null
+    : runVerificationLoop({
+      context: currentContext,
+      tags: normalizedJob.tags,
+      skill: normalizedJob.skill,
+      partnerProfile: normalizedJob.partnerProfile,
+      onRetry: normalizedJob.onRetry,
+      maxRetries: normalizedJob.maxRetries,
+    });
 
-  const improvementExperiment = verification.accepted
+  const improvementExperiment = !verification || verification.accepted
     ? null
     : maybeQueueImprovementExperiment(normalizedJob, state, recall, {
       type: 'verification',
       verification,
     });
 
-  const feedback = captureFeedback({
-    signal: verification.accepted ? 'up' : 'down',
-    context: verification.accepted
-      ? `Job ${normalizedJob.id} passed verification after ${verification.attempts} attempt(s)`
-      : `Job ${normalizedJob.id} failed verification after ${verification.attempts} attempt(s): ${(verification.finalVerification.violations || []).map((violation) => violation.pattern).join('; ')}`,
-    whatWorked: verification.accepted ? 'Verification loop accepted output' : undefined,
-    whatWentWrong: !verification.accepted ? `Failed ${verification.attempts} verification attempts` : undefined,
-    whatToChange: !verification.accepted ? 'Improve output to avoid known mistake patterns' : undefined,
-    tags: [...normalizedJob.tags, 'verification-loop'],
-    skill: normalizedJob.skill || 'async-job-runner',
-  });
+  const feedback = normalizedJob.recordFeedback === false
+    ? null
+    : captureFeedback({
+      signal: !verification || verification.accepted ? 'up' : 'down',
+      context: !verification
+        ? `Job ${normalizedJob.id} completed without post-run verification`
+        : verification.accepted
+          ? `Job ${normalizedJob.id} passed verification after ${verification.attempts} attempt(s)`
+          : `Job ${normalizedJob.id} failed verification after ${verification.attempts} attempt(s): ${(verification.finalVerification.violations || []).map((violation) => violation.pattern).join('; ')}`,
+      whatWorked: !verification
+        ? 'Operational job completed successfully'
+        : verification.accepted
+          ? 'Verification loop accepted output'
+          : undefined,
+      whatWentWrong: verification && !verification.accepted ? `Failed ${verification.attempts} verification attempts` : undefined,
+      whatToChange: verification && !verification.accepted ? 'Improve output to avoid known mistake patterns' : undefined,
+      tags: !verification
+        ? [...normalizedJob.tags, 'async-job-runner', 'verification-skipped']
+        : [...normalizedJob.tags, 'verification-loop'],
+      skill: normalizedJob.skill || 'async-job-runner',
+    });
 
   const terminalState = writeJobState({
     ...(readJobState(normalizedJob.id) || state),
-    status: verification.accepted ? 'completed' : 'failed',
+    status: !verification || verification.accepted ? 'completed' : 'failed',
     updatedAt: nowIso(),
     endedAt: nowIso(),
     currentStage: null,
     nextStageIndex: normalizedJob.stages.length,
     currentContext,
     improvementExperimentId: improvementExperiment ? improvementExperiment.id : null,
-    verification: {
+    verification: verification ? {
       accepted: verification.accepted,
       attempts: verification.attempts,
       score: verification.finalVerification ? verification.finalVerification.score : 0,
-    },
+    } : null,
   });
 
   clearJobControl(normalizedJob.id);
@@ -880,6 +939,7 @@ function runBatch(jobs) {
 module.exports = {
   recallContext,
   executeJob,
+  queueJob,
   runBatch,
   appendJobLog,
   readJobLog,

package/scripts/auto-wire-hooks.js

@@ -53,6 +53,7 @@ function detectAgent(flagAgent) {
     if (['claude-code', 'claude'].includes(normalized)) return 'claude-code';
     if (['codex'].includes(normalized)) return 'codex';
     if (['gemini'].includes(normalized)) return 'gemini';
+    if (['forge', 'forgecode', 'forge-code'].includes(normalized)) return 'forge';
     return null;
   }
 
@@ -61,6 +62,7 @@ function detectAgent(flagAgent) {
   if (fs.existsSync(path.join(home, '.claude'))) return 'claude-code';
   if (fs.existsSync(path.join(home, '.codex'))) return 'codex';
   if (fs.existsSync(path.join(home, '.gemini'))) return 'gemini';
+  if (fs.existsSync(path.join(process.cwd(), 'forge.yaml'))) return 'forge';
   return null;
 }
 
@@ -310,13 +312,64 @@ function wireGeminiHooks(options) {
   return { changed: true, settingsPath, added };
 }
 
+// --- ForgeCode wiring ---
+
+function forgeConfigPath() {
+  return path.join(process.cwd(), 'forge.yaml');
+}
+
+function wireForgeHooks(options) {
+  const dryRun = options.dryRun || false;
+
+  const preToolCmd = preToolHookCommand();
+  const userPromptCmd = userPromptHookCommand();
+
+  // ForgeCode uses YAML config (forge.yaml). We write a JSON-based hooks
+  // sidecar file (.thumbgate/forge-hooks.json) and append skill entries to
+  // forge.yaml if they are not already present.
+  const hooksPath = options.settingsPath || path.join(path.dirname(forgeConfigPath()), '.thumbgate', 'forge-hooks.json');
+  let existing = loadJsonFile(hooksPath) || {};
+  existing.hooks = existing.hooks || {};
+
+  const added = [];
+
+  if (!hookAlreadyPresent(existing.hooks.PreToolUse, preToolCmd)) {
+    existing.hooks.PreToolUse = existing.hooks.PreToolUse || [];
+    existing.hooks.PreToolUse.push({
+      matcher: 'Bash',
+      hooks: [{ type: 'command', command: preToolCmd }],
+    });
+    added.push({ lifecycle: 'PreToolUse', command: preToolCmd });
+  }
+
+  if (!hookAlreadyPresent(existing.hooks.UserPromptSubmit, userPromptCmd)) {
+    existing.hooks.UserPromptSubmit = existing.hooks.UserPromptSubmit || [];
+    existing.hooks.UserPromptSubmit.push({
+      hooks: [{ type: 'command', command: userPromptCmd }],
+    });
+    added.push({ lifecycle: 'UserPromptSubmit', command: userPromptCmd });
+  }
+
+  if (added.length === 0) {
+    return { changed: false, settingsPath: hooksPath, added: [] };
+  }
+
+  if (!dryRun) {
+    const dir = path.dirname(hooksPath);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(hooksPath, JSON.stringify(existing, null, 2) + '\n');
+  }
+
+  return { changed: true, settingsPath: hooksPath, added };
+}
+
 // --- Dispatcher ---
 
 function wireHooks(options) {
   const agent = detectAgent(options.agent);
   if (!agent) {
     return {
-      error: 'Could not detect AI agent. Use --agent=claude-code|codex|gemini',
+      error: 'Could not detect AI agent. Use --agent=claude-code|codex|gemini|forge',
       agent: null,
       changed: false,
     };
@@ -333,6 +386,9 @@ function wireHooks(options) {
     case 'gemini':
       result = wireGeminiHooks(options);
       break;
+    case 'forge':
+      result = wireForgeHooks(options);
+      break;
     default:
       return { error: `Unsupported agent: ${agent}`, agent, changed: false };
   }
@@ -364,6 +420,7 @@ module.exports = {
   wireClaudeHooks,
   wireCodexHooks,
   wireGeminiHooks,
+  wireForgeHooks,
   hookAlreadyPresent,
   loadJsonFile,
   parseFlags,
@@ -372,6 +429,7 @@ module.exports = {
   codexConfigPath,
   geminiSettingsPath,
   syncClaudeStatusLine,
+  forgeConfigPath,
   CLAUDE_HOOKS,
   preToolHookCommand,
   userPromptHookCommand,