thumbgate 1.0.0 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. package/.claude-plugin/marketplace.json +1 -1
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/.well-known/mcp/server-card.json +1 -1
  4. package/README.md +16 -5
  5. package/adapters/README.md +1 -1
  6. package/adapters/claude/.mcp.json +2 -2
  7. package/adapters/codex/config.toml +2 -2
  8. package/adapters/mcp/server-stdio.js +19 -7
  9. package/adapters/opencode/opencode.json +1 -1
  10. package/config/github-about.json +1 -1
  11. package/config/mcp-allowlists.json +1 -0
  12. package/package.json +22 -11
  13. package/plugins/claude-codex-bridge/.claude-plugin/plugin.json +1 -1
  14. package/plugins/claude-codex-bridge/.mcp.json +1 -1
  15. package/plugins/codex-profile/.codex-plugin/plugin.json +1 -1
  16. package/plugins/codex-profile/.mcp.json +1 -1
  17. package/plugins/codex-profile/INSTALL.md +1 -1
  18. package/plugins/codex-profile/README.md +1 -1
  19. package/plugins/cursor-marketplace/.cursor-plugin/plugin.json +1 -1
  20. package/plugins/opencode-profile/INSTALL.md +1 -1
  21. package/public/compare.html +302 -0
  22. package/public/index.html +41 -11
  23. package/scripts/__pycache__/train_from_feedback.cpython-312.pyc +0 -0
  24. package/scripts/ai-search-visibility.js +142 -0
  25. package/scripts/changeset-check.js +372 -0
  26. package/scripts/check-congruence.js +7 -4
  27. package/scripts/computer-use-firewall.js +45 -15
  28. package/scripts/docker-sandbox-planner.js +208 -0
  29. package/scripts/export-hf-dataset.js +293 -0
  30. package/scripts/github-about.js +56 -0
  31. package/scripts/operational-integrity.js +7 -1
  32. package/scripts/published-cli.js +10 -1
  33. package/scripts/statusline-links.js +238 -0
  34. package/scripts/statusline.sh +39 -4
  35. package/scripts/sync-github-about.js +7 -4
  36. package/scripts/tool-registry.js +11 -0
  37. package/scripts/workflow-sentinel.js +83 -35
  38. package/src/api/server.js +12 -1
package/public/compare.html ADDED
@@ -0,0 +1,302 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)</title>
7
+ <!-- Privacy-friendly analytics by Plausible -->
8
+ <script defer data-domain="rlhf-feedback-loop-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
9
+ <meta name="description" content="Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes.">
10
+ <meta name="keywords" content="AI agent safety, pre-action gates, AI coding agent comparison, ThumbGate vs manual review, AI agent guardrails, PreToolUse hooks, Claude Code safety, Codex safety, Gemini safety, Cursor rules alternative">
11
+ <meta property="og:title" content="Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)">
12
+ <meta property="og:description" content="Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes.">
13
+ <meta property="og:type" content="article">
14
+ <meta property="og:url" content="https://thumbgate-production.up.railway.app/compare">
15
+ <link rel="canonical" href="https://thumbgate-production.up.railway.app/compare">
16
+
17
+ <script type="application/ld+json">
18
+ {
19
+ "@context": "https://schema.org",
20
+ "@type": "TechArticle",
21
+ "headline": "Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)",
22
+ "description": "Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes vs Cursor rules vs linters.",
23
+ "author": {
24
+ "@type": "Person",
25
+ "name": "Igor Ganapolsky",
26
+ "url": "https://github.com/IgorGanapolsky"
27
+ },
28
+ "publisher": {
29
+ "@type": "Organization",
30
+ "name": "ThumbGate",
31
+ "url": "https://thumbgate-production.up.railway.app"
32
+ },
33
+ "datePublished": "2026-04-08",
34
+ "dateModified": "2026-04-08",
35
+ "mainEntityOfPage": "https://thumbgate-production.up.railway.app/compare"
36
+ }
37
+ </script>
38
+
39
+ <script type="application/ld+json">
40
+ {
41
+ "@context": "https://schema.org",
42
+ "@type": "FAQPage",
43
+ "mainEntity": [
44
+ {
45
+ "@type": "Question",
46
+ "name": "What is a pre-action gate for AI coding agents?",
47
+ "acceptedAnswer": {
48
+ "@type": "Answer",
49
+ "text": "A pre-action gate is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action gates physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests. ThumbGate implements pre-action gates via PreToolUse hooks that fire before every tool call."
50
+ }
51
+ },
52
+ {
53
+ "@type": "Question",
54
+ "name": "Does ThumbGate work with Claude Code?",
55
+ "acceptedAnswer": {
56
+ "@type": "Answer",
57
+ "text": "Yes. ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent. Run npx thumbgate init --agent claude-code to auto-configure PreToolUse hooks in your .claude/settings.json."
58
+ }
59
+ },
60
+ {
61
+ "@type": "Question",
62
+ "name": "Is ThumbGate free?",
63
+ "acceptedAnswer": {
64
+ "@type": "Answer",
65
+ "text": "ThumbGate has a free tier that includes local enforcement with 5 daily feedback captures, 10 lesson searches, unlimited recall, blocking, and history-aware lesson distillation. Pro ($19/mo or $149/yr) adds a personal local dashboard and DPO export. Team rollout ($12/seat/mo) adds a shared lesson database and org dashboard."
66
+ }
67
+ },
68
+ {
69
+ "@type": "Question",
70
+ "name": "How is ThumbGate different from .cursorrules or CLAUDE.md rules?",
71
+ "acceptedAnswer": {
72
+ "@type": "Answer",
73
+ "text": "Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is physically blocked before execution. Additionally, ThumbGate auto-generates prevention rules from feedback, so you never have to write rules manually."
74
+ }
75
+ },
76
+ {
77
+ "@type": "Question",
78
+ "name": "Can ThumbGate learn from mistakes automatically?",
79
+ "acceptedAnswer": {
80
+ "@type": "Answer",
81
+ "text": "Yes. When your AI agent makes a mistake, you give a thumbs-down with context. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule and wires it as a pre-action gate. Gates adapt their sensitivity over time using Thompson Sampling, a Bayesian multi-armed bandit algorithm."
82
+ }
83
+ }
84
+ ]
85
+ }
86
+ </script>
87
+
88
+ <style>
89
+ *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
90
+ :root {
91
+ --bg: #0a0a0b;
92
+ --bg-card: #161618;
93
+ --border: #222225;
94
+ --text: #e8e8ec;
95
+ --muted: #8b8b94;
96
+ --cyan: #22d3ee;
97
+ --green: #34d399;
98
+ --red: #f87171;
99
+ }
100
+ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.7; }
101
+ .container { max-width: 780px; margin: 0 auto; padding: 2rem 1.5rem 4rem; }
102
+ nav { padding: 1rem 2rem; border-bottom: 1px solid var(--border); display: flex; gap: 1.5rem; align-items: center; }
103
+ nav a { color: var(--muted); text-decoration: none; font-size: 0.9rem; }
104
+ nav a:hover { color: var(--cyan); }
105
+ nav .brand { color: var(--text); font-weight: 700; font-size: 1.1rem; }
106
+ h1 { font-size: 2.2rem; line-height: 1.2; margin: 2rem 0 1rem; }
107
+ h2 { font-size: 1.5rem; margin: 2.5rem 0 1rem; color: var(--cyan); }
108
+ h3 { font-size: 1.15rem; margin: 1.5rem 0 0.5rem; }
109
+ p, li { color: var(--text); margin-bottom: 0.75rem; }
110
+ ul { padding-left: 1.5rem; }
111
+ li { margin-bottom: 0.5rem; }
112
+ code { background: #1a1a1e; padding: 0.15em 0.4em; border-radius: 4px; font-size: 0.9em; color: var(--cyan); }
113
+ pre { background: #111113; border: 1px solid var(--border); border-radius: 8px; padding: 1rem; overflow-x: auto; margin: 1rem 0; }
114
+ pre code { background: none; padding: 0; color: var(--text); }
115
+ .highlight { color: var(--cyan); }
116
+ .card { background: var(--bg-card); border: 1px solid var(--border); border-radius: 12px; padding: 1.5rem; margin: 1.5rem 0; }
117
+ .comparison-table { width: 100%; border-collapse: collapse; margin: 1.5rem 0; font-size: 0.9rem; }
118
+ .comparison-table th, .comparison-table td { padding: 0.75rem; border: 1px solid var(--border); text-align: left; }
119
+ .comparison-table th { background: #111113; color: var(--cyan); }
120
+ .comparison-table td:first-child { font-weight: 600; }
121
+ .yes { color: var(--green); }
122
+ .no { color: var(--red); }
123
+ .partial { color: #fbbf24; }
124
+ .cta { display: inline-block; background: var(--cyan); color: #000; padding: 0.75rem 1.5rem; border-radius: 8px; text-decoration: none; font-weight: 600; margin: 1rem 0; }
125
+ .cta:hover { opacity: 0.9; }
126
+ .breadcrumb { color: var(--muted); font-size: 0.85rem; margin-bottom: 0.5rem; }
127
+ .breadcrumb a { color: var(--muted); }
128
+ .step-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 1rem; margin: 1.5rem 0; }
129
+ .step-card { background: var(--bg-card); border: 1px solid var(--border); border-radius: 12px; padding: 1.25rem; }
130
+ .step-card .step-number { color: var(--cyan); font-weight: 700; font-size: 1.5rem; margin-bottom: 0.5rem; }
131
+ .step-card h3 { margin-top: 0; }
132
+ footer { border-top: 1px solid var(--border); padding: 2rem; text-align: center; color: var(--muted); font-size: 0.85rem; }
133
+ footer a { color: var(--muted); text-decoration: underline; }
134
+ @media (max-width: 600px) { h1 { font-size: 1.6rem; } .container { padding: 1rem; } .comparison-table { font-size: 0.8rem; } .comparison-table th, .comparison-table td { padding: 0.5rem; } }
135
+ </style>
136
+ </head>
137
+ <body>
138
+ <nav>
139
+ <a href="/" class="brand">ThumbGate</a>
140
+ <a href="/guide">Guide</a>
141
+ <a href="/compare">Compare</a>
142
+ <a href="/dashboard">Dashboard</a>
143
+ <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a>
144
+ </nav>
145
+
146
+ <div class="container">
147
+ <p class="breadcrumb"><a href="/">Home</a> / Compare</p>
148
+
149
+ <h1>Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)</h1>
150
+ <p style="color:var(--muted);">Your AI coding agent force-pushed to main again. Which tool actually prevents that? We compared the five most common approaches to AI agent safety.</p>
151
+
152
+ <h2>Comparison Table</h2>
153
+ <div style="overflow-x:auto;">
154
+ <table class="comparison-table">
155
+ <tr>
156
+ <th>Feature</th>
157
+ <th>ThumbGate</th>
158
+ <th>Manual Code Review</th>
159
+ <th>Post-hoc Git Revert</th>
160
+ <th>Cursor Rules / .cursorrules</th>
161
+ <th>ESLint / Linters</th>
162
+ </tr>
163
+ <tr>
164
+ <td>Blocks bad actions before execution</td>
165
+ <td class="yes">Yes -- PreToolUse hooks</td>
166
+ <td class="partial">Partially -- after PR only</td>
167
+ <td class="no">No -- damage already done</td>
168
+ <td class="partial">Partially -- suggestions only</td>
169
+ <td class="partial">Partially -- static checks only</td>
170
+ </tr>
171
+ <tr>
172
+ <td>Learns from past mistakes</td>
173
+ <td class="yes">Yes -- auto-generates rules from feedback</td>
174
+ <td class="no">No -- relies on reviewer memory</td>
175
+ <td class="no">No</td>
176
+ <td class="no">No -- rules are hand-written</td>
177
+ <td class="no">No -- rules are hand-written</td>
178
+ </tr>
179
+ <tr>
180
+ <td>Works with Claude / Codex / Gemini / Forge</td>
181
+ <td class="yes">Yes -- all MCP-compatible agents</td>
182
+ <td class="yes">Yes -- agent-agnostic</td>
183
+ <td class="yes">Yes -- agent-agnostic</td>
184
+ <td class="partial">Cursor only</td>
185
+ <td class="partial">Partial -- code-level only</td>
186
+ </tr>
187
+ <tr>
188
+ <td>Zero config setup</td>
189
+ <td class="yes">Yes -- <code>npx thumbgate init</code></td>
190
+ <td class="no">No -- requires process + people</td>
191
+ <td class="no">No -- manual intervention each time</td>
192
+ <td class="partial">Partial -- requires writing rules</td>
193
+ <td class="partial">Partial -- requires config + plugins</td>
194
+ </tr>
195
+ <tr>
196
+ <td>Captures feedback for improvement</td>
197
+ <td class="yes">Yes -- thumbs up/down with context</td>
198
+ <td class="partial">Partial -- PR comments only</td>
199
+ <td class="no">No</td>
200
+ <td class="no">No</td>
201
+ <td class="no">No</td>
202
+ </tr>
203
+ <tr>
204
+ <td>Generates prevention rules automatically</td>
205
+ <td class="yes">Yes -- from repeated failure patterns</td>
206
+ <td class="no">No</td>
207
+ <td class="no">No</td>
208
+ <td class="no">No</td>
209
+ <td class="no">No</td>
210
+ </tr>
211
+ <tr>
212
+ <td>Real-time pre-action gates</td>
213
+ <td class="yes">Yes -- fires before every tool call</td>
214
+ <td class="no">No -- asynchronous review</td>
215
+ <td class="no">No -- reactive only</td>
216
+ <td class="no">No -- prompt-time only</td>
217
+ <td class="no">No -- build-time only</td>
218
+ </tr>
219
+ <tr>
220
+ <td>Cost</td>
221
+ <td>Free tier + Pro $19/mo</td>
222
+ <td>Engineer time per review</td>
223
+ <td>Time lost + recovery cost</td>
224
+ <td>Free</td>
225
+ <td>Free (open source)</td>
226
+ </tr>
227
+ </table>
228
+ </div>
229
+
230
+ <h2>Why ThumbGate Wins</h2>
231
+ <ul>
232
+ <li><strong>Enforcement, not suggestions.</strong> Prompt rules in CLAUDE.md or .cursorrules are instructions the agent can ignore. ThumbGate intercepts tool calls at the PreToolUse hook level and physically blocks dangerous actions before they execute.</li>
233
+ <li><strong>Learns and adapts automatically.</strong> Every thumbs-down becomes a data point. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule. Gates adapt their sensitivity over time using Thompson Sampling -- aggressive gates that over-block get tuned down, effective gates get reinforced.</li>
234
+ <li><strong>Works across all major AI coding agents.</strong> One install command covers Claude Code, Cursor, Codex, Gemini CLI, Amp, and OpenCode. No per-agent configuration needed.</li>
235
+ <li><strong>Prevention is cheaper than recovery.</strong> Manual code review catches mistakes after the PR. Git revert catches them after the push. ThumbGate catches them before the tool call executes -- saving the time, context switches, and cleanup cost of undoing damage.</li>
236
+ </ul>
237
+
238
+ <h2>How It Works</h2>
239
+ <div class="step-grid">
240
+ <div class="step-card">
241
+ <div class="step-number">1</div>
242
+ <h3>Install</h3>
243
+ <p>Run <code>npx thumbgate init</code>. ThumbGate auto-detects your AI coding agent and configures PreToolUse hooks. No manual setup needed.</p>
244
+ </div>
245
+ <div class="step-card">
246
+ <div class="step-number">2</div>
247
+ <h3>Gate</h3>
248
+ <p>Every tool call your agent makes passes through a pre-action gate. Known-bad patterns are blocked before execution. Good actions pass through instantly.</p>
249
+ </div>
250
+ <div class="step-card">
251
+ <div class="step-number">3</div>
252
+ <h3>Learn</h3>
253
+ <p>When your agent makes a mistake, give it a thumbs-down. ThumbGate captures the feedback and auto-generates prevention rules from repeated failures.</p>
254
+ </div>
255
+ </div>
256
+
257
+ <h2>Get Started</h2>
258
+ <div class="card">
259
+ <p>Install ThumbGate in one command:</p>
260
+ <pre><code>npx thumbgate init</code></pre>
261
+ <p>Then start giving feedback. ThumbGate handles the rest.</p>
262
+ <p>
263
+ <a href="https://www.npmjs.com/package/thumbgate" class="cta">View on npm</a>
264
+ <a href="https://github.com/IgorGanapolsky/ThumbGate" style="color:var(--cyan); margin-left:1.5rem; text-decoration:underline;">View on GitHub</a>
265
+ </p>
266
+ </div>
267
+
268
+ <h2>Frequently Asked Questions</h2>
269
+
270
+ <div class="card">
271
+ <h3>What is a pre-action gate?</h3>
272
+ <p>A pre-action gate is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action gates physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests.</p>
273
+ </div>
274
+
275
+ <div class="card">
276
+ <h3>Does ThumbGate work with Claude Code?</h3>
277
+ <p>Yes. ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent. Run <code>npx thumbgate init --agent claude-code</code> to auto-configure PreToolUse hooks.</p>
278
+ </div>
279
+
280
+ <div class="card">
281
+ <h3>Is ThumbGate free?</h3>
282
+ <p>ThumbGate has a free tier that includes local enforcement with 5 daily feedback captures, 10 lesson searches, unlimited recall, and pre-action gate blocking. Pro ($19/mo or $149/yr) adds a personal local dashboard and DPO export. Team rollout ($12/seat/mo) adds a shared lesson database and org dashboard.</p>
283
+ </div>
284
+
285
+ <div class="card">
286
+ <h3>How is ThumbGate different from .cursorrules or CLAUDE.md rules?</h3>
287
+ <p>Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is physically blocked before execution. Additionally, ThumbGate auto-generates prevention rules from feedback -- no manual rule writing.</p>
288
+ </div>
289
+
290
+ <div class="card">
291
+ <h3>Can ThumbGate learn from mistakes automatically?</h3>
292
+ <p>Yes. When your AI agent makes a mistake, give a thumbs-down with context. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule and wires it as a pre-action gate. Gates adapt over time using Thompson Sampling, a Bayesian multi-armed bandit algorithm.</p>
293
+ </div>
294
+
295
+ </div>
296
+
297
+ <footer>
298
+ <p>ThumbGate -- Pre-action gates for AI coding agents</p>
299
+ <p><a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> | <a href="https://www.npmjs.com/package/thumbgate">npm</a> | <a href="/guide">Guide</a> | <a href="/dashboard">Dashboard</a></p>
300
+ </footer>
301
+ </body>
302
+ </html>
package/public/index.html CHANGED
@@ -20,9 +20,9 @@
20
20
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
21
21
  __GOOGLE_SITE_VERIFICATION_META__
22
22
  <title>ThumbGate — Self-improving AI coding agents that learn from every mistake</title>
23
- <meta name="description" content="Pre-action gates for AI coding agents. 👎 Thumbs down → prevention rule → mistake permanently blocked. 👍 Thumbs up → pattern reinforced. History-aware lessons from your corrections. Team adds shared lessons and org visibility.">
23
+ <meta name="description" content="Pre-action gates and workflow governance for AI coding agents. 👎 Thumbs down → prevention rule → mistake permanently blocked. 👍 Thumbs up → pattern reinforced. History-aware lessons from your corrections. Risky local runs can route into Docker Sandboxes. Team adds shared lessons and org visibility, plus isolated execution guidance.">
24
24
  <meta property="og:title" content="ThumbGate — Self-improving AI coding agents that learn from every mistake">
25
- <meta property="og:description" content="Pre-action gates for AI coding agents. 👎 Thumbs down → prevention rule → mistake permanently blocked. 👍 Thumbs up → pattern reinforced. History-aware lessons from your corrections. Team adds shared lessons and org visibility.">
25
+ <meta property="og:description" content="Pre-action gates and workflow governance for AI coding agents. 👎 Thumbs down → prevention rule → mistake permanently blocked. 👍 Thumbs up → pattern reinforced. History-aware lessons from your corrections. Risky local runs can route into Docker Sandboxes. Team adds shared lessons and org visibility, plus isolated execution guidance.">
26
26
  <meta property="og:type" content="website">
27
27
  <meta name="keywords" content="ThumbGate, thumbgate, self-improving AI agents, AI agent self-improvement, AI agent learning, AI agent memory, pre-action gates, human-in-the-loop, MCP server, Claude Code, Cursor, Codex, Gemini, Amp, OpenCode, vibe coding safety, SpecLock alternative, Mem0 alternative, AI coding agent feedback loop, PreToolUse hooks, prevention rules, feedback enforcement, context engineering">
28
28
 
@@ -44,7 +44,7 @@ __GA_BOOTSTRAP__
44
44
  "@type": "SoftwareApplication",
45
45
  "name": "ThumbGate",
46
46
  "alternateName": "thumbgate",
47
- "description": "Make your AI coding agent self-improving. Every mistake becomes a prevention rule. Every correction makes it permanently smarter. Turns feedback into enforcement — your agent gets better with every session.",
47
+ "description": "Make your AI coding agent self-improving. Every mistake becomes a prevention rule. Every correction makes it permanently smarter. ThumbGate adds workflow governance and isolated execution guidance so high-risk runs do not have to happen directly on the host.",
48
48
  "applicationCategory": "DeveloperApplication",
49
49
  "operatingSystem": "Cross-platform, Node.js >=18.18.0",
50
50
  "license": "https://opensource.org/licenses/MIT",
@@ -59,6 +59,9 @@ __GA_BOOTSTRAP__
59
59
  },
60
60
  "featureList": [
61
61
  "Pre-Action Gates — block known-bad tool calls before execution",
62
+ "Workflow Sentinel — score blast radius before PR, merge, release, and publish actions fire",
63
+ "Docker Sandboxes routing — move high-risk local runs into isolated microVM-backed execution",
64
+ "Hosted sandbox dispatch — signed isolated lane for team automations",
62
65
  "Domain Skill Packs — Stripe, Railway, database migration best practices",
63
66
  "Progressive Disclosure — 82% token savings with 3-tier L1/L2/L3 loading",
64
67
  "Hallucination Detection — decomposes claims into verifiable sub-claims",
@@ -66,7 +69,9 @@ __GA_BOOTSTRAP__
66
69
  "Background Agent Governance — per-agent pass rates, CI auto-feedback",
67
70
  "Memory Migration — imports Claude Code MEMORY.md into unlimited SQLite DB",
68
71
  "Prompt-Level DLP — scans tool call inputs before execution",
69
- "Per-Step Scoring — every gate decision becomes a DPO/KTO training signal"
72
+ "Per-Step Scoring — every gate decision becomes a DPO/KTO training signal",
73
+ "HuggingFace Export — share PII-redacted agent traces as open training datasets",
74
+ "Unified Context — one-call context assembly with session, lessons, guards, and code-graph"
70
75
  ],
71
76
  "offers": [
72
77
  {
@@ -95,7 +100,7 @@ __GA_BOOTSTRAP__
95
100
  {
96
101
  "@type": "Offer",
97
102
  "name": "Team",
98
- "description": "Shared enforcement memory, review visibility, org dashboard, and pilot rollout support for teams shipping AI-generated changes",
103
+ "description": "Shared enforcement memory, review visibility, org dashboard, Docker Sandboxes guidance for risky local autonomy, and pilot rollout support for teams shipping AI-generated changes",
99
104
  "url": "https://thumbgate-production.up.railway.app/#workflow-sprint-intake"
100
105
  }
101
106
  ]
@@ -176,6 +181,14 @@ __GA_BOOTSTRAP__
176
181
  "text": "Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent."
177
182
  }
178
183
  },
184
+ {
185
+ "@type": "Question",
186
+ "name": "How does ThumbGate reduce host blast radius for high-risk local runs?",
187
+ "acceptedAnswer": {
188
+ "@type": "Answer",
189
+ "text": "ThumbGate combines pre-action gates with execution guidance. Workflow Sentinel predicts risky local actions before they execute, and high-risk runs can be routed into Docker Sandboxes instead of running directly on the host. Team workflows also have a signed hosted sandbox lane for isolated automation dispatch."
190
+ }
191
+ },
179
192
  {
180
193
  "@type": "Question",
181
194
  "name": "How are pre-action gates different from prompt rules?",
@@ -417,6 +430,7 @@ __GA_BOOTSTRAP__
417
430
  <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
418
431
  <a href="/guide">Setup Guide</a>
419
432
  <a href="/learn">Learn</a>
433
+ <a href="/compare">Compare</a>
420
434
  <a href="/dashboard">Dashboard Demo</a>
421
435
  <a href="/pro?utm_source=website&utm_medium=homepage_nav&utm_campaign=pro_page" class="nav-cta">See Pro</a>
422
436
  </div>
@@ -427,19 +441,19 @@ __GA_BOOTSTRAP__
427
441
  <section class="hero">
428
442
  <div class="container">
429
443
  <div class="hero-thumbs">👍👎</div>
430
- <div class="hero-badge">● Self-improving AI agents — every mistake makes it smarter</div>
444
+ <div class="hero-badge">● Self-improving AI agents with workflow governance and isolated execution</div>
431
445
  <h1>Your AI agent learns<br>from every mistake.</h1>
432
446
  <div class="hero-signals">
433
447
  <div class="signal-pill signal-down">👎 Mistake becomes a prevention rule — permanently blocked</div>
434
448
  <div class="signal-pill signal-up">👍 Good pattern reinforced — reused across sessions</div>
435
449
  </div>
436
- <p class="hero-persona">For developers using Claude Code, Cursor, Codex, Gemini, Amp, and OpenCode who want their AI agent to actually get better over time — not repeat the same mistakes every session.</p>
437
- <p><strong>The self-improvement loop:</strong> Your agent makes a mistake → you give a thumbs-down → ThumbGate auto-generates a prevention rule → a gate physically blocks that mistake from ever happening again. Your agent gets permanently smarter with every correction. No model retraining. No prompt hacking. Just enforcement that compounds.</p>
450
+ <p class="hero-persona">For developers using Claude Code, Cursor, Codex, Gemini, Amp, and OpenCode who want their AI agent to actually get better over time — and for teams that need the riskiest runs governed before they touch shared repos or the host machine.</p>
451
+ <p><strong>The self-improvement loop:</strong> Your agent makes a mistake → you give a thumbs-down → ThumbGate auto-generates a prevention rule → a gate physically blocks that mistake from ever happening again. Your agent gets permanently smarter with every correction. No model retraining. No prompt hacking. Just enforcement that compounds, plus isolated execution guidance when autonomy gets risky.</p>
438
452
  <div class="hero-actions">
439
453
  <a href="/pro?utm_source=website&utm_medium=homepage_hero&utm_campaign=pro_page" class="btn-pro-page">See Pro for individual operators</a>
440
454
  <a href="/dashboard?utm_source=website&utm_medium=homepage_hero&utm_campaign=demo" class="btn-demo-link">Open dashboard demo</a>
441
455
  </div>
442
- <p class="hero-paid-note"><strong>Paid path:</strong> Free stays the local install lane. Pro is the buyer-ready page for your personal local dashboard, DPO export, and review-ready evidence.</p>
456
+ <p class="hero-paid-note"><strong>Paid path:</strong> Free stays the local install lane. Pro is the buyer-ready page for your personal local dashboard, DPO export, and review-ready evidence. Team adds shared workflow governance, org proof, and isolated execution guidance for high-risk runs.</p>
443
457
  <div class="hero-install" onclick="copyInstall(this)" title="Click to copy">
444
458
  <span class="prompt">$</span>
445
459
  <span class="cmd">npx thumbgate init</span>
@@ -506,6 +520,10 @@ __GA_BOOTSTRAP__
506
520
  <h3>📊 Org Dashboard (Pro)</h3>
507
521
  <p>See which agents are creating review churn, which gates are saving time, and where rollout risk is still concentrated.</p>
508
522
  </div>
523
+ <div class="agent-card">
524
+ <h3>🧱 Isolated Execution Lanes</h3>
525
+ <p>High-risk local autonomy can route into Docker Sandboxes, while hosted team automations use a signed sandbox dispatch lane instead of running loose on a shared host.</p>
526
+ </div>
509
527
  <div class="agent-card">
510
528
  <h3>🧪 Thompson Sampling</h3>
511
529
  <p>Confidence tiers (none/low/medium/high) tell you when to trust the model vs fall back to rules. No guessing.</p>
@@ -578,7 +596,7 @@ __GA_BOOTSTRAP__
578
596
  <!-- HOW IT WORKS -->
579
597
  <section class="how-it-works" id="how-it-works">
580
598
  <div class="container">
581
- <div class="section-label">New in v1.0.0</div>
599
+ <div class="section-label">New in v1.2.0</div>
582
600
  <h2 class="section-title">Three steps to stop repeated AI failures</h2>
583
601
  <div class="steps">
584
602
  <div class="step">
@@ -623,6 +641,10 @@ __GA_BOOTSTRAP__
623
641
  <h3>Log everything, learn automatically</h3>
624
642
  <p>Repeated failures auto-promote to gates. Org dashboard shows all agents.</p>
625
643
  </div>
644
+ <div class="agent-card">
645
+ <h3>Keep risky runs off the host</h3>
646
+ <p>When Workflow Sentinel predicts a risky local action, ThumbGate can recommend Docker Sandboxes before the agent touches the host filesystem or broader credentials.</p>
647
+ </div>
626
648
  </div>
627
649
  </div>
628
650
  </section>
@@ -670,6 +692,7 @@ __GA_BOOTSTRAP__
670
692
  <li>All MCP integrations (Claude Code, Cursor, Codex, etc.)</li>
671
693
  <li>PreToolUse hook blocking</li>
672
694
  <li>Local SQLite lesson DB</li>
695
+ <li>Unified context assembly — one call gets session, lessons, guards, and code-graph</li>
673
696
  <li><a href="/guide" style="color:var(--cyan);text-decoration:underline;">Setup guide for all agents →</a></li>
674
697
  </ul>
675
698
  <a href="https://www.npmjs.com/package/thumbgate" target="_blank" rel="noopener" class="btn-free">Install Free</a>
@@ -698,6 +721,7 @@ __GA_BOOTSTRAP__
698
721
  <li><a href="/dashboard" style="color:var(--cyan);text-decoration:underline;">Visual gate debugger →</a> see every blocked action and the gate that fired so you can trust the system in minutes</li>
699
722
  <li>Auto-connect — activate once with your license key, then your running agents appear automatically on your local dashboard</li>
700
723
  <li><a href="/dashboard" style="color:var(--cyan);text-decoration:underline;">DPO training data export →</a> turn real thumbs-downs into ready-to-use preference pairs for fine-tuning (LoRA / JSONL)</li>
724
+ <li><strong>HuggingFace dataset export</strong> — share PII-redacted agent traces as open training datasets (<code>npm run export:hf</code>)</li>
701
725
  <li><strong>Model Hardening Advisor</strong> — get recommendations on when and how to fine-tune your model to natively avoid recurring failures</li>
702
726
  <li>Personal local dashboard — every Pro user gets a localhost dashboard without extra cloud setup</li>
703
727
  <li>Founder-license support — we help you wire the riskiest flows first: migrations, force-pushes, deploys, and CI</li>
@@ -724,6 +748,8 @@ __GA_BOOTSTRAP__
724
748
  <li>Org dashboard — active agents, gate hit rates, risk agents, and proof-backed team metrics in one place</li>
725
749
  <li>Hosted review views — constrained cards, lists, and callouts for rollout, incident, and audit visibility</li>
726
750
  <li>Gate template library — pre-built guardrails for force-pushes, skipped tests, destructive SQL, and evidence-before-done</li>
751
+ <li>Docker Sandboxes guidance — route risky local autonomy into an isolated microVM-backed lane instead of running it directly on a shared host</li>
752
+ <li>Signed hosted sandbox dispatch — isolated execution path for team automations that do not need repo-bound local access</li>
727
753
  <li>Workflow proof sprint — pilot one painful workflow first, then expand once the before/after evidence is real</li>
728
754
  <li>Rollout attribution stays tied to the team funnel instead of disappearing into generic referral traffic</li>
729
755
  </ul>
@@ -779,6 +805,10 @@ __GA_BOOTSTRAP__
779
805
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">What AI agents and editors does this work with?</div>
780
806
  <div class="faq-a">ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any other MCP-compatible agent. Cursor ships with a plugin bundle in this repo. Codex ships with a repo-local app plugin profile. VS Code works when you run an MCP-compatible agent inside it, but this repo does not ship a standalone VS Code extension today.</div>
781
807
  </div>
808
+ <div class="faq-item">
809
+ <button class="faq-q" type="button" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">How do we keep high-risk autonomous runs off the host?</button>
810
+ <div class="faq-a">ThumbGate is the control plane, not just a prompt layer. Workflow Sentinel predicts blast radius before execution, and risky local autonomy can be routed into Docker Sandboxes instead of running directly on the host. Team workflows also have a signed hosted sandbox lane for isolated dispatch when local repo access is not required.</div>
811
+ </div>
782
812
  <div class="faq-item">
783
813
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">Do I need a cloud account?</div>
784
814
  <div class="faq-a">No. Free keeps local enforcement on your machine with 5 daily feedback captures, 10 lesson searches, unlimited recall, gates, and hook blocking. No cloud account is required. Pro adds a personal local dashboard plus DPO export. Team is the hosted rollout lane when your group wants a shared lesson database, hosted review views, org dashboard visibility, and team-wide proof.</div>
@@ -835,7 +865,7 @@ __GA_BOOTSTRAP__
835
865
  <a href="https://www.linkedin.com/in/igorganapolsky" target="_blank" rel="noopener">LinkedIn</a>
836
866
  <a href="/blog">Blog</a>
837
867
  </div>
838
- <span class="footer-copy">© 2026 Max Smith KDP LLC · MIT License · v1.0.0</span>
868
+ <span class="footer-copy">© 2026 Max Smith KDP LLC · MIT License · v1.2.0</span>
839
869
  </div>
840
870
  </footer>
841
871
 
package/scripts/ai-search-visibility.js ADDED
@@ -0,0 +1,142 @@
1
+ 'use strict';
2
+
3
+ const https = require('node:https');
4
+ const fs = require('node:fs');
5
+ const path = require('node:path');
6
+
7
+ const PROMPTS = [
8
+ 'best pre-action gate tools for AI coding agents',
9
+ 'how to prevent AI coding agent from making mistakes',
10
+ 'Claude Code safety tools',
11
+ 'npm packages for AI agent guardrails',
12
+ 'how to block bad tool calls in AI agents',
13
+ 'alternatives to thumbgate',
14
+ 'pre-tool-use hooks for AI agents',
15
+ 'AI coding agent memory and learning',
16
+ ];
17
+
18
+ function queryPerplexity(prompt, apiKey) {
19
+ return new Promise((resolve, reject) => {
20
+ const body = JSON.stringify({
21
+ model: 'sonar',
22
+ messages: [{ role: 'user', content: prompt }],
23
+ });
24
+ const req = https.request(
25
+ {
26
+ hostname: 'api.perplexity.ai',
27
+ path: '/chat/completions',
28
+ method: 'POST',
29
+ headers: {
30
+ Authorization: `Bearer ${apiKey}`,
31
+ 'Content-Type': 'application/json',
32
+ 'Content-Length': Buffer.byteLength(body),
33
+ },
34
+ },
35
+ (res) => {
36
+ const chunks = [];
37
+ res.on('data', (c) => chunks.push(c));
38
+ res.on('end', () => {
39
+ try {
40
+ const json = JSON.parse(Buffer.concat(chunks).toString());
41
+ const content = json.choices?.[0]?.message?.content || '';
42
+ resolve(content);
43
+ } catch (e) {
44
+ reject(new Error(`Failed to parse Perplexity response: ${e.message}`));
45
+ }
46
+ });
47
+ }
48
+ );
49
+ req.on('error', reject);
50
+ req.write(body);
51
+ req.end();
52
+ });
53
+ }
54
+
55
+ async function runVisibilityCheck(opts = {}) {
56
+ const apiKey = opts.apiKey || process.env.PERPLEXITY_API_KEY;
57
+ const queryFn = opts.queryFn || (apiKey ? (p) => queryPerplexity(p, apiKey) : null);
58
+
59
+ const results = [];
60
+ for (const prompt of PROMPTS) {
61
+ if (!queryFn) {
62
+ results.push({ prompt, status: 'MANUAL', response: null });
63
+ continue;
64
+ }
65
+ try {
66
+ const response = await queryFn(prompt);
67
+ const found = /thumbgate/i.test(response);
68
+ results.push({ prompt, status: found ? 'FOUND' : 'MISSING', response });
69
+ } catch (err) {
70
+ results.push({ prompt, status: 'ERROR', response: null, error: err.message });
71
+ }
72
+ }
73
+ return results;
74
+ }
75
+
76
+ function formatReport(results) {
77
+ const date = new Date().toISOString().slice(0, 10);
78
+ const lines = [`AI Search Visibility Report — ${date}`, '='.repeat(42)];
79
+
80
+ for (const r of results) {
81
+ const tag = `[${r.status}]`.padEnd(10);
82
+ const shortPrompt =
83
+ r.prompt.length > 60 ? r.prompt.slice(0, 57) + '...' : r.prompt;
84
+ const suffix =
85
+ r.status === 'FOUND'
86
+ ? '— mentioned in response'
87
+ : r.status === 'MISSING'
88
+ ? '— not found'
89
+ : r.status === 'MANUAL'
90
+ ? '— check manually'
91
+ : `— ${r.error || 'error'}`;
92
+ lines.push(`${tag} "${shortPrompt}" ${suffix}`);
93
+ }
94
+
95
+ const hasApi = results.some((r) => r.status !== 'MANUAL');
96
+ if (hasApi) {
97
+ const found = results.filter((r) => r.status === 'FOUND').length;
98
+ const total = results.filter((r) => r.status !== 'MANUAL').length;
99
+ lines.push('', `Score: ${found}/${total} prompts mention ThumbGate`);
100
+ } else {
101
+ lines.push('', `Manual checklist: ${results.length} prompts to test`);
102
+ }
103
+ return lines.join('\n');
104
+ }
105
+
106
+ function saveReport(results, opts = {}) {
107
+ const date = new Date().toISOString().slice(0, 10);
108
+ const dir = opts.dir || path.join(process.cwd(), '.thumbgate', 'ai-visibility');
109
+ if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
110
+
111
+ const filePath = path.join(dir, `${date}.json`);
112
+ const found = results.filter((r) => r.status === 'FOUND').length;
113
+ const total = results.filter((r) => r.status !== 'MANUAL').length;
114
+
115
+ const report = {
116
+ date,
117
+ score: total > 0 ? `${found}/${total}` : 'manual',
118
+ results: results.map((r) => ({
119
+ prompt: r.prompt,
120
+ status: r.status,
121
+ ...(r.error ? { error: r.error } : {}),
122
+ })),
123
+ };
124
+
125
+ fs.writeFileSync(filePath, JSON.stringify(report, null, 2));
126
+ return filePath;
127
+ }
128
+
129
+ module.exports = { PROMPTS, queryPerplexity, runVisibilityCheck, formatReport, saveReport };
130
+
131
+ if (require.main === module) {
132
+ (async () => {
133
+ const results = await runVisibilityCheck();
134
+ const report = formatReport(results);
135
+ console.log(report);
136
+ const filePath = saveReport(results);
137
+ console.log(`\nReport saved to ${filePath}`);
138
+ })().catch((err) => {
139
+ console.error('Error:', err.message);
140
+ process.exit(1);
141
+ });
142
+ }