thumbgate 1.1.0 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (35) hide show
  1. package/.claude-plugin/marketplace.json +1 -1
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/.well-known/mcp/server-card.json +1 -1
  4. package/README.md +16 -5
  5. package/adapters/README.md +1 -1
  6. package/adapters/claude/.mcp.json +2 -2
  7. package/adapters/codex/config.toml +2 -2
  8. package/adapters/mcp/server-stdio.js +10 -7
  9. package/adapters/opencode/opencode.json +1 -1
  10. package/config/github-about.json +1 -1
  11. package/package.json +20 -11
  12. package/plugins/claude-codex-bridge/.claude-plugin/plugin.json +1 -1
  13. package/plugins/claude-codex-bridge/.mcp.json +1 -1
  14. package/plugins/codex-profile/.codex-plugin/plugin.json +1 -1
  15. package/plugins/codex-profile/.mcp.json +1 -1
  16. package/plugins/codex-profile/INSTALL.md +1 -1
  17. package/plugins/codex-profile/README.md +1 -1
  18. package/plugins/cursor-marketplace/.cursor-plugin/plugin.json +1 -1
  19. package/plugins/opencode-profile/INSTALL.md +1 -1
  20. package/public/compare.html +302 -0
  21. package/public/index.html +36 -10
  22. package/scripts/__pycache__/train_from_feedback.cpython-312.pyc +0 -0
  23. package/scripts/ai-search-visibility.js +142 -0
  24. package/scripts/changeset-check.js +372 -0
  25. package/scripts/check-congruence.js +7 -4
  26. package/scripts/computer-use-firewall.js +45 -15
  27. package/scripts/docker-sandbox-planner.js +208 -0
  28. package/scripts/github-about.js +56 -0
  29. package/scripts/operational-integrity.js +7 -1
  30. package/scripts/published-cli.js +10 -1
  31. package/scripts/statusline-links.js +238 -0
  32. package/scripts/statusline.sh +39 -4
  33. package/scripts/sync-github-about.js +7 -4
  34. package/scripts/workflow-sentinel.js +83 -35
  35. package/src/api/server.js +12 -1
package/public/compare.html ADDED
@@ -0,0 +1,302 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)</title>
7
+ <!-- Privacy-friendly analytics by Plausible -->
8
+ <script defer data-domain="rlhf-feedback-loop-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
9
+ <meta name="description" content="Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes.">
10
+ <meta name="keywords" content="AI agent safety, pre-action gates, AI coding agent comparison, ThumbGate vs manual review, AI agent guardrails, PreToolUse hooks, Claude Code safety, Codex safety, Gemini safety, Cursor rules alternative">
11
+ <meta property="og:title" content="Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)">
12
+ <meta property="og:description" content="Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes.">
13
+ <meta property="og:type" content="article">
14
+ <meta property="og:url" content="https://thumbgate-production.up.railway.app/compare">
15
+ <link rel="canonical" href="https://thumbgate-production.up.railway.app/compare">
16
+
17
+ <script type="application/ld+json">
18
+ {
19
+ "@context": "https://schema.org",
20
+ "@type": "TechArticle",
21
+ "headline": "Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)",
22
+ "description": "Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes vs Cursor rules vs linters.",
23
+ "author": {
24
+ "@type": "Person",
25
+ "name": "Igor Ganapolsky",
26
+ "url": "https://github.com/IgorGanapolsky"
27
+ },
28
+ "publisher": {
29
+ "@type": "Organization",
30
+ "name": "ThumbGate",
31
+ "url": "https://thumbgate-production.up.railway.app"
32
+ },
33
+ "datePublished": "2026-04-08",
34
+ "dateModified": "2026-04-08",
35
+ "mainEntityOfPage": "https://thumbgate-production.up.railway.app/compare"
36
+ }
37
+ </script>
38
+
39
+ <script type="application/ld+json">
40
+ {
41
+ "@context": "https://schema.org",
42
+ "@type": "FAQPage",
43
+ "mainEntity": [
44
+ {
45
+ "@type": "Question",
46
+ "name": "What is a pre-action gate for AI coding agents?",
47
+ "acceptedAnswer": {
48
+ "@type": "Answer",
49
+ "text": "A pre-action gate is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action gates physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests. ThumbGate implements pre-action gates via PreToolUse hooks that fire before every tool call."
50
+ }
51
+ },
52
+ {
53
+ "@type": "Question",
54
+ "name": "Does ThumbGate work with Claude Code?",
55
+ "acceptedAnswer": {
56
+ "@type": "Answer",
57
+ "text": "Yes. ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent. Run npx thumbgate init --agent claude-code to auto-configure PreToolUse hooks in your .claude/settings.json."
58
+ }
59
+ },
60
+ {
61
+ "@type": "Question",
62
+ "name": "Is ThumbGate free?",
63
+ "acceptedAnswer": {
64
+ "@type": "Answer",
65
+ "text": "ThumbGate has a free tier that includes local enforcement with 5 daily feedback captures, 10 lesson searches, unlimited recall, blocking, and history-aware lesson distillation. Pro ($19/mo or $149/yr) adds a personal local dashboard and DPO export. Team rollout ($12/seat/mo) adds a shared lesson database and org dashboard."
66
+ }
67
+ },
68
+ {
69
+ "@type": "Question",
70
+ "name": "How is ThumbGate different from .cursorrules or CLAUDE.md rules?",
71
+ "acceptedAnswer": {
72
+ "@type": "Answer",
73
+ "text": "Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is physically blocked before execution. Additionally, ThumbGate auto-generates prevention rules from feedback, so you never have to write rules manually."
74
+ }
75
+ },
76
+ {
77
+ "@type": "Question",
78
+ "name": "Can ThumbGate learn from mistakes automatically?",
79
+ "acceptedAnswer": {
80
+ "@type": "Answer",
81
+ "text": "Yes. When your AI agent makes a mistake, you give a thumbs-down with context. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule and wires it as a pre-action gate. Gates adapt their sensitivity over time using Thompson Sampling, a Bayesian multi-armed bandit algorithm."
82
+ }
83
+ }
84
+ ]
85
+ }
86
+ </script>
87
+
88
+ <style>
89
+ *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
90
+ :root {
91
+ --bg: #0a0a0b;
92
+ --bg-card: #161618;
93
+ --border: #222225;
94
+ --text: #e8e8ec;
95
+ --muted: #8b8b94;
96
+ --cyan: #22d3ee;
97
+ --green: #34d399;
98
+ --red: #f87171;
99
+ }
100
+ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.7; }
101
+ .container { max-width: 780px; margin: 0 auto; padding: 2rem 1.5rem 4rem; }
102
+ nav { padding: 1rem 2rem; border-bottom: 1px solid var(--border); display: flex; gap: 1.5rem; align-items: center; }
103
+ nav a { color: var(--muted); text-decoration: none; font-size: 0.9rem; }
104
+ nav a:hover { color: var(--cyan); }
105
+ nav .brand { color: var(--text); font-weight: 700; font-size: 1.1rem; }
106
+ h1 { font-size: 2.2rem; line-height: 1.2; margin: 2rem 0 1rem; }
107
+ h2 { font-size: 1.5rem; margin: 2.5rem 0 1rem; color: var(--cyan); }
108
+ h3 { font-size: 1.15rem; margin: 1.5rem 0 0.5rem; }
109
+ p, li { color: var(--text); margin-bottom: 0.75rem; }
110
+ ul { padding-left: 1.5rem; }
111
+ li { margin-bottom: 0.5rem; }
112
+ code { background: #1a1a1e; padding: 0.15em 0.4em; border-radius: 4px; font-size: 0.9em; color: var(--cyan); }
113
+ pre { background: #111113; border: 1px solid var(--border); border-radius: 8px; padding: 1rem; overflow-x: auto; margin: 1rem 0; }
114
+ pre code { background: none; padding: 0; color: var(--text); }
115
+ .highlight { color: var(--cyan); }
116
+ .card { background: var(--bg-card); border: 1px solid var(--border); border-radius: 12px; padding: 1.5rem; margin: 1.5rem 0; }
117
+ .comparison-table { width: 100%; border-collapse: collapse; margin: 1.5rem 0; font-size: 0.9rem; }
118
+ .comparison-table th, .comparison-table td { padding: 0.75rem; border: 1px solid var(--border); text-align: left; }
119
+ .comparison-table th { background: #111113; color: var(--cyan); }
120
+ .comparison-table td:first-child { font-weight: 600; }
121
+ .yes { color: var(--green); }
122
+ .no { color: var(--red); }
123
+ .partial { color: #fbbf24; }
124
+ .cta { display: inline-block; background: var(--cyan); color: #000; padding: 0.75rem 1.5rem; border-radius: 8px; text-decoration: none; font-weight: 600; margin: 1rem 0; }
125
+ .cta:hover { opacity: 0.9; }
126
+ .breadcrumb { color: var(--muted); font-size: 0.85rem; margin-bottom: 0.5rem; }
127
+ .breadcrumb a { color: var(--muted); }
128
+ .step-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 1rem; margin: 1.5rem 0; }
129
+ .step-card { background: var(--bg-card); border: 1px solid var(--border); border-radius: 12px; padding: 1.25rem; }
130
+ .step-card .step-number { color: var(--cyan); font-weight: 700; font-size: 1.5rem; margin-bottom: 0.5rem; }
131
+ .step-card h3 { margin-top: 0; }
132
+ footer { border-top: 1px solid var(--border); padding: 2rem; text-align: center; color: var(--muted); font-size: 0.85rem; }
133
+ footer a { color: var(--muted); text-decoration: underline; }
134
+ @media (max-width: 600px) { h1 { font-size: 1.6rem; } .container { padding: 1rem; } .comparison-table { font-size: 0.8rem; } .comparison-table th, .comparison-table td { padding: 0.5rem; } }
135
+ </style>
136
+ </head>
137
+ <body>
138
+ <nav>
139
+ <a href="/" class="brand">ThumbGate</a>
140
+ <a href="/guide">Guide</a>
141
+ <a href="/compare">Compare</a>
142
+ <a href="/dashboard">Dashboard</a>
143
+ <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a>
144
+ </nav>
145
+
146
+ <div class="container">
147
+ <p class="breadcrumb"><a href="/">Home</a> / Compare</p>
148
+
149
+ <h1>Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)</h1>
150
+ <p style="color:var(--muted);">Your AI coding agent force-pushed to main again. Which tool actually prevents that? We compared the five most common approaches to AI agent safety.</p>
151
+
152
+ <h2>Comparison Table</h2>
153
+ <div style="overflow-x:auto;">
154
+ <table class="comparison-table">
155
+ <tr>
156
+ <th>Feature</th>
157
+ <th>ThumbGate</th>
158
+ <th>Manual Code Review</th>
159
+ <th>Post-hoc Git Revert</th>
160
+ <th>Cursor Rules / .cursorrules</th>
161
+ <th>ESLint / Linters</th>
162
+ </tr>
163
+ <tr>
164
+ <td>Blocks bad actions before execution</td>
165
+ <td class="yes">Yes -- PreToolUse hooks</td>
166
+ <td class="partial">Partially -- after PR only</td>
167
+ <td class="no">No -- damage already done</td>
168
+ <td class="partial">Partially -- suggestions only</td>
169
+ <td class="partial">Partially -- static checks only</td>
170
+ </tr>
171
+ <tr>
172
+ <td>Learns from past mistakes</td>
173
+ <td class="yes">Yes -- auto-generates rules from feedback</td>
174
+ <td class="no">No -- relies on reviewer memory</td>
175
+ <td class="no">No</td>
176
+ <td class="no">No -- rules are hand-written</td>
177
+ <td class="no">No -- rules are hand-written</td>
178
+ </tr>
179
+ <tr>
180
+ <td>Works with Claude / Codex / Gemini / Forge</td>
181
+ <td class="yes">Yes -- all MCP-compatible agents</td>
182
+ <td class="yes">Yes -- agent-agnostic</td>
183
+ <td class="yes">Yes -- agent-agnostic</td>
184
+ <td class="partial">Cursor only</td>
185
+ <td class="partial">Partial -- code-level only</td>
186
+ </tr>
187
+ <tr>
188
+ <td>Zero config setup</td>
189
+ <td class="yes">Yes -- <code>npx thumbgate init</code></td>
190
+ <td class="no">No -- requires process + people</td>
191
+ <td class="no">No -- manual intervention each time</td>
192
+ <td class="partial">Partial -- requires writing rules</td>
193
+ <td class="partial">Partial -- requires config + plugins</td>
194
+ </tr>
195
+ <tr>
196
+ <td>Captures feedback for improvement</td>
197
+ <td class="yes">Yes -- thumbs up/down with context</td>
198
+ <td class="partial">Partial -- PR comments only</td>
199
+ <td class="no">No</td>
200
+ <td class="no">No</td>
201
+ <td class="no">No</td>
202
+ </tr>
203
+ <tr>
204
+ <td>Generates prevention rules automatically</td>
205
+ <td class="yes">Yes -- from repeated failure patterns</td>
206
+ <td class="no">No</td>
207
+ <td class="no">No</td>
208
+ <td class="no">No</td>
209
+ <td class="no">No</td>
210
+ </tr>
211
+ <tr>
212
+ <td>Real-time pre-action gates</td>
213
+ <td class="yes">Yes -- fires before every tool call</td>
214
+ <td class="no">No -- asynchronous review</td>
215
+ <td class="no">No -- reactive only</td>
216
+ <td class="no">No -- prompt-time only</td>
217
+ <td class="no">No -- build-time only</td>
218
+ </tr>
219
+ <tr>
220
+ <td>Cost</td>
221
+ <td>Free tier + Pro $19/mo</td>
222
+ <td>Engineer time per review</td>
223
+ <td>Time lost + recovery cost</td>
224
+ <td>Free</td>
225
+ <td>Free (open source)</td>
226
+ </tr>
227
+ </table>
228
+ </div>
229
+
230
+ <h2>Why ThumbGate Wins</h2>
231
+ <ul>
232
+ <li><strong>Enforcement, not suggestions.</strong> Prompt rules in CLAUDE.md or .cursorrules are instructions the agent can ignore. ThumbGate intercepts tool calls at the PreToolUse hook level and physically blocks dangerous actions before they execute.</li>
233
+ <li><strong>Learns and adapts automatically.</strong> Every thumbs-down becomes a data point. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule. Gates adapt their sensitivity over time using Thompson Sampling -- aggressive gates that over-block get tuned down, effective gates get reinforced.</li>
234
+ <li><strong>Works across all major AI coding agents.</strong> One install command covers Claude Code, Cursor, Codex, Gemini CLI, Amp, and OpenCode. No per-agent configuration needed.</li>
235
+ <li><strong>Prevention is cheaper than recovery.</strong> Manual code review catches mistakes after the PR. Git revert catches them after the push. ThumbGate catches them before the tool call executes -- saving the time, context switches, and cleanup cost of undoing damage.</li>
236
+ </ul>
237
+
238
+ <h2>How It Works</h2>
239
+ <div class="step-grid">
240
+ <div class="step-card">
241
+ <div class="step-number">1</div>
242
+ <h3>Install</h3>
243
+ <p>Run <code>npx thumbgate init</code>. ThumbGate auto-detects your AI coding agent and configures PreToolUse hooks. No manual setup needed.</p>
244
+ </div>
245
+ <div class="step-card">
246
+ <div class="step-number">2</div>
247
+ <h3>Gate</h3>
248
+ <p>Every tool call your agent makes passes through a pre-action gate. Known-bad patterns are blocked before execution. Good actions pass through instantly.</p>
249
+ </div>
250
+ <div class="step-card">
251
+ <div class="step-number">3</div>
252
+ <h3>Learn</h3>
253
+ <p>When your agent makes a mistake, give it a thumbs-down. ThumbGate captures the feedback and auto-generates prevention rules from repeated failures.</p>
254
+ </div>
255
+ </div>
256
+
257
+ <h2>Get Started</h2>
258
+ <div class="card">
259
+ <p>Install ThumbGate in one command:</p>
260
+ <pre><code>npx thumbgate init</code></pre>
261
+ <p>Then start giving feedback. ThumbGate handles the rest.</p>
262
+ <p>
263
+ <a href="https://www.npmjs.com/package/thumbgate" class="cta">View on npm</a>
264
+ <a href="https://github.com/IgorGanapolsky/ThumbGate" style="color:var(--cyan); margin-left:1.5rem; text-decoration:underline;">View on GitHub</a>
265
+ </p>
266
+ </div>
267
+
268
+ <h2>Frequently Asked Questions</h2>
269
+
270
+ <div class="card">
271
+ <h3>What is a pre-action gate?</h3>
272
+ <p>A pre-action gate is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action gates physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests.</p>
273
+ </div>
274
+
275
+ <div class="card">
276
+ <h3>Does ThumbGate work with Claude Code?</h3>
277
+ <p>Yes. ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent. Run <code>npx thumbgate init --agent claude-code</code> to auto-configure PreToolUse hooks.</p>
278
+ </div>
279
+
280
+ <div class="card">
281
+ <h3>Is ThumbGate free?</h3>
282
+ <p>ThumbGate has a free tier that includes local enforcement with 5 daily feedback captures, 10 lesson searches, unlimited recall, and pre-action gate blocking. Pro ($19/mo or $149/yr) adds a personal local dashboard and DPO export. Team rollout ($12/seat/mo) adds a shared lesson database and org dashboard.</p>
283
+ </div>
284
+
285
+ <div class="card">
286
+ <h3>How is ThumbGate different from .cursorrules or CLAUDE.md rules?</h3>
287
+ <p>Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is physically blocked before execution. Additionally, ThumbGate auto-generates prevention rules from feedback -- no manual rule writing.</p>
288
+ </div>
289
+
290
+ <div class="card">
291
+ <h3>Can ThumbGate learn from mistakes automatically?</h3>
292
+ <p>Yes. When your AI agent makes a mistake, give a thumbs-down with context. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule and wires it as a pre-action gate. Gates adapt over time using Thompson Sampling, a Bayesian multi-armed bandit algorithm.</p>
293
+ </div>
294
+
295
+ </div>
296
+
297
+ <footer>
298
+ <p>ThumbGate -- Pre-action gates for AI coding agents</p>
299
+ <p><a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> | <a href="https://www.npmjs.com/package/thumbgate">npm</a> | <a href="/guide">Guide</a> | <a href="/dashboard">Dashboard</a></p>
300
+ </footer>
301
+ </body>
302
+ </html>
package/public/index.html CHANGED
@@ -20,9 +20,9 @@
20
20
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
21
21
  __GOOGLE_SITE_VERIFICATION_META__
22
22
  <title>ThumbGate — Self-improving AI coding agents that learn from every mistake</title>
23
- <meta name="description" content="Pre-action gates for AI coding agents. 👎 Thumbs down → prevention rule → mistake permanently blocked. 👍 Thumbs up → pattern reinforced. History-aware lessons from your corrections. Team adds shared lessons and org visibility.">
23
+ <meta name="description" content="Pre-action gates and workflow governance for AI coding agents. 👎 Thumbs down → prevention rule → mistake permanently blocked. 👍 Thumbs up → pattern reinforced. History-aware lessons from your corrections. Risky local runs can route into Docker Sandboxes. Team adds shared lessons and org visibility, plus isolated execution guidance.">
24
24
  <meta property="og:title" content="ThumbGate — Self-improving AI coding agents that learn from every mistake">
25
- <meta property="og:description" content="Pre-action gates for AI coding agents. 👎 Thumbs down → prevention rule → mistake permanently blocked. 👍 Thumbs up → pattern reinforced. History-aware lessons from your corrections. Team adds shared lessons and org visibility.">
25
+ <meta property="og:description" content="Pre-action gates and workflow governance for AI coding agents. 👎 Thumbs down → prevention rule → mistake permanently blocked. 👍 Thumbs up → pattern reinforced. History-aware lessons from your corrections. Risky local runs can route into Docker Sandboxes. Team adds shared lessons and org visibility, plus isolated execution guidance.">
26
26
  <meta property="og:type" content="website">
27
27
  <meta name="keywords" content="ThumbGate, thumbgate, self-improving AI agents, AI agent self-improvement, AI agent learning, AI agent memory, pre-action gates, human-in-the-loop, MCP server, Claude Code, Cursor, Codex, Gemini, Amp, OpenCode, vibe coding safety, SpecLock alternative, Mem0 alternative, AI coding agent feedback loop, PreToolUse hooks, prevention rules, feedback enforcement, context engineering">
28
28
 
@@ -44,7 +44,7 @@ __GA_BOOTSTRAP__
44
44
  "@type": "SoftwareApplication",
45
45
  "name": "ThumbGate",
46
46
  "alternateName": "thumbgate",
47
- "description": "Make your AI coding agent self-improving. Every mistake becomes a prevention rule. Every correction makes it permanently smarter. Turns feedback into enforcement — your agent gets better with every session.",
47
+ "description": "Make your AI coding agent self-improving. Every mistake becomes a prevention rule. Every correction makes it permanently smarter. ThumbGate adds workflow governance and isolated execution guidance so high-risk runs do not have to happen directly on the host.",
48
48
  "applicationCategory": "DeveloperApplication",
49
49
  "operatingSystem": "Cross-platform, Node.js >=18.18.0",
50
50
  "license": "https://opensource.org/licenses/MIT",
@@ -59,6 +59,9 @@ __GA_BOOTSTRAP__
59
59
  },
60
60
  "featureList": [
61
61
  "Pre-Action Gates — block known-bad tool calls before execution",
62
+ "Workflow Sentinel — score blast radius before PR, merge, release, and publish actions fire",
63
+ "Docker Sandboxes routing — move high-risk local runs into isolated microVM-backed execution",
64
+ "Hosted sandbox dispatch — signed isolated lane for team automations",
62
65
  "Domain Skill Packs — Stripe, Railway, database migration best practices",
63
66
  "Progressive Disclosure — 82% token savings with 3-tier L1/L2/L3 loading",
64
67
  "Hallucination Detection — decomposes claims into verifiable sub-claims",
@@ -97,7 +100,7 @@ __GA_BOOTSTRAP__
97
100
  {
98
101
  "@type": "Offer",
99
102
  "name": "Team",
100
- "description": "Shared enforcement memory, review visibility, org dashboard, and pilot rollout support for teams shipping AI-generated changes",
103
+ "description": "Shared enforcement memory, review visibility, org dashboard, Docker Sandboxes guidance for risky local autonomy, and pilot rollout support for teams shipping AI-generated changes",
101
104
  "url": "https://thumbgate-production.up.railway.app/#workflow-sprint-intake"
102
105
  }
103
106
  ]
@@ -178,6 +181,14 @@ __GA_BOOTSTRAP__
178
181
  "text": "Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent."
179
182
  }
180
183
  },
184
+ {
185
+ "@type": "Question",
186
+ "name": "How does ThumbGate reduce host blast radius for high-risk local runs?",
187
+ "acceptedAnswer": {
188
+ "@type": "Answer",
189
+ "text": "ThumbGate combines pre-action gates with execution guidance. Workflow Sentinel predicts risky local actions before they execute, and high-risk runs can be routed into Docker Sandboxes instead of running directly on the host. Team workflows also have a signed hosted sandbox lane for isolated automation dispatch."
190
+ }
191
+ },
181
192
  {
182
193
  "@type": "Question",
183
194
  "name": "How are pre-action gates different from prompt rules?",
@@ -419,6 +430,7 @@ __GA_BOOTSTRAP__
419
430
  <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
420
431
  <a href="/guide">Setup Guide</a>
421
432
  <a href="/learn">Learn</a>
433
+ <a href="/compare">Compare</a>
422
434
  <a href="/dashboard">Dashboard Demo</a>
423
435
  <a href="/pro?utm_source=website&utm_medium=homepage_nav&utm_campaign=pro_page" class="nav-cta">See Pro</a>
424
436
  </div>
@@ -429,19 +441,19 @@ __GA_BOOTSTRAP__
429
441
  <section class="hero">
430
442
  <div class="container">
431
443
  <div class="hero-thumbs">👍👎</div>
432
- <div class="hero-badge">● Self-improving AI agents — every mistake makes it smarter</div>
444
+ <div class="hero-badge">● Self-improving AI agents with workflow governance and isolated execution</div>
433
445
  <h1>Your AI agent learns<br>from every mistake.</h1>
434
446
  <div class="hero-signals">
435
447
  <div class="signal-pill signal-down">👎 Mistake becomes a prevention rule — permanently blocked</div>
436
448
  <div class="signal-pill signal-up">👍 Good pattern reinforced — reused across sessions</div>
437
449
  </div>
438
- <p class="hero-persona">For developers using Claude Code, Cursor, Codex, Gemini, Amp, and OpenCode who want their AI agent to actually get better over time — not repeat the same mistakes every session.</p>
439
- <p><strong>The self-improvement loop:</strong> Your agent makes a mistake → you give a thumbs-down → ThumbGate auto-generates a prevention rule → a gate physically blocks that mistake from ever happening again. Your agent gets permanently smarter with every correction. No model retraining. No prompt hacking. Just enforcement that compounds.</p>
450
+ <p class="hero-persona">For developers using Claude Code, Cursor, Codex, Gemini, Amp, and OpenCode who want their AI agent to actually get better over time — and for teams that need the riskiest runs governed before they touch shared repos or the host machine.</p>
451
+ <p><strong>The self-improvement loop:</strong> Your agent makes a mistake → you give a thumbs-down → ThumbGate auto-generates a prevention rule → a gate physically blocks that mistake from ever happening again. Your agent gets permanently smarter with every correction. No model retraining. No prompt hacking. Just enforcement that compounds, plus isolated execution guidance when autonomy gets risky.</p>
440
452
  <div class="hero-actions">
441
453
  <a href="/pro?utm_source=website&utm_medium=homepage_hero&utm_campaign=pro_page" class="btn-pro-page">See Pro for individual operators</a>
442
454
  <a href="/dashboard?utm_source=website&utm_medium=homepage_hero&utm_campaign=demo" class="btn-demo-link">Open dashboard demo</a>
443
455
  </div>
444
- <p class="hero-paid-note"><strong>Paid path:</strong> Free stays the local install lane. Pro is the buyer-ready page for your personal local dashboard, DPO export, and review-ready evidence.</p>
456
+ <p class="hero-paid-note"><strong>Paid path:</strong> Free stays the local install lane. Pro is the buyer-ready page for your personal local dashboard, DPO export, and review-ready evidence. Team adds shared workflow governance, org proof, and isolated execution guidance for high-risk runs.</p>
445
457
  <div class="hero-install" onclick="copyInstall(this)" title="Click to copy">
446
458
  <span class="prompt">$</span>
447
459
  <span class="cmd">npx thumbgate init</span>
@@ -508,6 +520,10 @@ __GA_BOOTSTRAP__
508
520
  <h3>📊 Org Dashboard (Pro)</h3>
509
521
  <p>See which agents are creating review churn, which gates are saving time, and where rollout risk is still concentrated.</p>
510
522
  </div>
523
+ <div class="agent-card">
524
+ <h3>🧱 Isolated Execution Lanes</h3>
525
+ <p>High-risk local autonomy can route into Docker Sandboxes, while hosted team automations use a signed sandbox dispatch lane instead of running loose on a shared host.</p>
526
+ </div>
511
527
  <div class="agent-card">
512
528
  <h3>🧪 Thompson Sampling</h3>
513
529
  <p>Confidence tiers (none/low/medium/high) tell you when to trust the model vs fall back to rules. No guessing.</p>
@@ -580,7 +596,7 @@ __GA_BOOTSTRAP__
580
596
  <!-- HOW IT WORKS -->
581
597
  <section class="how-it-works" id="how-it-works">
582
598
  <div class="container">
583
- <div class="section-label">New in v1.1.0</div>
599
+ <div class="section-label">New in v1.2.0</div>
584
600
  <h2 class="section-title">Three steps to stop repeated AI failures</h2>
585
601
  <div class="steps">
586
602
  <div class="step">
@@ -625,6 +641,10 @@ __GA_BOOTSTRAP__
625
641
  <h3>Log everything, learn automatically</h3>
626
642
  <p>Repeated failures auto-promote to gates. Org dashboard shows all agents.</p>
627
643
  </div>
644
+ <div class="agent-card">
645
+ <h3>Keep risky runs off the host</h3>
646
+ <p>When Workflow Sentinel predicts a risky local action, ThumbGate can recommend Docker Sandboxes before the agent touches the host filesystem or broader credentials.</p>
647
+ </div>
628
648
  </div>
629
649
  </div>
630
650
  </section>
@@ -728,6 +748,8 @@ __GA_BOOTSTRAP__
728
748
  <li>Org dashboard — active agents, gate hit rates, risk agents, and proof-backed team metrics in one place</li>
729
749
  <li>Hosted review views — constrained cards, lists, and callouts for rollout, incident, and audit visibility</li>
730
750
  <li>Gate template library — pre-built guardrails for force-pushes, skipped tests, destructive SQL, and evidence-before-done</li>
751
+ <li>Docker Sandboxes guidance — route risky local autonomy into an isolated microVM-backed lane instead of running it directly on a shared host</li>
752
+ <li>Signed hosted sandbox dispatch — isolated execution path for team automations that do not need repo-bound local access</li>
731
753
  <li>Workflow proof sprint — pilot one painful workflow first, then expand once the before/after evidence is real</li>
732
754
  <li>Rollout attribution stays tied to the team funnel instead of disappearing into generic referral traffic</li>
733
755
  </ul>
@@ -783,6 +805,10 @@ __GA_BOOTSTRAP__
783
805
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">What AI agents and editors does this work with?</div>
784
806
  <div class="faq-a">ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any other MCP-compatible agent. Cursor ships with a plugin bundle in this repo. Codex ships with a repo-local app plugin profile. VS Code works when you run an MCP-compatible agent inside it, but this repo does not ship a standalone VS Code extension today.</div>
785
807
  </div>
808
+ <div class="faq-item">
809
+ <button class="faq-q" type="button" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">How do we keep high-risk autonomous runs off the host?</button>
810
+ <div class="faq-a">ThumbGate is the control plane, not just a prompt layer. Workflow Sentinel predicts blast radius before execution, and risky local autonomy can be routed into Docker Sandboxes instead of running directly on the host. Team workflows also have a signed hosted sandbox lane for isolated dispatch when local repo access is not required.</div>
811
+ </div>
786
812
  <div class="faq-item">
787
813
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">Do I need a cloud account?</div>
788
814
  <div class="faq-a">No. Free keeps local enforcement on your machine with 5 daily feedback captures, 10 lesson searches, unlimited recall, gates, and hook blocking. No cloud account is required. Pro adds a personal local dashboard plus DPO export. Team is the hosted rollout lane when your group wants a shared lesson database, hosted review views, org dashboard visibility, and team-wide proof.</div>
@@ -839,7 +865,7 @@ __GA_BOOTSTRAP__
839
865
  <a href="https://www.linkedin.com/in/igorganapolsky" target="_blank" rel="noopener">LinkedIn</a>
840
866
  <a href="/blog">Blog</a>
841
867
  </div>
842
- <span class="footer-copy">© 2026 Max Smith KDP LLC · MIT License · v1.1.0</span>
868
+ <span class="footer-copy">© 2026 Max Smith KDP LLC · MIT License · v1.2.0</span>
843
869
  </div>
844
870
  </footer>
845
871
 
package/scripts/ai-search-visibility.js ADDED
@@ -0,0 +1,142 @@
1
+ 'use strict';
2
+
3
+ const https = require('node:https');
4
+ const fs = require('node:fs');
5
+ const path = require('node:path');
6
+
7
+ const PROMPTS = [
8
+ 'best pre-action gate tools for AI coding agents',
9
+ 'how to prevent AI coding agent from making mistakes',
10
+ 'Claude Code safety tools',
11
+ 'npm packages for AI agent guardrails',
12
+ 'how to block bad tool calls in AI agents',
13
+ 'alternatives to thumbgate',
14
+ 'pre-tool-use hooks for AI agents',
15
+ 'AI coding agent memory and learning',
16
+ ];
17
+
18
+ function queryPerplexity(prompt, apiKey) {
19
+ return new Promise((resolve, reject) => {
20
+ const body = JSON.stringify({
21
+ model: 'sonar',
22
+ messages: [{ role: 'user', content: prompt }],
23
+ });
24
+ const req = https.request(
25
+ {
26
+ hostname: 'api.perplexity.ai',
27
+ path: '/chat/completions',
28
+ method: 'POST',
29
+ headers: {
30
+ Authorization: `Bearer ${apiKey}`,
31
+ 'Content-Type': 'application/json',
32
+ 'Content-Length': Buffer.byteLength(body),
33
+ },
34
+ },
35
+ (res) => {
36
+ const chunks = [];
37
+ res.on('data', (c) => chunks.push(c));
38
+ res.on('end', () => {
39
+ try {
40
+ const json = JSON.parse(Buffer.concat(chunks).toString());
41
+ const content = json.choices?.[0]?.message?.content || '';
42
+ resolve(content);
43
+ } catch (e) {
44
+ reject(new Error(`Failed to parse Perplexity response: ${e.message}`));
45
+ }
46
+ });
47
+ }
48
+ );
49
+ req.on('error', reject);
50
+ req.write(body);
51
+ req.end();
52
+ });
53
+ }
54
+
55
+ async function runVisibilityCheck(opts = {}) {
56
+ const apiKey = opts.apiKey || process.env.PERPLEXITY_API_KEY;
57
+ const queryFn = opts.queryFn || (apiKey ? (p) => queryPerplexity(p, apiKey) : null);
58
+
59
+ const results = [];
60
+ for (const prompt of PROMPTS) {
61
+ if (!queryFn) {
62
+ results.push({ prompt, status: 'MANUAL', response: null });
63
+ continue;
64
+ }
65
+ try {
66
+ const response = await queryFn(prompt);
67
+ const found = /thumbgate/i.test(response);
68
+ results.push({ prompt, status: found ? 'FOUND' : 'MISSING', response });
69
+ } catch (err) {
70
+ results.push({ prompt, status: 'ERROR', response: null, error: err.message });
71
+ }
72
+ }
73
+ return results;
74
+ }
75
+
76
+ function formatReport(results) {
77
+ const date = new Date().toISOString().slice(0, 10);
78
+ const lines = [`AI Search Visibility Report — ${date}`, '='.repeat(42)];
79
+
80
+ for (const r of results) {
81
+ const tag = `[${r.status}]`.padEnd(10);
82
+ const shortPrompt =
83
+ r.prompt.length > 60 ? r.prompt.slice(0, 57) + '...' : r.prompt;
84
+ const suffix =
85
+ r.status === 'FOUND'
86
+ ? '— mentioned in response'
87
+ : r.status === 'MISSING'
88
+ ? '— not found'
89
+ : r.status === 'MANUAL'
90
+ ? '— check manually'
91
+ : `— ${r.error || 'error'}`;
92
+ lines.push(`${tag} "${shortPrompt}" ${suffix}`);
93
+ }
94
+
95
+ const hasApi = results.some((r) => r.status !== 'MANUAL');
96
+ if (hasApi) {
97
+ const found = results.filter((r) => r.status === 'FOUND').length;
98
+ const total = results.filter((r) => r.status !== 'MANUAL').length;
99
+ lines.push('', `Score: ${found}/${total} prompts mention ThumbGate`);
100
+ } else {
101
+ lines.push('', `Manual checklist: ${results.length} prompts to test`);
102
+ }
103
+ return lines.join('\n');
104
+ }
105
+
106
+ function saveReport(results, opts = {}) {
107
+ const date = new Date().toISOString().slice(0, 10);
108
+ const dir = opts.dir || path.join(process.cwd(), '.thumbgate', 'ai-visibility');
109
+ if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
110
+
111
+ const filePath = path.join(dir, `${date}.json`);
112
+ const found = results.filter((r) => r.status === 'FOUND').length;
113
+ const total = results.filter((r) => r.status !== 'MANUAL').length;
114
+
115
+ const report = {
116
+ date,
117
+ score: total > 0 ? `${found}/${total}` : 'manual',
118
+ results: results.map((r) => ({
119
+ prompt: r.prompt,
120
+ status: r.status,
121
+ ...(r.error ? { error: r.error } : {}),
122
+ })),
123
+ };
124
+
125
+ fs.writeFileSync(filePath, JSON.stringify(report, null, 2));
126
+ return filePath;
127
+ }
128
+
129
+ module.exports = { PROMPTS, queryPerplexity, runVisibilityCheck, formatReport, saveReport };
130
+
131
+ if (require.main === module) {
132
+ (async () => {
133
+ const results = await runVisibilityCheck();
134
+ const report = formatReport(results);
135
+ console.log(report);
136
+ const filePath = saveReport(results);
137
+ console.log(`\nReport saved to ${filePath}`);
138
+ })().catch((err) => {
139
+ console.error('Error:', err.message);
140
+ process.exit(1);
141
+ });
142
+ }