thumbgate 1.1.0 โ†’ 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. package/.claude-plugin/README.md +4 -4
  2. package/.claude-plugin/marketplace.json +1 -1
  3. package/.claude-plugin/plugin.json +1 -1
  4. package/.well-known/mcp/server-card.json +1 -1
  5. package/README.md +48 -16
  6. package/adapters/README.md +1 -1
  7. package/adapters/claude/.mcp.json +2 -2
  8. package/adapters/codex/config.toml +2 -2
  9. package/adapters/mcp/server-stdio.js +11 -8
  10. package/adapters/opencode/opencode.json +1 -1
  11. package/bin/cli.js +20 -11
  12. package/config/github-about.json +1 -1
  13. package/config/model-tiers.json +11 -0
  14. package/package.json +22 -11
  15. package/plugins/claude-codex-bridge/.claude-plugin/plugin.json +1 -1
  16. package/plugins/claude-codex-bridge/.mcp.json +1 -1
  17. package/plugins/codex-profile/.codex-plugin/plugin.json +1 -1
  18. package/plugins/codex-profile/.mcp.json +1 -1
  19. package/plugins/codex-profile/INSTALL.md +1 -1
  20. package/plugins/codex-profile/README.md +1 -1
  21. package/plugins/cursor-marketplace/.cursor-plugin/plugin.json +1 -1
  22. package/plugins/cursor-marketplace/README.md +2 -2
  23. package/plugins/cursor-marketplace/commands/capture-feedback.md +2 -2
  24. package/plugins/cursor-marketplace/rules/feedback-capture.mdc +3 -3
  25. package/plugins/cursor-marketplace/skills/capture-feedback/SKILL.md +3 -2
  26. package/plugins/opencode-profile/INSTALL.md +1 -1
  27. package/public/compare.html +302 -0
  28. package/public/guide.html +4 -4
  29. package/public/index.html +77 -38
  30. package/public/learn/ai-agent-persistent-memory.html +1 -0
  31. package/public/lessons.html +325 -17
  32. package/scripts/__pycache__/train_from_feedback.cpython-312.pyc +0 -0
  33. package/scripts/ai-search-visibility.js +142 -0
  34. package/scripts/audit-trail.js +6 -0
  35. package/scripts/capture-railway-diagnostics.sh +97 -0
  36. package/scripts/changeset-check.js +372 -0
  37. package/scripts/check-congruence.js +8 -5
  38. package/scripts/claude-feedback-sync.js +320 -0
  39. package/scripts/cli-telemetry.js +4 -1
  40. package/scripts/computer-use-firewall.js +45 -15
  41. package/scripts/contextfs.js +32 -23
  42. package/scripts/dashboard.js +84 -0
  43. package/scripts/docker-sandbox-planner.js +208 -0
  44. package/scripts/feedback-loop.js +16 -0
  45. package/scripts/github-about.js +56 -0
  46. package/scripts/intervention-policy.js +696 -0
  47. package/scripts/local-model-profile.js +18 -2
  48. package/scripts/model-tier-router.js +10 -1
  49. package/scripts/operational-integrity.js +361 -32
  50. package/scripts/prove-adapters.js +1 -0
  51. package/scripts/prove-automation.js +2 -2
  52. package/scripts/prove-packaged-runtime.js +260 -0
  53. package/scripts/prove-runtime.js +13 -0
  54. package/scripts/published-cli.js +10 -1
  55. package/scripts/rate-limiter.js +3 -3
  56. package/scripts/statusline-links.js +238 -0
  57. package/scripts/statusline-local-stats.js +2 -0
  58. package/scripts/statusline.sh +200 -10
  59. package/scripts/sync-github-about.js +7 -4
  60. package/scripts/tool-registry.js +2 -2
  61. package/scripts/workflow-sentinel.js +197 -39
  62. package/skills/thumbgate/SKILL.md +1 -1
  63. package/src/api/server.js +12 -1
package/public/index.html CHANGED
@@ -20,9 +20,9 @@
20
20
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
21
21
  __GOOGLE_SITE_VERIFICATION_META__
22
22
  <title>ThumbGate โ€” Self-improving AI coding agents that learn from every mistake</title>
23
- <meta name="description" content="Pre-action gates for AI coding agents. ๐Ÿ‘Ž Thumbs down โ†’ prevention rule โ†’ mistake permanently blocked. ๐Ÿ‘ Thumbs up โ†’ pattern reinforced. History-aware lessons from your corrections. Team adds shared lessons and org visibility.">
23
+ <meta name="description" content="Pre-action gates, a learned intervention policy, and workflow governance for self-improving AI coding agents. ๐Ÿ‘Ž Thumbs down distills history-aware lessons from up to 8 prior entries and stays linked to a 60-second feedback session. ๐Ÿ‘ Thumbs up reinforces safe patterns. Team adds shared lessons and org visibility.">
24
24
  <meta property="og:title" content="ThumbGate โ€” Self-improving AI coding agents that learn from every mistake">
25
- <meta property="og:description" content="Pre-action gates for AI coding agents. ๐Ÿ‘Ž Thumbs down โ†’ prevention rule โ†’ mistake permanently blocked. ๐Ÿ‘ Thumbs up โ†’ pattern reinforced. History-aware lessons from your corrections. Team adds shared lessons and org visibility.">
25
+ <meta property="og:description" content="Pre-action gates, a learned intervention policy, and workflow governance for self-improving AI coding agents. ๐Ÿ‘Ž Thumbs down distills history-aware lessons from up to 8 prior entries and stays linked to a 60-second feedback session. ๐Ÿ‘ Thumbs up reinforces safe patterns. Team adds shared lessons and org visibility.">
26
26
  <meta property="og:type" content="website">
27
27
  <meta name="keywords" content="ThumbGate, thumbgate, self-improving AI agents, AI agent self-improvement, AI agent learning, AI agent memory, pre-action gates, human-in-the-loop, MCP server, Claude Code, Cursor, Codex, Gemini, Amp, OpenCode, vibe coding safety, SpecLock alternative, Mem0 alternative, AI coding agent feedback loop, PreToolUse hooks, prevention rules, feedback enforcement, context engineering">
28
28
 
@@ -44,7 +44,7 @@ __GA_BOOTSTRAP__
44
44
  "@type": "SoftwareApplication",
45
45
  "name": "ThumbGate",
46
46
  "alternateName": "thumbgate",
47
- "description": "Make your AI coding agent self-improving. Every mistake becomes a prevention rule. Every correction makes it permanently smarter. Turns feedback into enforcement โ€” your agent gets better with every session.",
47
+ "description": "Make your AI coding agent self-improving. Every mistake becomes a prevention rule and trains a local intervention policy. Every correction strengthens future recall, verification, and enforcement. ThumbGate adds workflow governance and isolated execution guidance so high-risk runs do not have to happen directly on the host.",
48
48
  "applicationCategory": "DeveloperApplication",
49
49
  "operatingSystem": "Cross-platform, Node.js >=18.18.0",
50
50
  "license": "https://opensource.org/licenses/MIT",
@@ -59,6 +59,9 @@ __GA_BOOTSTRAP__
59
59
  },
60
60
  "featureList": [
61
61
  "Pre-Action Gates โ€” block known-bad tool calls before execution",
62
+ "Workflow Sentinel โ€” score blast radius before PR, merge, release, and publish actions fire",
63
+ "Docker Sandboxes routing โ€” move high-risk local runs into isolated microVM-backed execution",
64
+ "Hosted sandbox dispatch โ€” signed isolated lane for team automations",
62
65
  "Domain Skill Packs โ€” Stripe, Railway, database migration best practices",
63
66
  "Progressive Disclosure โ€” 82% token savings with 3-tier L1/L2/L3 loading",
64
67
  "Hallucination Detection โ€” decomposes claims into verifiable sub-claims",
@@ -97,7 +100,9 @@ __GA_BOOTSTRAP__
97
100
  {
98
101
  "@type": "Offer",
99
102
  "name": "Team",
100
- "description": "Shared enforcement memory, review visibility, org dashboard, and pilot rollout support for teams shipping AI-generated changes",
103
+ "price": "12",
104
+ "priceCurrency": "USD",
105
+ "description": "Intake-led team rollout with a workflow hardening sprint, shared enforcement memory, org dashboard visibility, Docker Sandboxes guidance for risky local autonomy, and pilot support for teams shipping AI-generated changes",
101
106
  "url": "https://thumbgate-production.up.railway.app/#workflow-sprint-intake"
102
107
  }
103
108
  ]
@@ -109,7 +114,7 @@ __GA_BOOTSTRAP__
109
114
  "@context": "https://schema.org",
110
115
  "@type": "HowTo",
111
116
  "name": "How to make your AI coding agent self-improving",
112
- "description": "Set up ThumbGate so your AI agent learns from every mistake and never repeats it โ€” a self-improvement loop powered by feedback enforcement.",
117
+ "description": "Set up ThumbGate so your AI agent learns from every mistake and never repeats it โ€” a self-improvement loop powered by feedback enforcement and a trained local intervention policy.",
113
118
  "step": [
114
119
  {
115
120
  "@type": "HowToStep",
@@ -121,7 +126,7 @@ __GA_BOOTSTRAP__
121
126
  "@type": "HowToStep",
122
127
  "position": 2,
123
128
  "name": "Give feedback when something goes wrong",
124
- "text": "When your agent makes a mistake, give it a thumbs down with context: what went wrong and how to avoid it. ThumbGate validates the feedback and promotes it to a reusable memory."
129
+ "text": "When your agent makes a mistake, give it a thumbs down with context. In the current Claude auto-capture hook, vague negative signals can reuse up to 8 prior recorded entries before promotion and stay linked to a 60-second feedback session for later clarification."
125
130
  },
126
131
  {
127
132
  "@type": "HowToStep",
@@ -178,6 +183,14 @@ __GA_BOOTSTRAP__
178
183
  "text": "Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent."
179
184
  }
180
185
  },
186
+ {
187
+ "@type": "Question",
188
+ "name": "How does ThumbGate reduce host blast radius for high-risk local runs?",
189
+ "acceptedAnswer": {
190
+ "@type": "Answer",
191
+ "text": "ThumbGate combines pre-action gates with execution guidance. Workflow Sentinel predicts risky local actions before they execute, and high-risk runs can be routed into Docker Sandboxes instead of running directly on the host. Team workflows also have a signed hosted sandbox lane for isolated automation dispatch."
192
+ }
193
+ },
181
194
  {
182
195
  "@type": "Question",
183
196
  "name": "How are pre-action gates different from prompt rules?",
@@ -419,8 +432,9 @@ __GA_BOOTSTRAP__
419
432
  <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
420
433
  <a href="/guide">Setup Guide</a>
421
434
  <a href="/learn">Learn</a>
435
+ <a href="/compare">Compare</a>
422
436
  <a href="/dashboard">Dashboard Demo</a>
423
- <a href="/pro?utm_source=website&utm_medium=homepage_nav&utm_campaign=pro_page" class="nav-cta">See Pro</a>
437
+ <a href="#workflow-sprint-intake" class="nav-cta">Start Sprint</a>
424
438
  </div>
425
439
  </div>
426
440
  </nav>
@@ -429,19 +443,20 @@ __GA_BOOTSTRAP__
429
443
  <section class="hero">
430
444
  <div class="container">
431
445
  <div class="hero-thumbs">๐Ÿ‘๐Ÿ‘Ž</div>
432
- <div class="hero-badge">โ— Self-improving AI agents โ€” every mistake makes it smarter</div>
433
- <h1>Your AI agent learns<br>from every mistake.</h1>
446
+ <div class="hero-badge">โ— Workflow Hardening Sprint for teams shipping AI-generated changes</div>
447
+ <h1>Make one AI workflow<br>safe enough to ship team-wide.</h1>
434
448
  <div class="hero-signals">
435
- <div class="signal-pill signal-down">๐Ÿ‘Ž Mistake becomes a prevention rule โ€” permanently blocked</div>
436
- <div class="signal-pill signal-up">๐Ÿ‘ Good pattern reinforced โ€” reused across sessions</div>
449
+ <div class="signal-pill signal-down">๐Ÿ‘Ž Repeated failure becomes enforcement before the next run</div>
450
+ <div class="signal-pill signal-up">๐Ÿ‘ Safe pattern reinforced across the shared workflow</div>
437
451
  </div>
438
- <p class="hero-persona">For developers using Claude Code, Cursor, Codex, Gemini, Amp, and OpenCode who want their AI agent to actually get better over time โ€” not repeat the same mistakes every session.</p>
439
- <p><strong>The self-improvement loop:</strong> Your agent makes a mistake โ†’ you give a thumbs-down โ†’ ThumbGate auto-generates a prevention rule โ†’ a gate physically blocks that mistake from ever happening again. Your agent gets permanently smarter with every correction. No model retraining. No prompt hacking. Just enforcement that compounds.</p>
452
+ <p class="hero-persona">For consultancies, platform teams, and AI product teams with one workflow owner, one repeated failure, and one buyer who needs proof before a wider rollout.</p>
453
+ <p><strong>Best first paid motion:</strong> start with one repo, one workflow, and one repeat failure. ThumbGate turns the blocker into enforcement, routes risky runs toward isolated execution, and gives the buyer a proof-ready story around shared memory, approval boundaries, release confidence, and auditability.</p>
440
454
  <div class="hero-actions">
441
- <a href="/pro?utm_source=website&utm_medium=homepage_hero&utm_campaign=pro_page" class="btn-pro-page">See Pro for individual operators</a>
455
+ <a href="#workflow-sprint-intake" class="btn-team">Start Workflow Hardening Sprint</a>
456
+ <a href="/pro?utm_source=website&utm_medium=homepage_hero&utm_campaign=pro_page" class="btn-pro-page">See Pro for solo operators</a>
442
457
  <a href="/dashboard?utm_source=website&utm_medium=homepage_hero&utm_campaign=demo" class="btn-demo-link">Open dashboard demo</a>
443
458
  </div>
444
- <p class="hero-paid-note"><strong>Paid path:</strong> Free stays the local install lane. Pro is the buyer-ready page for your personal local dashboard, DPO export, and review-ready evidence.</p>
459
+ <p class="hero-paid-note"><strong>Start free as an individual.</strong> Pro stays the self-serve lane for personal dashboard and DPO export. Team pricing anchors at <strong>$12/seat/mo with a 3-seat minimum</strong>, but the team path starts intake-first with the Workflow Hardening Sprint so buyers see proof before a wider rollout.</p>
445
460
  <div class="hero-install" onclick="copyInstall(this)" title="Click to copy">
446
461
  <span class="prompt">$</span>
447
462
  <span class="cmd">npx thumbgate init</span>
@@ -508,13 +523,17 @@ __GA_BOOTSTRAP__
508
523
  <h3>๐Ÿ“Š Org Dashboard (Pro)</h3>
509
524
  <p>See which agents are creating review churn, which gates are saving time, and where rollout risk is still concentrated.</p>
510
525
  </div>
526
+ <div class="agent-card">
527
+ <h3>๐Ÿงฑ Isolated Execution Lanes</h3>
528
+ <p>High-risk local autonomy can route into Docker Sandboxes, while hosted team automations use a signed sandbox dispatch lane instead of running loose on a shared host.</p>
529
+ </div>
511
530
  <div class="agent-card">
512
531
  <h3>๐Ÿงช Thompson Sampling</h3>
513
532
  <p>Confidence tiers (none/low/medium/high) tell you when to trust the model vs fall back to rules. No guessing.</p>
514
533
  </div>
515
534
  <div class="agent-card">
516
535
  <h3>๐Ÿชž History-Aware Lessons</h3>
517
- <p>When a thumbs signal is vague, ThumbGate can reuse the last ~10 messages plus the failed tool call, propose what went wrong, and turn that into one linked lesson instead of a dead-end note.</p>
536
+ <p>When the current Claude auto-capture hook only gets a vague thumbs-down, ThumbGate can reuse up to 8 prior recorded entries plus the failed tool call, then keep a linked 60-second feedback session open for later corrections instead of creating a dead-end note.</p>
518
537
  </div>
519
538
  </div>
520
539
  </div>
@@ -580,13 +599,13 @@ __GA_BOOTSTRAP__
580
599
  <!-- HOW IT WORKS -->
581
600
  <section class="how-it-works" id="how-it-works">
582
601
  <div class="container">
583
- <div class="section-label">New in v1.1.0</div>
602
+ <div class="section-label">New in v1.3.0</div>
584
603
  <h2 class="section-title">Three steps to stop repeated AI failures</h2>
585
604
  <div class="steps">
586
605
  <div class="step">
587
606
  <div class="step-num">1</div>
588
607
  <h3>Feedback</h3>
589
- <p>Give <code>๐Ÿ‘</code> or <code>๐Ÿ‘Ž</code> on your AI agent's actions. Feedback is stored in a SQLite+FTS5 lesson DB. If the signal is vague, ThumbGate can distill it from the recent conversation window and failed tool call before promotion. Example: you ๐Ÿ‘Ž a risky migration โ†’ it auto-promotes to a "never run DROP on prod" gate.</p>
608
+ <p>Give <code>๐Ÿ‘</code> or <code>๐Ÿ‘Ž</code> on your AI agent's actions. Feedback is stored in a SQLite+FTS5 lesson DB. In the current Claude auto-capture hook, a vague thumbs-down can distill from up to 8 prior recorded entries and the failed tool call before promotion, then stay linked to a 60-second feedback session. Example: you ๐Ÿ‘Ž a risky migration โ†’ it auto-promotes to a "never run DROP on prod" gate.</p>
590
609
  </div>
591
610
  <div class="step">
592
611
  <div class="step-num">2</div>
@@ -625,6 +644,14 @@ __GA_BOOTSTRAP__
625
644
  <h3>Log everything, learn automatically</h3>
626
645
  <p>Repeated failures auto-promote to gates. Org dashboard shows all agents.</p>
627
646
  </div>
647
+ <div class="agent-card">
648
+ <h3>Keep risky runs off the host</h3>
649
+ <p>When Workflow Sentinel predicts a risky local action, ThumbGate can recommend Docker Sandboxes before the agent touches the host filesystem or broader credentials.</p>
650
+ </div>
651
+ <div class="agent-card">
652
+ <h3>Ship with versioned proof</h3>
653
+ <p>Changesets, SemVer, sync checks, and verification evidence make new package releases inspectable before a buyer trusts the next rollout.</p>
654
+ </div>
628
655
  </div>
629
656
  </div>
630
657
  </section>
@@ -659,7 +686,7 @@ __GA_BOOTSTRAP__
659
686
  <section class="pricing" id="pricing">
660
687
  <div class="container">
661
688
  <div class="section-label">Pricing</div>
662
- <h2 class="section-title">Start free. Prove value on a real workflow. Upgrade when review churn costs more than $19/mo.</h2>
689
+ <h2 class="section-title">Start free. Use the workflow hardening sprint to prove team value. Keep Pro as the self-serve lane for individual operators.</h2>
663
690
  <div class="pricing-grid">
664
691
  <div class="price-card">
665
692
  <div class="tier">Free</div>
@@ -667,7 +694,7 @@ __GA_BOOTSTRAP__
667
694
  <div class="price-sub">Forever free ยท Local enforcement for one developer</div>
668
695
  <p style="font-size:13px;color:#aaa;margin-bottom:16px;">For solo developers who want to stop the same agent mistake from showing up twice.</p>
669
696
  <ul>
670
- <li>Unlimited feedback captures ยท 5 lesson searches/day ยท unlimited recall</li>
697
+ <li>3 feedback captures/day ยท 5 lesson searches/day ยท unlimited recall</li>
671
698
  <li>5 auto-promoted gates plus the core safety policy</li>
672
699
  <li>All MCP integrations (Claude Code, Cursor, Codex, etc.)</li>
673
700
  <li>PreToolUse hook blocking</li>
@@ -718,21 +745,24 @@ __GA_BOOTSTRAP__
718
745
  <div class="price-card team">
719
746
  <div class="tier">Team</div>
720
747
  <div class="price">$12<span style="font-size:16px;color:var(--text-dim)">/seat/mo</span></div>
721
- <div class="price-sub">Starts at $36/mo for 3 seats ยท or $297/yr ยท Shared enforcement + org visibility</div>
722
- <p style="font-size:13px;color:var(--green);margin-bottom:16px;font-weight:500;">For teams shipping AI-generated changes across shared repos who need one correction to protect every reviewer and runtime.</p>
748
+ <div class="price-sub">3-seat minimum ยท intake-led rollout for the first workflow</div>
749
+ <p style="font-size:13px;color:var(--green);margin-bottom:16px;font-weight:500;">For teams shipping AI-generated changes across shared repos who need one correction to protect every reviewer and runtime. The first team step is a workflow hardening sprint, not a blind org-wide rollout.</p>
723
750
  <div class="pro-upgrade-triggers" style="font-size:12px;color:#aaa;margin-bottom:12px;">
724
- <strong style="color:#fff;">Start Team when:</strong> you need shared enforcement, org-wide proof, or one workflow pilot that proves ROI internally.
751
+ <strong style="color:#fff;">Best first paid motion:</strong> one workflow, one owner, one proof review. Qualify the blocker first, then expand into seats.
725
752
  </div>
726
753
  <ul>
754
+ <li>Workflow hardening sprint โ€” map one painful workflow, one repeated failure, and one buyer proof review before wider rollout</li>
727
755
  <li>Shared enforcement memory โ€” a shared lesson database where one developer's ๐Ÿ‘Ž on a bad migration protects every agent on the team</li>
728
756
  <li>Org dashboard โ€” active agents, gate hit rates, risk agents, and proof-backed team metrics in one place</li>
729
757
  <li>Hosted review views โ€” constrained cards, lists, and callouts for rollout, incident, and audit visibility</li>
730
758
  <li>Gate template library โ€” pre-built guardrails for force-pushes, skipped tests, destructive SQL, and evidence-before-done</li>
731
- <li>Workflow proof sprint โ€” pilot one painful workflow first, then expand once the before/after evidence is real</li>
732
- <li>Rollout attribution stays tied to the team funnel instead of disappearing into generic referral traffic</li>
759
+ <li>Docker Sandboxes guidance โ€” route risky local autonomy into an isolated microVM-backed lane instead of running it directly on a shared host</li>
760
+ <li>Signed hosted sandbox dispatch โ€” isolated execution path for team automations that do not need repo-bound local access</li>
761
+ <li>Release confidence story โ€” Changesets, SemVer, version sync, and verification evidence keep publishes and rollout claims inspectable</li>
762
+ <li>Proof pack โ€” attach verification evidence and rollout diagnostics so the buyer does not have to trust a demo</li>
733
763
  </ul>
734
- <a href="#workflow-sprint-intake" class="btn-team">Start Team Pilot</a>
735
- <p style="font-size:11px;color:#666;margin-top:8px;">Hosted rollout starts with one workflow pilot so the first expansion has measurable before/after proof.</p>
764
+ <a href="#workflow-sprint-intake" class="btn-team">Start Workflow Hardening Sprint</a>
765
+ <p style="font-size:11px;color:#666;margin-top:8px;">Team pricing anchors at $12/seat/mo with a 3-seat minimum after qualification. The first step is a 30-minute intake around one real blocker.</p>
736
766
  </div>
737
767
  </div>
738
768
  </div>
@@ -742,7 +772,7 @@ __GA_BOOTSTRAP__
742
772
  <div class="container">
743
773
  <div class="section-label">Team Pilot</div>
744
774
  <h2 class="section-title">Start with one repo, one workflow, one repeat failure</h2>
745
- <p style="color:var(--text-dim);max-width:720px;margin:0 auto 16px;">The recurring value is shared enforcement. Start with one workflow, one owner, and one blocker. The intake is designed to prove that ThumbGate reduces review churn, rollout risk, or repeated agent mistakes before a wider rollout.</p>
775
+ <p style="color:var(--text-dim);max-width:720px;margin:0 auto 16px;">This is the fastest path to first paid value for teams. Start with one workflow, one owner, and one blocker. The intake is designed to prove that ThumbGate reduces review churn, rollout risk, or repeated agent mistakes before a wider rollout.</p>
746
776
  <form class="team-form" action="/v1/intake/workflow-sprint" method="POST">
747
777
  <input type="hidden" name="ctaId" value="workflow_sprint_intake">
748
778
  <input type="hidden" name="ctaPlacement" value="team_pricing">
@@ -783,13 +813,21 @@ __GA_BOOTSTRAP__
783
813
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">What AI agents and editors does this work with?</div>
784
814
  <div class="faq-a">ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any other MCP-compatible agent. Cursor ships with a plugin bundle in this repo. Codex ships with a repo-local app plugin profile. VS Code works when you run an MCP-compatible agent inside it, but this repo does not ship a standalone VS Code extension today.</div>
785
815
  </div>
816
+ <div class="faq-item">
817
+ <button class="faq-q" type="button" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">How do we keep high-risk autonomous runs off the host?</button>
818
+ <div class="faq-a">ThumbGate is the control plane, not just a prompt layer. Workflow Sentinel predicts blast radius before execution, and risky local autonomy can be routed into Docker Sandboxes instead of running directly on the host. Team workflows also have a signed hosted sandbox lane for isolated dispatch when local repo access is not required.</div>
819
+ </div>
820
+ <div class="faq-item">
821
+ <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">How do we trust a new package release?</div>
822
+ <div class="faq-a">ThumbGate does not rely on vibes. Release-relevant PRs need a Changeset, SemVer rules keep version bumps honest, sync checks keep manifests aligned, proof lanes run before merge, and the exact main-branch merge commit is verified before the work is called done.</div>
823
+ </div>
786
824
  <div class="faq-item">
787
825
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">Do I need a cloud account?</div>
788
- <div class="faq-a">No. Free keeps local enforcement on your machine with 5 daily feedback captures, 10 lesson searches, unlimited recall, gates, and hook blocking. No cloud account is required. Pro adds a personal local dashboard plus DPO export. Team is the hosted rollout lane when your group wants a shared lesson database, hosted review views, org dashboard visibility, and team-wide proof.</div>
826
+ <div class="faq-a">No. Free keeps local enforcement on your machine with 3 daily feedback captures, 5 lesson searches, unlimited recall, gates, and hook blocking. No cloud account is required. Pro adds a personal local dashboard plus DPO export. Team is the hosted rollout lane when your group wants a shared lesson database, hosted review views, org dashboard visibility, and team-wide proof.</div>
789
827
  </div>
790
828
  <div class="faq-item">
791
829
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">What if my thumbs-down is vague?</div>
792
- <div class="faq-a">ThumbGate can reuse the last ~10 messages, the failed tool call, and later follow-up notes to propose <code>whatWentWrong</code>, <code>whatToChange</code>, and a reusable lesson. The feedback session stays linked instead of creating duplicate records.</div>
830
+ <div class="faq-a">For the current Claude auto-capture hook, ThumbGate can reuse up to 8 prior recorded entries and the failed tool call for a vague thumbs-down, then keep a linked 60-second feedback session open for later clarification. The timer resets when more context arrives, so the lesson stays attached to one feedback record instead of fragmenting into duplicates.</div>
793
831
  </div>
794
832
  <div class="faq-item">
795
833
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">How are pre-action gates different from prompt rules?</div>
@@ -797,7 +835,7 @@ __GA_BOOTSTRAP__
797
835
  </div>
798
836
  <div class="faq-item">
799
837
  <div class="faq-q" role="button" tabindex="0" aria-expanded="false" onclick="toggleFaq(this)" onkeydown="handleFaqKeydown(event)">What does Pro cost?</div>
800
- <div class="faq-a">Pro is $19/mo or $149/yr (save 35%). Team starts at $36/mo for 3 seats, then $12/seat/mo, or $297/yr at the 3-seat floor. Cancel anytime. No contracts.</div>
838
+ <div class="faq-a">Pro is $19/mo or $149/yr (save 35%) for individual operators. Team pricing anchors at $12/seat/mo with a 3-seat minimum, and team buyers start with the workflow sprint intake instead of a blind org-wide rollout.</div>
801
839
  </div>
802
840
  </div>
803
841
  </div>
@@ -807,8 +845,8 @@ __GA_BOOTSTRAP__
807
845
  <section class="compatibility" id="newsletter" style="padding: 48px 0;">
808
846
  <div class="container" style="text-align: center;">
809
847
  <div class="section-label">Buyer Follow-Up</div>
810
- <h2 class="section-title" style="margin-bottom: 16px;">Not ready to buy today? Keep the demo and checkout link one click away.</h2>
811
- <p style="color: var(--text-dim); margin-bottom: 24px; max-width: 560px; margin-left: auto; margin-right: auto;">Save your work email for launch updates, new gate patterns, and the paid demo path. We also keep it on this device so the Pro checkout can open prefilled instead of making you type it again.</p>
848
+ <h2 class="section-title" style="margin-bottom: 16px;">Not ready to buy today? Keep the sprint brief, demo, and checkout path one click away.</h2>
849
+ <p style="color: var(--text-dim); margin-bottom: 24px; max-width: 560px; margin-left: auto; margin-right: auto;">Save your work email for launch updates, new gate patterns, the workflow sprint brief, and the paid demo path. We also keep it on this device so the Pro checkout can open prefilled instead of making you type it again.</p>
812
850
  <form action="/api/newsletter" method="POST" data-newsletter-form data-page="homepage" data-intent="buyer_follow_up" style="display: flex; gap: 8px; max-width: 480px; margin: 0 auto; flex-wrap: wrap; justify-content: center;">
813
851
  <input type="email" name="email" data-buyer-email placeholder="you@company.com" required style="flex: 1; min-width: 220px; padding: 12px 16px; border: 1px solid var(--border); border-radius: 8px; background: var(--bg-raised); color: var(--text); font-size: 15px;">
814
852
  <button type="submit" style="padding: 12px 24px; background: var(--cyan); color: #000; border: none; border-radius: 8px; font-weight: 600; font-size: 15px; cursor: pointer;">Get updates + keep checkout ready</button>
@@ -820,10 +858,10 @@ __GA_BOOTSTRAP__
820
858
  <!-- FINAL CTA -->
821
859
  <section class="final-cta">
822
860
  <div class="container">
823
- <h2>Put ThumbGate on your next AI-generated change.</h2>
824
- <p>Try the dashboard demo first or install in 30 seconds. Prove the value on a real PR, deploy, or migration.</p>
861
+ <h2>Start with one workflow you actually need to defend.</h2>
862
+ <p>Use the workflow hardening sprint for team rollout, or choose Pro if you are the solo operator who needs a personal dashboard and review-ready exports.</p>
825
863
  <div style="display:flex;gap:12px;justify-content:center;flex-wrap:wrap;">
826
- <a href="/dashboard" class="btn-demo-link" style="background:transparent;border:1px solid var(--cyan);color:var(--cyan);">Try Dashboard Demo</a>
864
+ <a href="#workflow-sprint-intake" class="btn-team" style="background:var(--green);">Start Workflow Hardening Sprint</a>
827
865
  <a href="/checkout/pro?utm_source=website&utm_medium=homepage_final&utm_campaign=pro_pack&cta_id=homepage_final_trial&cta_placement=final&plan_id=pro&landing_path=%2F" class="btn-pro">Try Pro free for 7 days โ†’ $19/mo</a>
828
866
  </div>
829
867
  </div>
@@ -839,7 +877,7 @@ __GA_BOOTSTRAP__
839
877
  <a href="https://www.linkedin.com/in/igorganapolsky" target="_blank" rel="noopener">LinkedIn</a>
840
878
  <a href="/blog">Blog</a>
841
879
  </div>
842
- <span class="footer-copy">ยฉ 2026 Max Smith KDP LLC ยท MIT License ยท v1.1.0</span>
880
+ <span class="footer-copy">ยฉ 2026 Max Smith KDP LLC ยท MIT License ยท v1.3.0</span>
843
881
  </div>
844
882
  </footer>
845
883
 
@@ -859,6 +897,7 @@ function resolvePricingClickTier(el) {
859
897
  if (el.classList.contains('btn-team')) return 'team';
860
898
  if (el.classList.contains('btn-free')) return 'free';
861
899
  if (el.classList.contains('btn-demo-link')) return 'demo';
900
+ if (el.classList.contains('nav-cta')) return 'team';
862
901
  return 'nav';
863
902
  }
864
903
 
@@ -900,7 +939,7 @@ function copyInstall(el) {
900
939
  trackClick('.btn-team', 'workflow_sprint_intake_click', { tier: 'team', offer: 'workflow_hardening_sprint' });
901
940
  trackClick('.btn-free', 'install_click', { tier: 'free' });
902
941
  trackClick('.btn-demo-link', 'demo_click', { source: 'homepage' });
903
- trackClick('.nav-cta', 'pro_page_click', { tier: 'pro', source: 'nav' });
942
+ trackClick('.nav-cta', 'workflow_sprint_intake_click', { tier: 'team', source: 'nav', offer: 'workflow_hardening_sprint' });
904
943
 
905
944
  /* Pricing CTA conversion tracking โ€” fires on every Get Started / Pro / Team button click
906
945
  with section context so we can distinguish pricing section vs final CTA section clicks */
@@ -128,6 +128,7 @@
128
128
 
129
129
  <h3>Episodic layer: the feedback log</h3>
130
130
  <p>Every thumbs-up or thumbs-down you give an agent action is written to a structured feedback log. Each entry captures the tool call that was made, the context at the time, what worked or went wrong, and any tags you add. The log is append-only and survives across sessions.</p>
131
+ <p>In the current Claude auto-capture hook, a vague thumbs-down can borrow up to 8 prior recorded entries plus the failed tool call before promotion. Accepted feedback also opens a linked 60-second follow-up session so later corrections stay attached to the same memory trace instead of fragmenting into duplicates.</p>
131
132
 
132
133
  <pre><code># Thumbs-down: record a specific failure
133
134
  node .claude/scripts/feedback/capture-feedback.js \