thumbgate 1.14.1 → 1.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. package/.claude-plugin/marketplace.json +2 -2
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/.well-known/mcp/server-card.json +1 -1
  4. package/README.md +2 -1
  5. package/adapters/claude/.mcp.json +2 -2
  6. package/adapters/mcp/server-stdio.js +8 -1
  7. package/adapters/opencode/opencode.json +1 -1
  8. package/bin/cli.js +54 -0
  9. package/config/enforcement.json +59 -7
  10. package/config/gates/default.json +33 -0
  11. package/config/mcp-allowlists.json +4 -0
  12. package/config/merge-quality-checks.json +2 -1
  13. package/package.json +17 -5
  14. package/public/codex-plugin.html +7 -1
  15. package/public/dashboard.html +23 -2
  16. package/public/index.html +20 -2
  17. package/public/learn.html +39 -0
  18. package/public/lessons.html +25 -1
  19. package/public/numbers.html +271 -0
  20. package/public/pro.html +7 -1
  21. package/scripts/cli-feedback.js +2 -1
  22. package/scripts/cli-schema.js +43 -4
  23. package/scripts/commercial-offer.js +1 -1
  24. package/scripts/contextfs.js +214 -32
  25. package/scripts/feedback-loop.js +49 -5
  26. package/scripts/harness-selector.js +132 -0
  27. package/scripts/lesson-canonical.js +181 -0
  28. package/scripts/lesson-db.js +71 -10
  29. package/scripts/lesson-synthesis.js +23 -2
  30. package/scripts/native-messaging-audit.js +514 -0
  31. package/scripts/pr-manager.js +47 -7
  32. package/scripts/profile-router.js +16 -1
  33. package/scripts/rule-validator.js +285 -0
  34. package/scripts/seo-gsd.js +182 -2
  35. package/scripts/tool-registry.js +12 -0
  36. package/skills/thumbgate/SKILL.md +1 -1
  37. package/src/api/server.js +53 -0
  38. package/.claude-plugin/README.md +0 -170
  39. package/adapters/README.md +0 -12
  40. package/skills/agent-memory/SKILL.md +0 -97
  41. package/skills/solve-architecture-autonomy/SKILL.md +0 -17
  42. package/skills/solve-architecture-autonomy/tool.js +0 -33
  43. package/skills/thumbgate-feedback/SKILL.md +0 -49
package/public/learn.html CHANGED
@@ -22,6 +22,16 @@
22
22
  "name": "ThumbGate Learning Hub",
23
23
  "description": "Practical guides for AI coding agent safety, pre-action gates, and vibe coding guardrails.",
24
24
  "url": "https://thumbgate-production.up.railway.app/learn",
25
+ "dateModified": "2026-04-20",
26
+ "author": {
27
+ "@type": "Person",
28
+ "name": "Igor Ganapolsky",
29
+ "url": "https://github.com/IgorGanapolsky",
30
+ "sameAs": [
31
+ "https://github.com/IgorGanapolsky",
32
+ "https://www.linkedin.com/in/igorganapolsky"
33
+ ]
34
+ },
25
35
  "publisher": {
26
36
  "@type": "Organization",
27
37
  "name": "ThumbGate",
@@ -83,6 +93,18 @@
83
93
  "position": 9,
84
94
  "url": "https://thumbgate-production.up.railway.app/guides/gemini-cli-feedback-memory",
85
95
  "name": "Gemini CLI Feedback Memory That Leads to Enforcement"
96
+ },
97
+ {
98
+ "@type": "ListItem",
99
+ "position": 10,
100
+ "url": "https://thumbgate-production.up.railway.app/guides/browser-automation-safety",
101
+ "name": "Browser Automation Safety for AI Agents"
102
+ },
103
+ {
104
+ "@type": "ListItem",
105
+ "position": 11,
106
+ "url": "https://thumbgate-production.up.railway.app/guides/native-messaging-host-security",
107
+ "name": "Native Messaging Host Security"
86
108
  }
87
109
  ]
88
110
  }
@@ -188,6 +210,7 @@
188
210
  <div class="container">
189
211
  <h1>Learn: AI Agent Safety</h1>
190
212
  <p class="hero-sub">Practical guides for developers who use AI coding agents and want them to stop repeating the same mistakes. Every article ends with something you can ship today.</p>
213
+ <p class="hero-sub" style="font-size:0.85rem;margin-top:-1rem;">Updated: <time datetime="2026-04-20">2026-04-20</time> · by <a href="https://github.com/IgorGanapolsky" style="color:inherit;">Igor Ganapolsky</a></p>
191
214
 
192
215
  <div class="article-grid">
193
216
  <a href="/learn/stop-ai-agent-force-push" class="article-card">
@@ -265,6 +288,22 @@
265
288
  <span class="article-tag">Enforcement</span>
266
289
  </a>
267
290
 
291
+ <a href="/guides/browser-automation-safety" class="article-card">
292
+ <h3>Browser Automation Safety for AI Agents</h3>
293
+ <p>Prompt injection gets more dangerous when browser agents can create cross-app bridges, hold persistent permissions, or silently widen connector scope.</p>
294
+ <span class="article-tag">Browser Use</span>
295
+ <span class="article-tag">Prompt Injection</span>
296
+ <span class="article-tag">Buyer Guide</span>
297
+ </a>
298
+
299
+ <a href="/guides/native-messaging-host-security" class="article-card">
300
+ <h3>Native Messaging Host Security</h3>
301
+ <p>Understand how native messaging manifests work, which extension IDs already have access, and how to audit dormant AI browser bridges before they surprise a team.</p>
302
+ <span class="article-tag">Native Messaging</span>
303
+ <span class="article-tag">Bridge Audit</span>
304
+ <span class="article-tag">Buyer Guide</span>
305
+ </a>
306
+
268
307
  <a href="/guides/autoresearch-agent-safety" class="article-card">
269
308
  <h3>Autoresearch Agent Safety for Self-Improving Coding Agents</h3>
270
309
  <p>The control-plane story for benchmark-search loops that need holdout tests, proof trails, and reward-hacking gates.</p>
@@ -7,6 +7,29 @@
7
7
  <link rel="icon" type="image/png" href="/thumbgate-icon.png">
8
8
  <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg">
9
9
  <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
10
+ <script type="application/ld+json">
11
+ {
12
+ "@context": "https://schema.org",
13
+ "@type": "WebPage",
14
+ "name": "ThumbGate Lessons Learned",
15
+ "url": "https://thumbgate-production.up.railway.app/lessons",
16
+ "dateModified": "2026-04-20",
17
+ "author": {
18
+ "@type": "Person",
19
+ "name": "Igor Ganapolsky",
20
+ "url": "https://github.com/IgorGanapolsky",
21
+ "sameAs": [
22
+ "https://github.com/IgorGanapolsky",
23
+ "https://www.linkedin.com/in/igorganapolsky"
24
+ ]
25
+ },
26
+ "publisher": {
27
+ "@type": "Organization",
28
+ "name": "ThumbGate",
29
+ "url": "https://thumbgate-production.up.railway.app"
30
+ }
31
+ }
32
+ </script>
10
33
  <style>
11
34
  *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
12
35
  :root {
@@ -201,6 +224,7 @@
201
224
  <div class="container">
202
225
  <div style="margin:32px 0 24px;padding:24px;background:linear-gradient(135deg,rgba(167,139,250,0.08),rgba(34,211,238,0.05));border:1px solid rgba(167,139,250,0.2);border-radius:12px;">
203
226
  <h1 style="font-size:22px;font-weight:700;margin-bottom:8px;letter-spacing:-0.02em;">📚 Lessons Learned</h1>
227
+ <p style="font-size:12px;color:var(--text-muted);margin-bottom:8px;">Updated: <time datetime="2026-04-20">2026-04-20</time> · by <a href="https://github.com/IgorGanapolsky" style="color:inherit;">Igor Ganapolsky</a></p>
204
228
  <p style="font-size:14px;color:var(--text-muted);line-height:1.6;max-width:700px;">See what ThumbGate learned from your feedback, which failure patterns keep repeating, and how many actions the gate layer actually blocked. <span style="color:var(--purple);font-weight:600;">This view separates repeated failures from recorded gate blocks so the proof stays honest.</span></p>
205
229
  <div style="display:flex;gap:16px;margin-top:12px;font-size:12px;color:var(--text-muted);">
206
230
  <span>📋 <strong style="color:var(--text);">Active Rules</strong> — what was learned</span>
@@ -820,7 +844,7 @@ function renderUpgradeWall(containerId) {
820
844
  '<div style="text-align:center;background:rgba(10,10,15,0.92);border:1px solid #333;border-radius:12px;padding:28px 36px;">' +
821
845
  '<div style="font-size:20px;font-weight:700;color:#fff;margin-bottom:8px;">Unlock your full lessons</div>' +
822
846
  '<div style="color:#aaa;margin-bottom:16px;">Pro shows your real prevention rules, timeline, and insights.</div>' +
823
- '<a href="https://buy.stripe.com/7sYcN5bmIf5IcSd8qf3sI0a" target="_blank" rel="noopener" ' +
847
+ '<a href="/go/pro?utm_source=lessons" rel="noopener" ' +
824
848
  'style="display:inline-block;background:#b85c2d;color:#fff;padding:10px 24px;border-radius:8px;text-decoration:none;font-weight:700;">Start 7-day free trial</a>' +
825
849
  '<div style="color:#666;font-size:12px;margin-top:10px;">npx thumbgate pro --activate --key=YOUR_KEY</div>' +
826
850
  '</div></div>';
@@ -0,0 +1,271 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <meta name="generator" content="ThumbGate">
7
+ <meta name="author" content="Igor Ganapolsky">
8
+ <title>ThumbGate — The Numbers | Live First-Party Data</title>
9
+ <meta name="description" content="ThumbGate's live operational numbers: active pre-action gates, AI agent actions blocked, estimated LLM tokens and dollars saved, and the Bayes error rate of our intervention scorer. First-party data, regenerated on every release.">
10
+ <meta property="og:title" content="ThumbGate — The Numbers">
11
+ <meta property="og:description" content="Live first-party operational metrics: gates, blocks, token savings, and scorer calibration. Regenerated on every release.">
12
+ <meta property="og:type" content="website">
13
+ <meta property="og:url" content="https://thumbgate-production.up.railway.app/numbers">
14
+ <meta name="twitter:card" content="summary_large_image">
15
+ <link rel="canonical" href="https://thumbgate-production.up.railway.app/numbers">
16
+ <link rel="icon" type="image/png" href="/thumbgate-icon.png">
17
+ <link rel="apple-touch-icon" href="/apple-touch-icon.png">
18
+ <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
19
+
20
+ <script type="application/ld+json">
21
+ {
22
+ "@context": "https://schema.org",
23
+ "@type": "SoftwareApplication",
24
+ "name": "ThumbGate",
25
+ "alternateName": "thumbgate",
26
+ "applicationCategory": "DeveloperApplication",
27
+ "operatingSystem": "Cross-platform, Node.js >=18.18.0",
28
+ "softwareVersion": "1.12.2",
29
+ "url": "https://thumbgate-production.up.railway.app/numbers",
30
+ "dateModified": "2026-04-20",
31
+ "creator": {
32
+ "@type": "Person",
33
+ "name": "Igor Ganapolsky",
34
+ "url": "https://github.com/IgorGanapolsky",
35
+ "sameAs": [
36
+ "https://github.com/IgorGanapolsky",
37
+ "https://www.linkedin.com/in/igorganapolsky"
38
+ ]
39
+ }
40
+ }
41
+ </script>
42
+
43
+ <script type="application/ld+json">
44
+ {
45
+ "@context": "https://schema.org",
46
+ "@type": "Dataset",
47
+ "name": "ThumbGate Live Operational Metrics",
48
+ "description": "First-party operational metrics from the ThumbGate pre-action gate runtime: active gates, blocked AI agent actions, estimated token savings, and Bayes error rate of the intervention scorer.",
49
+ "url": "https://thumbgate-production.up.railway.app/numbers",
50
+ "license": "https://opensource.org/licenses/MIT",
51
+ "creator": {
52
+ "@type": "Person",
53
+ "name": "Igor Ganapolsky",
54
+ "url": "https://github.com/IgorGanapolsky",
55
+ "sameAs": [
56
+ "https://github.com/IgorGanapolsky",
57
+ "https://www.linkedin.com/in/igorganapolsky"
58
+ ]
59
+ },
60
+ "dateModified": "2026-04-20",
61
+ "datePublished": "2026-04-20",
62
+ "keywords": [
63
+ "AI agent gates",
64
+ "LLM token savings",
65
+ "prevention rules",
66
+ "Bayes error rate",
67
+ "self-improving agents"
68
+ ],
69
+ "variableMeasured": [
70
+ {
71
+ "@type": "PropertyValue",
72
+ "name": "active_gates",
73
+ "value": 52
74
+ },
75
+ {
76
+ "@type": "PropertyValue",
77
+ "name": "actions_blocked",
78
+ "value": 0
79
+ },
80
+ {
81
+ "@type": "PropertyValue",
82
+ "name": "actions_warned",
83
+ "value": 455
84
+ },
85
+ {
86
+ "@type": "PropertyValue",
87
+ "name": "estimated_hours_saved",
88
+ "value": "113.8"
89
+ },
90
+ {
91
+ "@type": "PropertyValue",
92
+ "name": "estimated_dollars_saved",
93
+ "value": 0,
94
+ "unitText": "USD"
95
+ },
96
+ {
97
+ "@type": "PropertyValue",
98
+ "name": "tokens_saved_total",
99
+ "value": 0
100
+ },
101
+ {
102
+ "@type": "PropertyValue",
103
+ "name": "bayes_error_rate",
104
+ "value": 0.015
105
+ }
106
+ ]
107
+ }
108
+ </script>
109
+
110
+ <style>
111
+ *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
112
+ :root {
113
+ --bg: #0a0a0b;
114
+ --bg-card: #161618;
115
+ --bg-raised: #111113;
116
+ --border: #222225;
117
+ --text: #e8e8ec;
118
+ --muted: #8b8b94;
119
+ --cyan: #22d3ee;
120
+ --green: #34d399;
121
+ --amber: #fbbf24;
122
+ }
123
+ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.6; }
124
+ nav { padding: 1rem 2rem; border-bottom: 1px solid var(--border); display: flex; gap: 1.5rem; align-items: center; }
125
+ nav a { color: var(--muted); text-decoration: none; font-size: 0.9rem; }
126
+ nav a:hover { color: var(--cyan); }
127
+ nav .brand { color: var(--text); font-weight: 700; font-size: 1.05rem; text-decoration: none; }
128
+ .container { max-width: 900px; margin: 0 auto; padding: 3rem 1.5rem 5rem; }
129
+ h1 { font-size: 2.4rem; line-height: 1.15; margin-bottom: 0.75rem; }
130
+ h2 { font-size: 1.35rem; color: var(--cyan); margin: 3rem 0 1rem; }
131
+ .subtitle { color: var(--muted); font-size: 1.05rem; max-width: 640px; margin-bottom: 1.25rem; }
132
+ .freshness {
133
+ display: inline-block;
134
+ padding: 6px 14px;
135
+ background: rgba(52, 211, 153, 0.08);
136
+ border: 1px solid rgba(52, 211, 153, 0.35);
137
+ border-radius: 999px;
138
+ color: var(--green);
139
+ font-size: 0.82rem;
140
+ font-weight: 600;
141
+ margin-bottom: 2.5rem;
142
+ }
143
+ .stats-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 18px; margin: 1.5rem 0; }
144
+ .stat-card {
145
+ background: var(--bg-card);
146
+ border: 1px solid var(--border);
147
+ border-radius: 12px;
148
+ padding: 22px 20px;
149
+ }
150
+ .stat-label { color: var(--muted); font-size: 0.82rem; text-transform: uppercase; letter-spacing: 0.04em; margin-bottom: 10px; }
151
+ .stat-value { font-size: 2.1rem; font-weight: 700; color: var(--text); line-height: 1.1; }
152
+ .stat-sub { color: var(--muted); font-size: 0.85rem; margin-top: 8px; }
153
+ .stat-source { display: block; color: var(--cyan); font-size: 0.75rem; text-decoration: none; margin-top: 10px; }
154
+ .stat-source:hover { text-decoration: underline; }
155
+ .method {
156
+ background: var(--bg-raised);
157
+ border: 1px solid var(--border);
158
+ border-radius: 12px;
159
+ padding: 22px 24px;
160
+ color: var(--muted);
161
+ font-size: 0.95rem;
162
+ }
163
+ .method strong { color: var(--text); }
164
+ .method ul { margin: 10px 0 0 18px; }
165
+ .method li { margin-bottom: 6px; }
166
+ .cta { text-align: center; margin-top: 3rem; }
167
+ .cta a {
168
+ display: inline-block;
169
+ padding: 14px 28px;
170
+ background: var(--cyan);
171
+ color: #0a0a0b;
172
+ border-radius: 10px;
173
+ font-weight: 700;
174
+ text-decoration: none;
175
+ }
176
+ .footer-note { color: var(--muted); font-size: 0.85rem; margin-top: 1.5rem; text-align: center; }
177
+ .footer-note a { color: var(--cyan); text-decoration: none; }
178
+ </style>
179
+ </head>
180
+ <body>
181
+ <nav>
182
+ <a class="brand" href="/">ThumbGate</a>
183
+ <a href="/learn">Learn</a>
184
+ <a href="/compare">Compare</a>
185
+ <a href="/numbers">Numbers</a>
186
+ <a href="/dashboard">Dashboard</a>
187
+ <a href="/pro">Pro</a>
188
+ </nav>
189
+
190
+ <main class="container">
191
+ <h1>The Numbers</h1>
192
+ <p class="subtitle">Live first-party operational data from the ThumbGate runtime. No surveys, no projections — counts pulled from the same local scripts that power the CLI and dashboard.</p>
193
+ <div class="freshness">Updated: 2026-04-20 · Version 1.12.2</div>
194
+
195
+ <h2>Gate enforcement</h2>
196
+ <div class="stats-grid">
197
+ <div class="stat-card">
198
+ <div class="stat-label">Active gates</div>
199
+ <div class="stat-value">52</div>
200
+ <div class="stat-sub">33 manual · 19 auto-promoted</div>
201
+ <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/gate-stats.js">source: gate-stats.js</a>
202
+ </div>
203
+ <div class="stat-card">
204
+ <div class="stat-label">Actions blocked</div>
205
+ <div class="stat-value">0</div>
206
+ <div class="stat-sub">repeat AI mistakes prevented at the gate</div>
207
+ <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/gate-stats.js">source: gate-stats.js</a>
208
+ </div>
209
+ <div class="stat-card">
210
+ <div class="stat-label">Actions warned</div>
211
+ <div class="stat-value">455</div>
212
+ <div class="stat-sub">soft interventions; not blocks</div>
213
+ <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/gate-stats.js">source: gate-stats.js</a>
214
+ </div>
215
+ <div class="stat-card">
216
+ <div class="stat-label">Top blocked gate</div>
217
+ <div class="stat-value" style="font-size:1.1rem;">local-only-git-writes (0 blocks)</div>
218
+ <div class="stat-sub">highest-occurrence prevention rule</div>
219
+ <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/gate-stats.js">source: gate-stats.js</a>
220
+ </div>
221
+ </div>
222
+
223
+ <h2>Token &amp; time savings</h2>
224
+ <div class="stats-grid">
225
+ <div class="stat-card">
226
+ <div class="stat-label">Estimated hours saved</div>
227
+ <div class="stat-value">113.8</div>
228
+ <div class="stat-sub">~15 min per blocked mistake × blocks+warns</div>
229
+ <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/gate-stats.js">source: gate-stats.js</a>
230
+ </div>
231
+ <div class="stat-card">
232
+ <div class="stat-label">Estimated LLM dollars saved</div>
233
+ <div class="stat-value">$0.00</div>
234
+ <div class="stat-sub">blended Sonnet/Opus/Haiku 80/15/5 mix</div>
235
+ <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/token-savings.js">source: token-savings.js</a>
236
+ </div>
237
+ <div class="stat-card">
238
+ <div class="stat-label">Tokens not spent</div>
239
+ <div class="stat-value">0</div>
240
+ <div class="stat-sub">2,000 input + 600 output per block, conservative</div>
241
+ <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/token-savings.js">source: token-savings.js</a>
242
+ </div>
243
+ <div class="stat-card">
244
+ <div class="stat-label">Scorer Bayes error</div>
245
+ <div class="stat-value">1.5%</div>
246
+ <div class="stat-sub">irreducible error given current feature set</div>
247
+ <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/bayes-optimal-gate.js">source: bayes-optimal-gate.js</a>
248
+ </div>
249
+ </div>
250
+
251
+ <h2>Methodology</h2>
252
+ <div class="method">
253
+ <p><strong>Where the numbers come from.</strong> This page is regenerated from local scripts — no survey data, no hand-edited figures, no third-party attribution. Every number on this page is produced by code in the public <a href="https://github.com/IgorGanapolsky/ThumbGate">ThumbGate repo</a>.</p>
254
+ <ul>
255
+ <li><strong>Active gates</strong> — union of <code>config/gates/default.json</code> (manual) and the auto-promotion ledger (auto).</li>
256
+ <li><strong>Actions blocked/warned</strong> — sum of <code>occurrences</code> across gates with the corresponding action.</li>
257
+ <li><strong>Hours saved</strong> — conservative 15-minute/incident estimate for debugging a repeated AI mistake × (blocks + warns).</li>
258
+ <li><strong>Dollars saved</strong> — blended per-call token estimate (2k input + 600 output) × blocks × 2026-04-15 Anthropic + OpenAI list prices. See <code>scripts/token-savings.js</code> for the full price snapshot.</li>
259
+ <li><strong>Bayes error rate</strong> — irreducible classifier error of the current risk scorer given its feature set. High values mean "add features, don't tune thresholds."</li>
260
+ </ul>
261
+ <p style="margin-top:12px;">Last auto-promotion: auto-entity-funnel-metric-roi on 2026-04-17. Regenerated on every release via <code>npm run numbers:generate</code> and on a weekly cadence.</p>
262
+ </div>
263
+
264
+ <div class="cta">
265
+ <a href="https://www.npmjs.com/package/thumbgate">Install ThumbGate — npx thumbgate init</a>
266
+ <div class="footer-note">Prefer the raw feed? See <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> or run <code>npm run gate:stats</code> locally.</div>
267
+ <div class="footer-note">Generated at 2026-04-20T21:45:34.500Z UTC.</div>
268
+ </div>
269
+ </main>
270
+ </body>
271
+ </html>
package/public/pro.html CHANGED
@@ -38,10 +38,15 @@ __GA_BOOTSTRAP__
38
38
  "description": "Paid ThumbGate lane for individual operators who want a personal local dashboard, DPO export, review-ready evidence, and founder support for risky AI coding workflows.",
39
39
  "url": "__APP_ORIGIN__/pro",
40
40
  "downloadUrl": "https://www.npmjs.com/package/thumbgate",
41
+ "dateModified": "2026-04-20",
41
42
  "creator": {
42
43
  "@type": "Person",
43
44
  "name": "Igor Ganapolsky",
44
- "url": "https://github.com/IgorGanapolsky"
45
+ "url": "https://github.com/IgorGanapolsky",
46
+ "sameAs": [
47
+ "https://github.com/IgorGanapolsky",
48
+ "https://www.linkedin.com/in/igorganapolsky"
49
+ ]
45
50
  },
46
51
  "featureList": [
47
52
  "Personal local dashboard",
@@ -801,6 +806,7 @@ __GA_BOOTSTRAP__
801
806
  <div class="panel hero-copy">
802
807
  <div class="eyebrow">Agent governance for engineering teams</div>
803
808
  <h1>One correction protects every agent on your team.</h1>
809
+ <p style="font-size:13px;opacity:0.8;margin-bottom:0.5rem;">Updated: <time datetime="2026-04-20">2026-04-20</time> · by <a href="https://github.com/IgorGanapolsky" style="color:inherit;">Igor Ganapolsky</a></p>
804
810
  <p>ThumbGate prevents unsafe AI agent actions before they hit shared repos, CI pipelines, and production. When one developer flags a bad pattern, every agent on the team is permanently blocked from repeating it.</p>
805
811
  <p>Open-source core for individuals. Team plan for shared enforcement, CI gates, approval policies, and audit trails across your engineering org.</p>
806
812
  <div class="hero-proof">
@@ -73,7 +73,8 @@ function processInlineFeedback({ signal, context, chatHistory, whatWentWrong, wh
73
73
  */
74
74
  function formatCliOutput(result) {
75
75
  const lines = [];
76
- const isDown = result.feedbackResult && result.feedbackResult.signal === 'negative';
76
+ const feedbackSignal = result.feedbackResult?.signal || result.feedbackResult?.feedbackEvent?.signal;
77
+ const isDown = ['down', 'negative', 'thumbs_down'].includes(feedbackSignal);
77
78
 
78
79
  // Header
79
80
  if (result.feedbackResult && result.feedbackResult.accepted !== false) {
@@ -10,6 +10,27 @@
10
10
  * Groups: capture | discovery | gates | export | ops | advanced
11
11
  */
12
12
 
13
+ function jsonFlag() {
14
+ return { name: 'json', type: 'boolean', description: 'Output as JSON' };
15
+ }
16
+
17
+ function discoveryCommand({
18
+ name,
19
+ aliases = [],
20
+ description,
21
+ mcpTool,
22
+ flags = [],
23
+ }) {
24
+ return {
25
+ name,
26
+ aliases,
27
+ description,
28
+ group: 'discovery',
29
+ ...(mcpTool ? { mcpTool } : {}),
30
+ flags,
31
+ };
32
+ }
33
+
13
34
  const CLI_COMMANDS = [
14
35
  // -------------------------------------------------------------------------
15
36
  // Capture
@@ -99,14 +120,32 @@ const CLI_COMMANDS = [
99
120
  { name: 'json', type: 'boolean', description: 'Output as JSON' },
100
121
  ],
101
122
  },
102
- {
123
+ discoveryCommand({
103
124
  name: 'doctor',
104
125
  description: 'Audit runtime isolation, bootstrap context, and permission tier',
105
- group: 'discovery',
126
+ flags: [jsonFlag()],
127
+ }),
128
+ discoveryCommand({
129
+ name: 'harness-audit',
130
+ aliases: ['harness'],
131
+ description: 'Score global docs, MCP discovery, and specialized gate harnesses',
106
132
  flags: [
107
- { name: 'json', type: 'boolean', description: 'Output as JSON' },
133
+ jsonFlag(),
134
+ { name: 'doc-token-budget', type: 'number', description: 'Global docs budget (default 9000)' },
108
135
  ],
109
- },
136
+ }),
137
+ discoveryCommand({
138
+ name: 'native-messaging-audit',
139
+ aliases: ['bridge-audit'],
140
+ description: 'Audit local browser native messaging hosts and AI browser bridges',
141
+ mcpTool: 'native_messaging_audit',
142
+ flags: [
143
+ jsonFlag(),
144
+ { name: 'platform', type: 'string', description: 'Override platform detection (darwin | linux | win32)' },
145
+ { name: 'home-dir', type: 'string', description: 'Override home directory for manifest discovery' },
146
+ { name: 'ai-only', type: 'boolean', description: 'Only report AI/browser bridge manifests' },
147
+ ],
148
+ }),
110
149
  {
111
150
  name: 'lesson-health',
112
151
  aliases: ['stale'],
@@ -1,6 +1,6 @@
1
1
  'use strict';
2
2
 
3
- const PRO_MONTHLY_PAYMENT_LINK = 'https://buy.stripe.com/7sYcN5bmIf5IcSd8qf3sI0a';
3
+ const PRO_MONTHLY_PAYMENT_LINK = 'https://thumbgate-production.up.railway.app/go/pro?utm_source=offer';
4
4
  const PRO_ANNUAL_PAYMENT_LINK = 'https://buy.stripe.com/3cI8wPfCYaPs2dzdKz3sI07';
5
5
 
6
6
  const PRO_MONTHLY_PRICE_ID = 'price_1THQY7GGBpd520QYHoS7RG0J';