thumbgate 1.15.0 → 1.16.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (129) hide show
  1. package/.claude-plugin/marketplace.json +6 -6
  2. package/.claude-plugin/plugin.json +3 -3
  3. package/.well-known/llms.txt +5 -5
  4. package/.well-known/mcp/server-card.json +1 -1
  5. package/README.md +59 -35
  6. package/adapters/chatgpt/openapi.yaml +118 -2
  7. package/adapters/claude/.mcp.json +2 -2
  8. package/adapters/mcp/server-stdio.js +210 -84
  9. package/adapters/opencode/opencode.json +1 -1
  10. package/bench/prompt-eval-suite.json +5 -1
  11. package/bin/cli.js +157 -8
  12. package/config/evals/agent-safety-eval.json +338 -22
  13. package/config/gates/routine.json +43 -0
  14. package/config/github-about.json +3 -3
  15. package/config/model-candidates.json +131 -0
  16. package/openapi/openapi.yaml +118 -2
  17. package/package.json +57 -49
  18. package/public/blog.html +7 -7
  19. package/public/codex-plugin.html +6 -6
  20. package/public/compare.html +29 -23
  21. package/public/dashboard.html +82 -10
  22. package/public/guide.html +28 -28
  23. package/public/index.html +216 -98
  24. package/public/learn.html +50 -22
  25. package/public/lessons.html +1 -1
  26. package/public/numbers.html +17 -17
  27. package/public/pro.html +82 -18
  28. package/scripts/agent-audit-trace.js +55 -0
  29. package/scripts/agent-memory-lifecycle.js +96 -0
  30. package/scripts/agent-readiness-plan.js +118 -0
  31. package/scripts/agentic-data-pipeline.js +21 -1
  32. package/scripts/agents-sdk-sandbox-plan.js +57 -0
  33. package/scripts/ai-org-governance.js +98 -0
  34. package/scripts/ai-search-distribution.js +43 -0
  35. package/scripts/artifact-agent-plan.js +81 -0
  36. package/scripts/billing.js +27 -8
  37. package/scripts/cli-schema.js +18 -2
  38. package/scripts/code-mode-mcp-plan.js +71 -0
  39. package/scripts/context-engine.js +1 -2
  40. package/scripts/context-manager.js +4 -1
  41. package/scripts/dashboard-render-spec.js +1 -1
  42. package/scripts/dashboard.js +275 -9
  43. package/scripts/decision-journal.js +13 -3
  44. package/scripts/document-workflow-governance.js +62 -0
  45. package/scripts/enterprise-agent-rollout.js +34 -0
  46. package/scripts/experience-replay-governance.js +69 -0
  47. package/scripts/export-hf-dataset.js +1 -1
  48. package/scripts/feedback-loop.js +92 -4
  49. package/scripts/feedback-to-rules.js +17 -23
  50. package/scripts/gates-engine.js +4 -6
  51. package/scripts/growth-campaigns.js +49 -0
  52. package/scripts/harness-selector.js +16 -4
  53. package/scripts/hybrid-supervisor-agent.js +64 -0
  54. package/scripts/inference-cache-policy.js +72 -0
  55. package/scripts/inference-economics.js +53 -0
  56. package/scripts/internal-agent-bootstrap.js +12 -2
  57. package/scripts/knowledge-layer-plan.js +108 -0
  58. package/scripts/lesson-inference.js +183 -44
  59. package/scripts/lesson-search.js +4 -1
  60. package/scripts/llm-client.js +157 -26
  61. package/scripts/mailer/resend-mailer.js +112 -1
  62. package/scripts/mcp-transport-strategy.js +66 -0
  63. package/scripts/memory-store-governance.js +60 -0
  64. package/scripts/meta-agent-loop.js +7 -13
  65. package/scripts/model-access-eligibility.js +38 -0
  66. package/scripts/model-migration-readiness.js +55 -0
  67. package/scripts/operational-integrity.js +96 -3
  68. package/scripts/otel-declarative-config.js +56 -0
  69. package/scripts/perplexity-client.js +1 -1
  70. package/scripts/post-training-governance.js +34 -0
  71. package/scripts/private-core-boundary.js +72 -0
  72. package/scripts/production-agent-readiness.js +40 -0
  73. package/scripts/prompt-eval.js +564 -32
  74. package/scripts/prompt-programs.js +93 -0
  75. package/scripts/provider-action-normalizer.js +585 -0
  76. package/scripts/scaling-law-claims.js +60 -0
  77. package/scripts/security-scanner.js +1 -1
  78. package/scripts/self-distill-agent.js +7 -32
  79. package/scripts/seo-gsd.js +232 -55
  80. package/scripts/skill-rag-router.js +53 -0
  81. package/scripts/spec-gate.js +1 -1
  82. package/scripts/student-consistent-training.js +73 -0
  83. package/scripts/synthetic-data-provenance.js +98 -0
  84. package/scripts/task-context-result.js +81 -0
  85. package/scripts/telemetry-analytics.js +149 -0
  86. package/scripts/thompson-sampling.js +2 -2
  87. package/scripts/token-savings.js +7 -6
  88. package/scripts/token-tco.js +46 -0
  89. package/scripts/tool-registry.js +63 -3
  90. package/scripts/verification-loop.js +10 -1
  91. package/scripts/verifier-scoring.js +71 -0
  92. package/scripts/workflow-sentinel.js +284 -28
  93. package/scripts/workspace-agent-routines.js +118 -0
  94. package/src/api/server.js +381 -120
  95. package/scripts/analytics-report.js +0 -328
  96. package/scripts/autonomous-workflow.js +0 -377
  97. package/scripts/billing-setup.js +0 -109
  98. package/scripts/creator-campaigns.js +0 -239
  99. package/scripts/cross-encoder-reranker.js +0 -235
  100. package/scripts/daemon-manager.js +0 -108
  101. package/scripts/decision-trace.js +0 -354
  102. package/scripts/delegation-runtime.js +0 -896
  103. package/scripts/dispatch-brief.js +0 -159
  104. package/scripts/distribution-surfaces.js +0 -110
  105. package/scripts/feedback-history-distiller.js +0 -382
  106. package/scripts/funnel-analytics.js +0 -35
  107. package/scripts/history-distiller.js +0 -200
  108. package/scripts/hosted-job-launcher.js +0 -256
  109. package/scripts/intent-router.js +0 -392
  110. package/scripts/lesson-reranker.js +0 -263
  111. package/scripts/lesson-retrieval.js +0 -148
  112. package/scripts/managed-lesson-agent.js +0 -183
  113. package/scripts/operational-dashboard.js +0 -103
  114. package/scripts/operational-summary.js +0 -129
  115. package/scripts/operator-artifacts.js +0 -608
  116. package/scripts/optimize-context.js +0 -17
  117. package/scripts/org-dashboard.js +0 -206
  118. package/scripts/partner-orchestration.js +0 -146
  119. package/scripts/predictive-insights.js +0 -356
  120. package/scripts/pulse.js +0 -80
  121. package/scripts/reflector-agent.js +0 -221
  122. package/scripts/sales-pipeline.js +0 -681
  123. package/scripts/session-episode-store.js +0 -329
  124. package/scripts/session-health-sensor.js +0 -242
  125. package/scripts/session-report.js +0 -120
  126. package/scripts/swarm-coordinator.js +0 -81
  127. package/scripts/tool-kpi-tracker.js +0 -12
  128. package/scripts/webhook-delivery.js +0 -62
  129. package/scripts/workflow-sprint-intake.js +0 -475
package/public/compare.html CHANGED
@@ -3,13 +3,13 @@
3
3
  <head>
4
4
  <meta charset="UTF-8">
5
5
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
- <title>Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)</title>
6
+ <title>Best Pre-Action Check Tools for AI Coding Agents (2026 Comparison)</title>
7
7
  <!-- Privacy-friendly analytics by Plausible -->
8
8
  <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
9
- <meta name="description" content="Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes.">
10
- <meta name="keywords" content="AI agent safety, pre-action gates, AI coding agent comparison, ThumbGate vs manual review, AI agent guardrails, PreToolUse hooks, Claude Code safety, Codex safety, Gemini safety, Cursor rules alternative">
11
- <meta property="og:title" content="Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)">
12
- <meta property="og:description" content="Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes.">
9
+ <meta name="description" content="Compare pre-action check tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes.">
10
+ <meta name="keywords" content="AI agent safety, pre-action checks, AI coding agent comparison, ThumbGate vs manual review, AI agent guardrails, PreToolUse hooks, Claude Code safety, Codex safety, Gemini safety, Cursor rules alternative">
11
+ <meta property="og:title" content="Best Pre-Action Check Tools for AI Coding Agents (2026 Comparison)">
12
+ <meta property="og:description" content="Compare pre-action check tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes.">
13
13
  <meta property="og:type" content="article">
14
14
  <meta property="og:url" content="https://thumbgate-production.up.railway.app/compare">
15
15
  <link rel="canonical" href="https://thumbgate-production.up.railway.app/compare">
@@ -18,8 +18,8 @@
18
18
  {
19
19
  "@context": "https://schema.org",
20
20
  "@type": "TechArticle",
21
- "headline": "Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)",
22
- "description": "Compare pre-action gate tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes vs Cursor rules vs linters.",
21
+ "headline": "Best Pre-Action Check Tools for AI Coding Agents (2026 Comparison)",
22
+ "description": "Compare pre-action check tools that prevent AI coding agents from making costly mistakes. ThumbGate vs manual review vs post-hoc fixes vs Cursor rules vs linters.",
23
23
  "author": {
24
24
  "@type": "Person",
25
25
  "name": "Igor Ganapolsky",
@@ -43,10 +43,10 @@
43
43
  "mainEntity": [
44
44
  {
45
45
  "@type": "Question",
46
- "name": "What is a pre-action gate for AI coding agents?",
46
+ "name": "What is a pre-action check for AI coding agents?",
47
47
  "acceptedAnswer": {
48
48
  "@type": "Answer",
49
- "text": "A pre-action gate is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action gates physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests. ThumbGate implements pre-action gates via PreToolUse hooks that fire before every tool call."
49
+ "text": "A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests. ThumbGate implements pre-action checks via PreToolUse hooks that fire before every tool call."
50
50
  }
51
51
  },
52
52
  {
@@ -54,7 +54,7 @@
54
54
  "name": "Does ThumbGate work with Claude Code?",
55
55
  "acceptedAnswer": {
56
56
  "@type": "Answer",
57
- "text": "Yes. ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent. Run npx thumbgate init --agent claude-code to auto-configure PreToolUse hooks in your .claude/settings.json."
57
+ "text": "Yes. ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and any MCP-compatible agent. Run npx thumbgate init --agent claude-code to auto-configure PreToolUse hooks in your .claude/settings.json."
58
58
  }
59
59
  },
60
60
  {
@@ -78,7 +78,7 @@
78
78
  "name": "Can ThumbGate learn from mistakes automatically?",
79
79
  "acceptedAnswer": {
80
80
  "@type": "Answer",
81
- "text": "Yes. When your AI agent makes a mistake, you give a thumbs-down with context. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule and wires it as a pre-action gate. Gates adapt their sensitivity over time using Thompson Sampling, a Bayesian multi-armed bandit algorithm."
81
+ "text": "Yes. When your AI agent makes a mistake, you give a thumbs-down with context. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule and wires it as a pre-action check. Checks adapt their sensitivity over time using Thompson Sampling, a Bayesian multi-armed bandit algorithm."
82
82
  }
83
83
  }
84
84
  ]
@@ -146,7 +146,7 @@
146
146
  <div class="container">
147
147
  <p class="breadcrumb"><a href="/">Home</a> / Compare</p>
148
148
 
149
- <h1>Best Pre-Action Gate Tools for AI Coding Agents (2026 Comparison)</h1>
149
+ <h1>Best Pre-Action Check Tools for AI Coding Agents (2026 Comparison)</h1>
150
150
  <p style="color:var(--muted);">Your AI coding agent force-pushed to main again. Which tool actually prevents that? We compared the five most common approaches to AI agent safety.</p>
151
151
 
152
152
  <h2>Comparison Table</h2>
@@ -209,7 +209,7 @@
209
209
  <td class="no">No</td>
210
210
  </tr>
211
211
  <tr>
212
- <td>Real-time pre-action gates</td>
212
+ <td>Real-time pre-action checks</td>
213
213
  <td class="yes">Yes -- fires before every tool call</td>
214
214
  <td class="no">No -- asynchronous review</td>
215
215
  <td class="no">No -- reactive only</td>
@@ -238,11 +238,17 @@
238
238
  <h2>Why ThumbGate Wins</h2>
239
239
  <ul>
240
240
  <li><strong>Enforcement, not suggestions.</strong> Prompt rules in CLAUDE.md or .cursorrules are instructions the agent can ignore. ThumbGate intercepts tool calls at the PreToolUse hook level and physically blocks dangerous actions before they execute.</li>
241
- <li><strong>Learns and adapts automatically.</strong> Every thumbs-down becomes a data point. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule. Gates adapt their sensitivity over time using Thompson Sampling -- aggressive gates that over-block get tuned down, effective gates get reinforced.</li>
242
- <li><strong>Works across all major AI coding agents.</strong> One install command covers Claude Code, Cursor, Codex, Gemini CLI, Amp, and OpenCode. No per-agent configuration needed.</li>
241
+ <li><strong>Learns and adapts automatically.</strong> Every thumbs-down becomes a data point. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule. Checks adapt their sensitivity over time using Thompson Sampling -- aggressive checks that over-block get tuned down, effective checks get reinforced.</li>
242
+ <li><strong>Works across all major AI coding agents.</strong> One install command covers Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, and OpenCode. No per-agent configuration needed.</li>
243
243
  <li><strong>Prevention is cheaper than recovery.</strong> Manual code review catches mistakes after the PR. Git revert catches them after the push. ThumbGate catches them before the tool call executes -- saving the time, context switches, and cleanup cost of undoing damage.</li>
244
244
  </ul>
245
245
 
246
+ <div class="card">
247
+ <h3>Evaluating bigger orchestration platforms?</h3>
248
+ <p>Journey orchestration and AI workflow routing are different from execution enforcement. If you are comparing ThumbGate to a broader AI orchestration stack, start here.</p>
249
+ <p><a href="/compare/ai-experience-orchestration" class="cta">Read orchestration vs enforcement</a></p>
250
+ </div>
251
+
246
252
  <h2>How It Works</h2>
247
253
  <div class="step-grid">
248
254
  <div class="step-card">
@@ -252,8 +258,8 @@
252
258
  </div>
253
259
  <div class="step-card">
254
260
  <div class="step-number">2</div>
255
- <h3>Gate</h3>
256
- <p>Every tool call your agent makes passes through a pre-action gate. Known-bad patterns are blocked before execution. Good actions pass through instantly.</p>
261
+ <h3>Check</h3>
262
+ <p>Every tool call your agent makes passes through a pre-action check. Known-bad patterns are blocked before execution. Good actions pass through instantly.</p>
257
263
  </div>
258
264
  <div class="step-card">
259
265
  <div class="step-number">3</div>
@@ -276,18 +282,18 @@
276
282
  <h2>Frequently Asked Questions</h2>
277
283
 
278
284
  <div class="card">
279
- <h3>What is a pre-action gate?</h3>
280
- <p>A pre-action gate is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action gates physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests.</p>
285
+ <h3>What is a pre-action check?</h3>
286
+ <p>A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests.</p>
281
287
  </div>
282
288
 
283
289
  <div class="card">
284
290
  <h3>Does ThumbGate work with Claude Code?</h3>
285
- <p>Yes. ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and any MCP-compatible agent. Run <code>npx thumbgate init --agent claude-code</code> to auto-configure PreToolUse hooks.</p>
291
+ <p>Yes. ThumbGate works with Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and any MCP-compatible agent. Run <code>npx thumbgate init --agent claude-code</code> to auto-configure PreToolUse hooks.</p>
286
292
  </div>
287
293
 
288
294
  <div class="card">
289
295
  <h3>Is ThumbGate free?</h3>
290
- <p>ThumbGate has a free tier that includes local enforcement with 3 daily feedback captures, 5 lesson searches, unlimited recall, and pre-action gate blocking. Pro ($19/mo or $149/yr) adds a personal local dashboard and DPO export. Team rollout ($49/seat/mo) adds a shared lesson database and org dashboard.</p>
296
+ <p>ThumbGate has a free tier that includes local enforcement with 3 daily feedback captures, 5 lesson searches, unlimited recall, and pre-action check blocking. Pro ($19/mo or $149/yr) adds a personal local dashboard and DPO export. Team rollout ($49/seat/mo) adds a shared lesson database and org dashboard.</p>
291
297
  </div>
292
298
 
293
299
  <div class="card">
@@ -297,13 +303,13 @@
297
303
 
298
304
  <div class="card">
299
305
  <h3>Can ThumbGate learn from mistakes automatically?</h3>
300
- <p>Yes. When your AI agent makes a mistake, give a thumbs-down with context. In the current Claude auto-capture path, vague negative signals can reuse up to 8 prior recorded entries plus the failed tool call, then stay linked to a 60-second follow-up session. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule and wires it as a pre-action gate. Gates adapt over time using Thompson Sampling, a Bayesian multi-armed bandit algorithm.</p>
306
+ <p>Yes. When your AI agent makes a mistake, give a thumbs-down with context. In the current Claude auto-capture path, vague negative signals can reuse up to 8 prior recorded entries plus the failed tool call, then stay linked to a 60-second follow-up session. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule and wires it as a pre-action check. Checks adapt over time using Thompson Sampling, a Bayesian multi-armed bandit algorithm.</p>
301
307
  </div>
302
308
 
303
309
  </div>
304
310
 
305
311
  <footer>
306
- <p>ThumbGate -- Pre-action gates for AI coding agents</p>
312
+ <p>ThumbGate -- Pre-action checks for AI coding agents</p>
307
313
  <p><a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> | <a href="https://www.npmjs.com/package/thumbgate">npm</a> | <a href="/guide">Guide</a> | <a href="/dashboard">Dashboard</a></p>
308
314
  </footer>
309
315
  </body>
package/public/dashboard.html CHANGED
@@ -4,7 +4,7 @@
4
4
  <meta charset="UTF-8">
5
5
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
6
  <title>ThumbGate Dashboard — Gate Stats, Approval Rate, Prevention Impact</title>
7
- <meta name="description" content="Live dashboard showing gate enforcement stats, approval rate trends, prevention impact, and system health for ThumbGate pre-action gates.">
7
+ <meta name="description" content="Live dashboard showing gate enforcement stats, approval rate trends, prevention impact, and system health for ThumbGate pre-action checks.">
8
8
  <link rel="canonical" href="https://thumbgate-production.up.railway.app/dashboard">
9
9
  <link rel="icon" type="image/png" href="/thumbgate-icon.png">
10
10
  <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg">
@@ -221,7 +221,7 @@
221
221
  <div style="margin:0 0 24px;padding:24px;background:linear-gradient(135deg,rgba(34,211,238,0.08),rgba(74,222,128,0.05));border:1px solid rgba(34,211,238,0.2);border-radius:12px;">
222
222
  <h1 style="font-size:22px;font-weight:700;margin-bottom:8px;letter-spacing:-0.02em;">🔍 Operations Dashboard</h1>
223
223
  <p style="font-size:12px;color:var(--text-muted);margin-bottom:8px;">Updated: <time datetime="2026-04-20">2026-04-20</time> · by <a href="https://github.com/IgorGanapolsky" style="color:inherit;">Igor Ganapolsky</a></p>
224
- <p style="font-size:14px;color:var(--text-muted);line-height:1.6;max-width:700px;">What's happening right now? Search memories, inspect active gates, manage your team, and export training data. <span style="color:var(--cyan);font-weight:600;">This is your control plane for AI agent behavior.</span></p>
224
+ <p style="font-size:14px;color:var(--text-muted);line-height:1.6;max-width:700px;">What's happening right now? Search memories, inspect active checks, manage your team, and export training data. <span style="color:var(--cyan);font-weight:600;">This is your control plane for AI agent behavior.</span></p>
225
225
  <div style="display:flex;gap:16px;margin-top:12px;font-size:12px;color:var(--text-muted);">
226
226
  <span>🔍 <strong style="color:var(--text);">Search</strong> — find any memory</span>
227
227
  <span>🛡️ <strong style="color:var(--text);">Gates</strong> — what's blocking</span>
@@ -240,7 +240,7 @@
240
240
  <a class="stat-card" data-card-action="all" onclick="selectCard(this,'all')" href="/lessons" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view all feedback → Lessons page"><div class="stat-label">Total Feedback</div><div class="stat-value cyan" id="statTotal">—</div></a>
241
241
  <a class="stat-card" data-card-action="up" onclick="selectCard(this,'up')" href="/lessons?signal=positive" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view positive feedback → Lessons page"><div class="stat-label">👍 Positive</div><div class="stat-value green" id="statPositive">—</div></a>
242
242
  <a class="stat-card" data-card-action="down" onclick="selectCard(this,'down')" href="/lessons?signal=negative" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view negative feedback → Lessons page"><div class="stat-label">👎 Negative</div><div class="stat-value red" id="statNegative">—</div></a>
243
- <a class="stat-card" data-card-action="gates" onclick="selectCard(this,'gates');return false;" href="#" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view active gates"><div class="stat-label">Active Gates</div><div class="stat-value cyan" id="statGates">—</div></a>
243
+ <a class="stat-card" data-card-action="gates" onclick="selectCard(this,'gates');return false;" href="#" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view active checks"><div class="stat-label">Active Gates</div><div class="stat-value cyan" id="statGates">—</div></a>
244
244
  </div>
245
245
 
246
246
  <div class="panel" id="reviewDeltaPanel" style="margin-bottom:20px;">
@@ -303,7 +303,7 @@
303
303
  <!-- GATES TAB -->
304
304
  <div class="tab-content" id="tab-gates">
305
305
  <div class="gates-section">
306
- <h2>Active Pre-Action Gates</h2>
306
+ <h2>Active Pre-Action Checks</h2>
307
307
  <div id="gatesList"><div class="loading">Loading gates...</div></div>
308
308
  </div>
309
309
  </div>
@@ -445,7 +445,7 @@
445
445
  <div>
446
446
  <div style="font-size:32px;margin-bottom:8px;">🛡️</div>
447
447
  <div style="font-size:13px;font-weight:600;margin-bottom:4px;">3. Gate Promoted</div>
448
- <div style="font-size:12px;color:var(--text-muted);">Repeated lessons auto-promote into pre-action gates</div>
448
+ <div style="font-size:12px;color:var(--text-muted);">Repeated lessons auto-promote into pre-action checks</div>
449
449
  </div>
450
450
  <div>
451
451
  <div style="font-size:32px;margin-bottom:8px;">🚫</div>
@@ -523,6 +523,10 @@ async function connect(options) {
523
523
  renderStats(data);
524
524
  setSelectedCard('all');
525
525
  await loadDashboardData();
526
+ // Open a live-events stream so feedback/rule-regen events surface
527
+ // without a manual refresh. Non-fatal: if the browser doesn't support
528
+ // ReadableStream over fetch (very old), we simply stay on the polled path.
529
+ subscribeToLiveEvents();
526
530
  } catch (e) {
527
531
  status.className = 'auth-status err';
528
532
  status.textContent = '✗ ' + e.message;
@@ -756,6 +760,74 @@ async function loadDashboardData() {
756
760
  } catch (e) { /* insights degrade gracefully */ }
757
761
  }
758
762
 
763
+ // Live-events SSE subscription. We use fetch() + ReadableStream instead of
764
+ // the native EventSource because EventSource can't attach our Bearer auth
765
+ // header. On any event we re-fetch the stats/dashboard summary — cheap, and
766
+ // avoids having to duplicate rendering logic per event type.
767
+ var __liveEventsController = null;
768
+ async function subscribeToLiveEvents() {
769
+ if (__liveEventsController) {
770
+ try { __liveEventsController.abort(); } catch (_) { /* already aborted */ }
771
+ }
772
+ if (typeof AbortController === 'undefined' || !window.fetch) return;
773
+ var controller = new AbortController();
774
+ __liveEventsController = controller;
775
+ try {
776
+ var res = await fetch('/v1/events', {
777
+ headers: { 'Authorization': 'Bearer ' + API_KEY },
778
+ signal: controller.signal,
779
+ });
780
+ if (!res.ok || !res.body || !res.body.getReader) return;
781
+ var reader = res.body.getReader();
782
+ var decoder = new TextDecoder('utf-8');
783
+ var buffer = '';
784
+ while (true) {
785
+ var chunk = await reader.read();
786
+ if (chunk.done) break;
787
+ buffer += decoder.decode(chunk.value, { stream: true });
788
+ var frames = buffer.split('\n\n');
789
+ buffer = frames.pop() || '';
790
+ for (var i = 0; i < frames.length; i++) {
791
+ handleLiveEventFrame(frames[i]);
792
+ }
793
+ }
794
+ } catch (e) {
795
+ // AbortError fires on logout/reconnect — not worth surfacing to the user.
796
+ }
797
+ }
798
+
799
+ function handleLiveEventFrame(frame) {
800
+ if (!frame || frame.charAt(0) === ':') return; // heartbeat comment
801
+ var eventName = 'message';
802
+ var dataLines = [];
803
+ var lines = frame.split('\n');
804
+ for (var i = 0; i < lines.length; i++) {
805
+ var line = lines[i];
806
+ if (line.indexOf('event:') === 0) eventName = line.slice(6).trim();
807
+ else if (line.indexOf('data:') === 0) dataLines.push(line.slice(5).trim());
808
+ }
809
+ if (!dataLines.length) return;
810
+ var payload;
811
+ try { payload = JSON.parse(dataLines.join('\n')); } catch (_) { return; }
812
+ onLiveEvent(eventName, payload);
813
+ }
814
+
815
+ function onLiveEvent(eventName, payload) {
816
+ // All events currently boil down to "something changed, re-pull summary".
817
+ // When we add richer partial updates we can branch on eventName here.
818
+ if (eventName === 'connected') return;
819
+ refreshStatsOnly();
820
+ }
821
+
822
+ async function refreshStatsOnly() {
823
+ try {
824
+ var res = await fetch('/v1/feedback/stats', { headers: getHeaders() });
825
+ if (!res.ok) return;
826
+ var data = await res.json();
827
+ renderStats(data);
828
+ } catch (_) { /* ignore transient errors */ }
829
+ }
830
+
759
831
  function formatReviewTimestamp(value) {
760
832
  if (!value) return 'Not reviewed yet';
761
833
  var date = new Date(value);
@@ -824,7 +896,7 @@ function renderDashboardData(data) {
824
896
  const gateStats = data.gateStats || {};
825
897
  document.getElementById('statGates').textContent = gates.length || gateStats.totalGates || 0;
826
898
  if (!gates.length) {
827
- document.getElementById('gatesList').innerHTML = '<div class="empty">No active gates</div>';
899
+ document.getElementById('gatesList').innerHTML = '<div class="empty">No active checks</div>';
828
900
  } else {
829
901
  document.getElementById('gatesList').innerHTML = gates.map(function(g) {
830
902
  const action = g.action || 'block';
@@ -1147,7 +1219,7 @@ function renderTemplates(templateLibrary) {
1147
1219
  '<div class="template-pattern">' + escHtml(template.pattern || '') + '</div>' +
1148
1220
  '</div>';
1149
1221
  }).join('')
1150
- : '<div class="empty">No gate templates available</div>';
1222
+ : '<div class="empty">No check templates available</div>';
1151
1223
  }
1152
1224
 
1153
1225
  document.addEventListener('click', function(event) {
@@ -1211,9 +1283,9 @@ function loadDemo() {
1211
1283
  document.getElementById('reviewCheckpointBtn').textContent = 'Connect to save your own review checkpoint';
1212
1284
  // Sample memories — realistic scenarios from real agent-driven development
1213
1285
  var demoResults = [
1214
- { signal: 'down', title: 'Claimed fix worked without running tests', context: 'Agent announced "fixed and pushed" but never ran the test suite. CI failed on 3 tests. Gate now requires test evidence before any completion claim.', tags: ['anti-lying', 'verification-gap', 'ci', 'trust-breach'], timestamp: '2025-06-22T10:20:00Z' },
1215
- { signal: 'down', title: 'Force-pushed to main and lost teammate commits', context: 'Used git push --force on main to fix a rebase. Overwrote 3 commits from another team member. Had to recover from reflog. Gate now blocks all --force pushes to protected branches.', tags: ['git', 'destructive', 'auto-blocked'], timestamp: '2025-06-20T09:15:00Z' },
1216
- { signal: 'up', title: 'Pre-action gate caught .env commit', context: 'Gate blocked a git add that included .env with production API keys. Saved from leaking secrets to a public repo.', tags: ['security', 'prevention', 'secrets'], timestamp: '2025-06-19T11:30:00Z' },
1286
+ { signal: 'down', title: 'Claimed fix worked without running tests', context: 'Agent announced "fixed and pushed" but never ran the test suite. CI failed on 3 tests. Check now requires test evidence before any completion claim.', tags: ['anti-lying', 'verification-gap', 'ci', 'trust-breach'], timestamp: '2025-06-22T10:20:00Z' },
1287
+ { signal: 'down', title: 'Force-pushed to main and lost teammate commits', context: 'Used git push --force on main to fix a rebase. Overwrote 3 commits from another team member. Had to recover from reflog. Check now blocks all --force pushes to protected branches.', tags: ['git', 'destructive', 'auto-blocked'], timestamp: '2025-06-20T09:15:00Z' },
1288
+ { signal: 'up', title: 'Pre-action check caught .env commit', context: 'Check blocked a git add that included .env with production API keys. Saved from leaking secrets to a public repo.', tags: ['security', 'prevention', 'secrets'], timestamp: '2025-06-19T11:30:00Z' },
1217
1289
  { signal: 'down', title: 'PR scope creep — 72 changed files for a 2-file fix', context: 'Agent included unrelated formatting changes, config files, and lock file updates in a PR that should have touched 2 files. User had to manually separate the changes.', tags: ['pr-scope', 'scope-creep', 'user-frustration', 'git-workflow'], timestamp: '2025-06-18T14:30:00Z' },
1218
1290
  { signal: 'up', title: 'Full PR review cycle with on-device verification', context: 'Fixed 3 review findings, verified on physical Android device with fresh debug build, confirmed Delete Account flow end-to-end before marking PR ready.', tags: ['pr-review', 'on-device-verification', 'evidence-based', 'metric:ROI'], timestamp: '2025-06-17T16:45:00Z' },
1219
1291
  { signal: 'down', title: 'Claimed Figma compliance without visual verification', context: 'Said UI matched Figma designs without actually checking. User pointed out wrong colors, missing spacing, and incorrect font weights. Should have used screenshot comparison.', tags: ['anti-lying', 'figma', 'visual-verification', 'trust-breach'], timestamp: '2025-06-16T08:05:00Z' },
package/public/guide.html CHANGED
@@ -6,10 +6,10 @@
6
6
  <title>How to Stop AI Coding Agents From Repeating Mistakes — ThumbGate Guide</title>
7
7
  <!-- Privacy-friendly analytics by Plausible -->
8
8
  <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
9
- <meta name="description" content="The complete guide to preventing AI coding agent mistakes with pre-action gates, history-aware lesson distillation, and automatic prevention rules.">
10
- <meta name="keywords" content="AI agent mistakes, Claude Code force push, AI coding agent memory, MCP server guardrails, pre-action gates, vibe coding safety, PreToolUse hooks, ThumbGate, SpecLock alternative, Mem0 alternative">
9
+ <meta name="description" content="The complete guide to preventing AI coding agent mistakes with pre-action checks, history-aware lesson distillation, and automatic prevention rules.">
10
+ <meta name="keywords" content="AI agent mistakes, Claude Code force push, AI coding agent memory, MCP server guardrails, pre-action checks, vibe coding safety, PreToolUse hooks, ThumbGate, SpecLock alternative, Mem0 alternative">
11
11
  <meta property="og:title" content="How to Stop AI Coding Agents From Repeating Mistakes">
12
- <meta property="og:description" content="Pre-action gates that physically block AI agents from repeating known mistakes. The complete guide.">
12
+ <meta property="og:description" content="Pre-action checks that physically block AI agents from repeating known mistakes. The complete guide.">
13
13
  <meta property="og:type" content="article">
14
14
  <meta property="og:url" content="https://thumbgate-production.up.railway.app/guide">
15
15
  <link rel="canonical" href="https://thumbgate-production.up.railway.app/guide">
@@ -19,7 +19,7 @@
19
19
  "@context": "https://schema.org",
20
20
  "@type": "TechArticle",
21
21
  "headline": "How to Stop AI Coding Agents From Repeating Mistakes",
22
- "description": "Complete guide to preventing AI agent mistakes with pre-action gates, feedback capture, history-aware lesson distillation, and automatic prevention rule generation.",
22
+ "description": "Complete guide to preventing AI agent mistakes with pre-action checks, feedback capture, history-aware lesson distillation, and automatic prevention rule generation.",
23
23
  "author": {
24
24
  "@type": "Person",
25
25
  "name": "Igor Ganapolsky",
@@ -36,7 +36,7 @@
36
36
  "about": [
37
37
  {"@type": "Thing", "name": "AI coding agents"},
38
38
  {"@type": "Thing", "name": "Model Context Protocol"},
39
- {"@type": "Thing", "name": "pre-action gates"}
39
+ {"@type": "Thing", "name": "pre-action checks"}
40
40
  ]
41
41
  }
42
42
  </script>
@@ -64,12 +64,12 @@
64
64
  "@type": "HowToStep",
65
65
  "position": 3,
66
66
  "name": "Feedback auto-promotes to prevention rules",
67
- "text": "After repeated failures, ThumbGate generates a prevention rule and wires it as a pre-action gate."
67
+ "text": "After repeated failures, ThumbGate generates a prevention rule and wires it as a pre-action check."
68
68
  },
69
69
  {
70
70
  "@type": "HowToStep",
71
71
  "position": 4,
72
- "name": "Gates block mistakes before they happen",
72
+ "name": "Checks block mistakes before they happen",
73
73
  "text": "PreToolUse hooks intercept tool calls and check them against known failure patterns. Bad actions are blocked before execution."
74
74
  }
75
75
  ]
@@ -86,7 +86,7 @@
86
86
  "name": "How do I stop my AI coding agent from repeating mistakes?",
87
87
  "acceptedAnswer": {
88
88
  "@type": "Answer",
89
- "text": "Install ThumbGate (npx thumbgate init). When your agent makes a mistake, give it a thumbs-down with context. ThumbGate captures the feedback, and after repeated failures, auto-generates a prevention rule. Pre-action gates then block the same mistake before it executes in future sessions."
89
+ "text": "Install ThumbGate (npx thumbgate init). When your agent makes a mistake, give it a thumbs-down with context. ThumbGate captures the feedback, and after repeated failures, auto-generates a prevention rule. Pre-action checks then block the same mistake before it executes in future sessions."
90
90
  }
91
91
  },
92
92
  {
@@ -94,15 +94,15 @@
94
94
  "name": "Why does my Claude Code agent keep force-pushing to main?",
95
95
  "acceptedAnswer": {
96
96
  "@type": "Answer",
97
- "text": "Because prompt rules are suggestions the agent can ignore. ThumbGate solves this with enforcement: a PreToolUse hook fires before every tool call and checks it against known failure patterns. If the action matches a gate (like git push --force to main), it is physically blocked before execution."
97
+ "text": "Because prompt rules are suggestions the agent can ignore. ThumbGate solves this with enforcement: a PreToolUse hook fires before every tool call and checks it against known failure patterns. If the action matches a check (like git push --force to main), it is physically blocked before execution."
98
98
  }
99
99
  },
100
100
  {
101
101
  "@type": "Question",
102
- "name": "What is the difference between pre-action gates and prompt rules?",
102
+ "name": "What is the difference between pre-action checks and prompt rules?",
103
103
  "acceptedAnswer": {
104
104
  "@type": "Answer",
105
- "text": "Prompt rules (like CLAUDE.md or .cursorrules) are instructions the agent may ignore. Pre-action gates are enforcement: they intercept the tool call at the PreToolUse hook level and block it before execution. Gates are auto-generated from feedback and use Thompson Sampling to adapt their sensitivity."
105
+ "text": "Prompt rules (like CLAUDE.md or .cursorrules) are instructions the agent may ignore. Pre-action checks are enforcement: they intercept the tool call at the PreToolUse hook level and block it before execution. Checks are auto-generated from feedback and use Thompson Sampling to adapt their sensitivity."
106
106
  }
107
107
  },
108
108
  {
@@ -126,7 +126,7 @@
126
126
  "name": "Does AI agent memory persist across sessions?",
127
127
  "acceptedAnswer": {
128
128
  "@type": "Answer",
129
- "text": "With ThumbGate, yes. Feedback is stored in a local SQLite database with FTS5 indexing. Prevention rules and gates persist across sessions. The recall tool injects relevant context at session start, and session handoff preserves continuity."
129
+ "text": "With ThumbGate, yes. Feedback is stored in a local SQLite database with FTS5 indexing. Prevention rules and checks persist across sessions. The recall tool injects relevant context at session start, and session handoff preserves continuity."
130
130
  }
131
131
  },
132
132
  {
@@ -134,7 +134,7 @@
134
134
  "name": "How do I set up PreToolUse hooks in Claude Code?",
135
135
  "acceptedAnswer": {
136
136
  "@type": "Answer",
137
- "text": "Run npx thumbgate init --agent claude-code. This auto-configures PreToolUse hooks in your .claude/settings.json. The hooks fire before every tool call and check it against your prevention rules and gates."
137
+ "text": "Run npx thumbgate init --agent claude-code. This auto-configures PreToolUse hooks in your .claude/settings.json. The hooks fire before every tool call and check it against your prevention rules and checks."
138
138
  }
139
139
  },
140
140
  {
@@ -201,14 +201,14 @@
201
201
  <p class="breadcrumb"><a href="/">Home</a> / Guide</p>
202
202
 
203
203
  <h1>How to Stop AI Coding Agents From Repeating Mistakes</h1>
204
- <p style="color:var(--muted);">The complete guide to pre-action gates, feedback capture, history-aware lesson distillation, and automatic prevention rules.</p>
204
+ <p style="color:var(--muted);">The complete guide to pre-action checks, feedback capture, history-aware lesson distillation, and automatic prevention rules.</p>
205
205
 
206
206
  <h2>The Problem</h2>
207
207
  <p>Your AI coding agent force-pushes to main. You correct it. Next session, it force-pushes again. You add a rule to CLAUDE.md. It ignores it. You lose an afternoon reverting.</p>
208
208
  <p>This happens because <strong>prompt rules are suggestions</strong>. The agent can read them, forget them, or override them. There is no enforcement at the tool-call level.</p>
209
209
 
210
- <h2>The Fix: Pre-Action Gates</h2>
211
- <p>ThumbGate adds an enforcement layer between your agent and its tools. When the agent tries to execute a tool call, a <code>PreToolUse</code> hook fires <em>before</em> the action runs. The hook checks the call against known failure patterns. If it matches a gate, the action is blocked.</p>
210
+ <h2>The Fix: Pre-Action Checks</h2>
211
+ <p>ThumbGate adds an enforcement layer between your agent and its tools. When the agent tries to execute a tool call, a <code>PreToolUse</code> hook fires <em>before</em> the action runs. The hook checks the call against known failure patterns. If it matches a check, the action is blocked.</p>
212
212
 
213
213
  <div class="card">
214
214
  <h3>Before ThumbGate</h3>
@@ -216,9 +216,9 @@
216
216
  Result: Force-pushed. You lose 3 commits. Again.</code></pre>
217
217
  <h3>After ThumbGate</h3>
218
218
  <pre><code>Agent: git push --force origin main
219
- [gate] Blocked: no-force-push (confidence: 0.94)
219
+ [check] Blocked: no-force-push (confidence: 0.94)
220
220
  Agent: git push origin feature-branch
221
- [gate] Passed</code></pre>
221
+ [check] Passed</code></pre>
222
222
  </div>
223
223
 
224
224
  <h2>Install (One Command)</h2>
@@ -249,11 +249,11 @@ npx thumbgate init --agent gemini</code></pre>
249
249
  <h3>2. Feedback auto-promotes to prevention rules</h3>
250
250
  <p>After repeated failures with the same pattern, ThumbGate generates a prevention rule automatically. No manual rule writing needed.</p>
251
251
 
252
- <h3>3. Rules become gates</h3>
253
- <p>Prevention rules are enforced as pre-action gates. The gate fires at the <code>PreToolUse</code> hook level — inside the agent's runtime, before the tool call executes.</p>
252
+ <h3>3. Rules become checks</h3>
253
+ <p>Prevention rules are enforced as pre-action checks. The check fires at the <code>PreToolUse</code> hook level — inside the agent's runtime, before the tool call executes.</p>
254
254
 
255
- <h3>4. Gates adapt via Thompson Sampling</h3>
256
- <p>Gates that block too aggressively (high false-positive rate) get their confidence reduced automatically. Gates that catch real mistakes get reinforced. This is Bayesian multi-armed bandit optimization, not static rules.</p>
255
+ <h3>4. Checks adapt via Thompson Sampling</h3>
256
+ <p>Checks that block too aggressively (high false-positive rate) get their confidence reduced automatically. Checks that catch real mistakes get reinforced. This is Bayesian multi-armed bandit optimization, not static rules.</p>
257
257
 
258
258
  <h2>Memory That Persists Across Sessions</h2>
259
259
  <p>ThumbGate stores feedback in a local SQLite database with FTS5 full-text indexing. Lookups are sub-millisecond even at tens of thousands of entries. Old entries that contradict newer evidence are auto-pruned via Bayesian belief decay.</p>
@@ -273,9 +273,9 @@ npx thumbgate init --agent gemini</code></pre>
273
273
  <li><code>reflect_on_feedback</code> proposes a reusable rule from the same transcript when the failure pattern is obvious.</li>
274
274
  </ul>
275
275
 
276
- <h2>Pre-Action Gates vs Prompt Rules</h2>
276
+ <h2>Pre-Action Checks vs Prompt Rules</h2>
277
277
  <table class="comparison-table">
278
- <tr><th>Feature</th><th>Prompt Rules</th><th>Pre-Action Gates</th></tr>
278
+ <tr><th>Feature</th><th>Prompt Rules</th><th>Pre-Action Checks</th></tr>
279
279
  <tr><td>Where they live</td><td>CLAUDE.md, .cursorrules</td><td>PreToolUse hooks</td></tr>
280
280
  <tr><td>Enforcement</td><td>Suggestion (can be ignored)</td><td>Blocks execution</td></tr>
281
281
  <tr><td>When they fire</td><td>At prompt load</td><td>Before every tool call</td></tr>
@@ -287,7 +287,7 @@ npx thumbgate init --agent gemini</code></pre>
287
287
  <h2>ThumbGate vs Alternatives</h2>
288
288
  <table class="comparison-table">
289
289
  <tr><th>Feature</th><th>ThumbGate</th><th>SpecLock</th><th>Mem0</th></tr>
290
- <tr><td>Blocks mistakes before execution</td><td>Yes — PreToolUse gates</td><td>Yes — Patch Firewall</td><td>No</td></tr>
290
+ <tr><td>Blocks mistakes before execution</td><td>Yes — PreToolUse checks</td><td>Yes — Patch Firewall</td><td>No</td></tr>
291
291
  <tr><td>Learns from feedback</td><td>Yes — thumbs up/down</td><td>No — manual specs</td><td>Yes — auto-capture</td></tr>
292
292
  <tr><td>Auto-generates rules</td><td>Yes — from repeated failures</td><td>No</td><td>No</td></tr>
293
293
  <tr><td>Agent support</td><td>Claude Code, Codex, Gemini, Amp, Cursor, OpenCode</td><td>Claude Code, Cursor, Windsurf, Cline</td><td>Claude, Cursor</td></tr>
@@ -298,13 +298,13 @@ npx thumbgate init --agent gemini</code></pre>
298
298
  <h2>Common Scenarios</h2>
299
299
 
300
300
  <h3>Agent keeps deleting files</h3>
301
- <p>Give a thumbs-down: "deleted production config file." After 2-3 occurrences, ThumbGate generates a gate that blocks <code>rm</code> commands targeting config files.</p>
301
+ <p>Give a thumbs-down: "deleted production config file." After 2-3 occurrences, ThumbGate generates a check that blocks <code>rm</code> commands targeting config files.</p>
302
302
 
303
303
  <h3>Agent ignores test failures</h3>
304
- <p>Give a thumbs-down: "committed code with failing tests." ThumbGate learns the pattern and gates future commits when test results show failures.</p>
304
+ <p>Give a thumbs-down: "committed code with failing tests." ThumbGate learns the pattern and checks future commits when test results show failures.</p>
305
305
 
306
306
  <h3>Agent uses wrong API endpoint</h3>
307
- <p>Give a thumbs-down: "called staging API in production code." The gate blocks tool calls that reference staging URLs in production contexts.</p>
307
+ <p>Give a thumbs-down: "called staging API in production code." The check blocks tool calls that reference staging URLs in production contexts.</p>
308
308
 
309
309
  <h2>Get Started</h2>
310
310
  <pre><code>npx thumbgate init</code></pre>