thumbgate 1.20.0 → 1.21.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.20.0",
+  "version": "1.21.1",
   "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 33 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
   "homepage": "https://thumbgate-production.up.railway.app",
   "repository": {
@@ -15,44 +15,13 @@
     "thumbgate": "bin/cli.js"
   },
   "files": [
-    ".claude-plugin/marketplace.json",
-    ".claude-plugin/plugin.json",
-    ".well-known/",
-    "LICENSE",
-    "README.md",
-    "adapters/amp/skills/thumbgate-feedback/SKILL.md",
-    "adapters/chatgpt/openapi.yaml",
-    "adapters/claude/.mcp.json",
-    "adapters/codex/config.toml",
-    "adapters/forge/forge.yaml",
-    "adapters/gemini/function-declarations.json",
-    "adapters/mcp/server-stdio.js",
-    "adapters/opencode/opencode.json",
-    "bench/programbench-smoke.json",
-    "bench/prompt-eval-suite.json",
-    "bench/thumbgate-bench.json",
-    "bin/cli.js",
-    "bin/postinstall.js",
-    "config/",
-    "openapi/",
-    "public/blog.html",
-    "public/codex-plugin.html",
-    "public/compare.html",
-    "public/dashboard.html",
-    "public/federal.html",
-    "public/guide.html",
-    "public/index.html",
-    "public/learn.html",
-    "public/lessons.html",
-    "public/numbers.html",
-    "public/pro.html",
     "scripts/access-anomaly-detector.js",
     "scripts/activation-tracker.js",
     "scripts/agent-audit-trace.js",
     "scripts/agent-design-governance.js",
     "scripts/agent-memory-lifecycle.js",
-    "scripts/agent-readiness.js",
     "scripts/agent-readiness-plan.js",
+    "scripts/agent-readiness.js",
     "scripts/agent-reasoning-traces.js",
     "scripts/agent-reward-model.js",
     "scripts/agent-stack-survival-audit.js",
@@ -60,11 +29,11 @@
     "scripts/ai-engineering-stack-guardrails.js",
     "scripts/ai-search-distribution.js",
     "scripts/analytics-window.js",
-    "scripts/autoresearch-runner.js",
     "scripts/async-job-runner.js",
     "scripts/audit-trail.js",
     "scripts/auto-promote-gates.js",
     "scripts/auto-wire-hooks.js",
+    "scripts/autoresearch-runner.js",
     "scripts/background-agent-governance.js",
     "scripts/bayes-optimal-gate.js",
     "scripts/belief-update.js",
@@ -78,28 +47,28 @@
     "scripts/cli-feedback.js",
     "scripts/cli-schema.js",
     "scripts/cli-status.js",
-    "scripts/cli-test-block.js",
     "scripts/cli-telemetry.js",
+    "scripts/cli-test-block.js",
     "scripts/cloudflare-dynamic-sandbox.js",
+    "scripts/code-graph-guardrails.js",
     "scripts/code-mode-mcp-plan.js",
     "scripts/code-reasoning.js",
-    "scripts/code-graph-guardrails.js",
     "scripts/codegraph-context.js",
+    "scripts/codex-self-heal.js",
     "scripts/commercial-offer.js",
-    "scripts/context-manager.js",
     "scripts/context-engine.js",
+    "scripts/context-footprint.js",
+    "scripts/context-manager.js",
     "scripts/contextfs.js",
     "scripts/conversation-context.js",
-    "scripts/context-footprint.js",
-    "scripts/codex-self-heal.js",
     "scripts/dashboard-render-spec.js",
     "scripts/dashboard.js",
     "scripts/decision-journal.js",
-    "scripts/durability/step.js",
     "scripts/deepseek-v4-runtime-guardrails.js",
     "scripts/docker-sandbox-planner.js",
     "scripts/document-intake.js",
     "scripts/document-workflow-governance.js",
+    "scripts/durability/step.js",
     "scripts/evolution-state.js",
     "scripts/experiment-tracker.js",
     "scripts/explore-subcommands.js",
@@ -112,10 +81,10 @@
     "scripts/feedback-loop.js",
     "scripts/feedback-paths.js",
     "scripts/feedback-quality.js",
-    "scripts/feedback_quality_eval.py",
     "scripts/feedback-schema.js",
     "scripts/feedback-session.js",
     "scripts/feedback-to-rules.js",
+    "scripts/feedback_quality_eval.py",
     "scripts/filesystem-search.js",
     "scripts/fs-utils.js",
     "scripts/gate-stats.js",
@@ -130,8 +99,8 @@
     "scripts/hosted-config.js",
     "scripts/hybrid-feedback-context.js",
     "scripts/hybrid-supervisor-agent.js",
-    "scripts/install-mcp.js",
     "scripts/inference-cache-policy.js",
+    "scripts/install-mcp.js",
     "scripts/internal-agent-bootstrap.js",
     "scripts/intervention-policy.js",
     "scripts/jsonl-watcher.js",
@@ -142,14 +111,13 @@
     "scripts/lesson-rotation.js",
     "scripts/lesson-search.js",
     "scripts/lesson-synthesis.js",
-    "scripts/rule-validator.js",
     "scripts/license.js",
-    "scripts/llm-client.js",
     "scripts/llm-behavior-monitor.js",
-    "scripts/mailer/index.js",
-    "scripts/mailer/resend-mailer.js",
+    "scripts/llm-client.js",
     "scripts/local-model-profile.js",
     "scripts/long-running-agent-context-guardrails.js",
+    "scripts/mailer/index.js",
+    "scripts/mailer/resend-mailer.js",
     "scripts/mcp-config.js",
     "scripts/mcp-policy.js",
     "scripts/mcp-transport-strategy.js",
@@ -162,32 +130,33 @@
     "scripts/native-messaging-audit.js",
     "scripts/natural-language-harness.js",
     "scripts/obsidian-export.js",
+    "scripts/operational-integrity.js",
     "scripts/oss-pr-opportunity-scout.js",
     "scripts/otel-declarative-config.js",
-    "scripts/operational-integrity.js",
     "scripts/perplexity-client.js",
     "scripts/plausible-server-events.js",
     "scripts/pr-manager.js",
     "scripts/private-core-boundary.js",
     "scripts/pro-local-dashboard.js",
-    "scripts/problem-detail.js",
     "scripts/proactive-agent-eval-guardrails.js",
+    "scripts/problem-detail.js",
     "scripts/product-feedback.js",
-    "scripts/prompting-operating-system.js",
-    "scripts/provider-action-normalizer.js",
     "scripts/profile-router.js",
-    "scripts/prompt-programs.js",
     "scripts/prompt-eval.js",
     "scripts/prompt-guard.js",
+    "scripts/prompt-programs.js",
+    "scripts/prompting-operating-system.js",
+    "scripts/provider-action-normalizer.js",
     "scripts/proxy-pointer-rag-guardrails.js",
-    "scripts/rag-precision-guardrails.js",
     "scripts/published-cli.js",
+    "scripts/rag-precision-guardrails.js",
     "scripts/rate-limiter.js",
     "scripts/reasoning-efficiency-guardrails.js",
     "scripts/reward-hacking-guardrails.js",
     "scripts/risk-scorer.js",
     "scripts/rlaif-self-audit.js",
     "scripts/rubric-engine.js",
+    "scripts/rule-validator.js",
     "scripts/secret-scanner.js",
     "scripts/security-scanner.js",
     "scripts/self-distill-agent.js",
@@ -196,9 +165,9 @@
     "scripts/semantic-layer.js",
     "scripts/seo-gsd.js",
     "scripts/settings-hierarchy.js",
+    "scripts/single-use-credential-gate.js",
     "scripts/skill-generator.js",
     "scripts/skill-rag-router.js",
-    "scripts/single-use-credential-gate.js",
     "scripts/slo-alert-engine.js",
     "scripts/spec-gate.js",
     "scripts/statusline-cache-path.js",
@@ -216,20 +185,54 @@
     "scripts/thompson-sampling.js",
     "scripts/thumbgate-bench.js",
     "scripts/thumbgate-search.js",
-    "scripts/token-tco.js",
     "scripts/token-savings.js",
+    "scripts/token-tco.js",
     "scripts/tool-registry.js",
     "scripts/upstream-contribution-engine.js",
     "scripts/user-profile.js",
     "scripts/validate-workflow-contract.js",
     "scripts/vector-store.js",
-    "scripts/verifier-scoring.js",
     "scripts/verification-loop.js",
+    "scripts/verifier-scoring.js",
+    "scripts/verify-marketing-pages-deployed.js",
     "scripts/workflow-runs.js",
     "scripts/workflow-sentinel.js",
     "scripts/workspace-agent-routines.js",
     "scripts/workspace-evolver.js",
     "scripts/xmemory-lite.js",
+    ".claude-plugin/marketplace.json",
+    ".claude-plugin/plugin.json",
+    ".well-known/",
+    "LICENSE",
+    "README.md",
+    "adapters/amp/skills/thumbgate-feedback/SKILL.md",
+    "adapters/chatgpt/openapi.yaml",
+    "adapters/claude/.mcp.json",
+    "adapters/codex/config.toml",
+    "adapters/forge/forge.yaml",
+    "adapters/gemini/function-declarations.json",
+    "adapters/mcp/server-stdio.js",
+    "adapters/opencode/opencode.json",
+    "bench/programbench-smoke.json",
+    "bench/prompt-eval-suite.json",
+    "bench/thumbgate-bench.json",
+    "bin/cli.js",
+    "bin/postinstall.js",
+    "config/",
+    "openapi/",
+    "public/agent-manager.html",
+    "public/blog.html",
+    "public/codex-plugin.html",
+    "public/compare.html",
+    "public/dashboard.html",
+    "public/federal.html",
+    "public/guide.html",
+    "public/index.html",
+    "public/learn.html",
+    "public/lessons.html",
+    "public/numbers.html",
+    "public/pricing.html",
+    "public/pro.html",
     "skills/thumbgate/SKILL.md",
     "src/"
   ],
@@ -329,7 +332,7 @@
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
     "test:python": "python3 -m pytest tests/*.py",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:zernio && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:post-everywhere-zernio-default && npm run test:zernio-canonical-pollers && npm run test:zernio-status && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:plan-gate && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:bot-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:community-course-platform-launch-kit && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:social-dedupe-cleanup && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:demo-voiceover && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:ci-cd-hygiene-audit",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:zernio && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:post-everywhere-zernio-default && npm run test:zernio-canonical-pollers && npm run test:zernio-status && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:plan-gate && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:bot-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:community-course-platform-launch-kit && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:social-dedupe-cleanup && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:demo-voiceover && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
     "test:hook-stop-anti-claim": "node --test tests/hook-stop-anti-claim.test.js",
     "test:plausible-server-events": "node --test tests/plausible-server-events.test.js",
@@ -435,7 +438,7 @@
     "test:workflow": "node --test tests/workflow-contract.test.js tests/social-marketing-assets.test.js tests/social-pipeline.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/gtm-revenue-loop.test.js tests/may-2026-revenue-machine.test.js tests/customer-discovery-sprint.test.js tests/revenue-pack-utils.test.js tests/aiventyx-marketplace-plan.test.js tests/cursor-marketplace-revenue-pack.test.js tests/codex-marketplace-revenue-pack.test.js tests/codex-plugin-revenue-pack.test.js tests/gemini-cli-demand-pack.test.js tests/roo-sunset-demand-pack.test.js tests/linkedin-workflow-hardening-pack.test.js tests/chatgpt-gpt-revenue-pack.test.js tests/mcp-directory-revenue-pack.test.js tests/money-marketplace-distribution-pack.test.js tests/autonomous-sales-agent.test.js tests/reddit-dm-workflow-hardening-pack.test.js tests/sales-pipeline.test.js tests/reddit-dm-outreach.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/ralph-loop.test.js tests/ralph-mode-ci.test.js tests/guide-conversion-path.test.js tests/roo-sunset-marketing.test.js",
     "test:sales-pipeline": "node --test tests/sales-pipeline.test.js",
     "test:billing": "node --test tests/billing.test.js tests/stripe-sync-product-images.test.js",
-    "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/install-mcp.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
+    "test:cli": "node --test tests/analytics-report.test.js tests/agent-design-governance.test.js tests/codex-self-heal.test.js tests/creator-campaigns.test.js tests/cli.test.js tests/codex-bridge-script.test.js tests/dependabot-changeset.test.js tests/dispatch-brief.test.js tests/feedback-normalize.test.js tests/install-mcp.test.js tests/install-scope-docs.test.js tests/pr-manager.test.js tests/pro-local-dashboard.test.js tests/published-cli.test.js tests/revenue-status.test.js tests/stripe-live-status.test.js tests/creator-dev-and-prune.test.js",
     "test:evolution": "node --test tests/workspace-evolver.test.js",
     "test:watcher": "node --test tests/jsonl-watcher.test.js",
     "test:autoresearch": "node --test tests/autoresearch.test.js",
@@ -510,6 +513,8 @@
     "test:audit-pr-bot-contamination": "node --test tests/audit-pr-bot-contamination.test.js",
     "test:stripe-bootstrap-saas-catalog": "node --test tests/stripe-bootstrap-saas-catalog.test.js",
     "test:bot-detection": "node --test tests/bot-detection.test.js",
+    "test:postgres-guard": "node --test tests/postgres-guard.test.js",
+    "test:checkout-archived-product-guard": "node --test tests/checkout-archived-product-guard.test.js",
     "test:checkout-bot-guard": "node --test tests/checkout-bot-guard.test.js",
     "test:checkout-pro-confirmation-gate": "node --test tests/checkout-pro-confirmation-gate.test.js",
     "test:revenue-observability-doctor": "node --test tests/revenue-observability-doctor.test.js",
@@ -634,6 +639,10 @@
     "test:competitive-positioning-marketing": "node --test tests/competitive-positioning-marketing.test.js tests/knowledge-graph-guardrails.test.js tests/supply-chain-guardrails.test.js",
     "test:medium-weekly": "node --test tests/medium-weekly.test.js",
     "test:dashboard-deeplink-e2e": "node --test tests/dashboard-deeplink-e2e.test.js",
+    "test:e2e:playwright": "playwright test",
+    "test:e2e:playwright:headed": "playwright test --headed",
+    "test:e2e:playwright:ui": "playwright test --ui",
+    "test:e2e:playwright:report": "playwright show-report",
     "test:public-package-parity": "node --test tests/public-package-parity.test.js",
     "prepare": "bash bin/install-hooks.sh >/dev/null 2>&1 || true",
     "install:hooks": "bash bin/install-hooks.sh",
@@ -646,7 +655,11 @@
     "test:enforcement-teeth": "node --test tests/enforcement-teeth.test.js",
     "test:bayes-optimal-gate": "node --test tests/bayes-optimal-gate.test.js",
     "test:actionable-remediations": "node --test tests/actionable-remediations.test.js",
-    "test:public-bundle-ratchet": "node --test tests/public-bundle-ratchet.test.js"
+    "test:public-bundle-ratchet": "node --test tests/public-bundle-ratchet.test.js",
+    "test:stripe-payment-link-update": "node --test tests/stripe-payment-link-update.test.js",
+    "test:verify-marketing-pages-deployed": "node --test tests/verify-marketing-pages-deployed.test.js",
+    "verify:marketing-pages": "node scripts/verify-marketing-pages-deployed.js",
+    "test:install-email-capture": "node --test tests/install-email-capture.test.js"
   },
   "keywords": [
     "mcp",
@@ -701,7 +714,7 @@
     "node": ">=18.18.0"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "0.95.2",
+    "@anthropic-ai/sdk": "0.96.0",
     "@google/genai": "1.49.0",
     "@huggingface/transformers": "^4.2.0",
     "@lancedb/lancedb": "^0.27.2",
@@ -709,7 +722,7 @@
     "better-sqlite3": "^12.9.0",
     "dotenv": "^17.4.2",
     "playwright-core": "^1.59.1",
-    "protobufjs": "^7.5.5",
+    "protobufjs": "^8.4.0",
     "stripe": "^22.0.2"
   },
   "overrides": {
@@ -721,6 +734,7 @@
   "devDependencies": {
     "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "^2.31.0",
+    "@playwright/test": "^1.60.0",
     "c8": "^11.0.0",
     "undici": "^8.2.0"
   }

package/public/agent-manager.html

@@ -0,0 +1,139 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>ThumbGate for the Agent Manager — Pre-Action Checks for Claude Code, Cursor, Codex</title>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
+<meta name="description" content="Anthropic named the role that owns enterprise Claude Code: the Agent Manager. ThumbGate is the pre-action enforcement layer underneath CLAUDE.md, the plugin marketplace, permissions policy, and which skills ship.">
+<meta property="og:title" content="ThumbGate for the Agent Manager">
+<meta property="og:description" content="The role Anthropic named — Agent Manager — owns CLAUDE.md, the plugin marketplace, permissions, and which skills ship. ThumbGate is the runtime underneath all of that.">
+<meta property="og:type" content="article">
+<meta property="og:image" content="https://thumbgate-production.up.railway.app/og.png">
+<link rel="canonical" href="https://thumbgate-production.up.railway.app/agent-manager">
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "TechArticle",
+  "headline": "ThumbGate for the Agent Manager",
+  "description": "Anthropic named the role that owns enterprise Claude Code rollouts: the Agent Manager. ThumbGate is the pre-action enforcement layer underneath CLAUDE.md, the plugin marketplace, permissions policy, and which skills ship.",
+  "datePublished": "2026-05-19",
+  "dateModified": "2026-05-19",
+  "author": { "@type": "Person", "name": "Igor Ganapolsky", "url": "https://github.com/IgorGanapolsky" },
+  "publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate-production.up.railway.app" },
+  "about": [
+    { "@type": "Thing", "name": "Agent Manager" },
+    { "@type": "Thing", "name": "Claude Code rollout" },
+    { "@type": "Thing", "name": "Pre-Action Checks" }
+  ]
+}
+</script>
+<style>
+  *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
+  :root { --bg:#0a0a0b; --card:#161618; --border:#222225; --text:#e8e8ec; --muted:#8b8b94; --cyan:#22d3ee; }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.7; }
+  .container { max-width: 860px; margin: 0 auto; padding: 2rem 1.5rem 4rem; }
+  nav { padding: 1rem 2rem; border-bottom: 1px solid var(--border); display:flex; gap:1.5rem; flex-wrap:wrap; }
+  nav a { color: var(--muted); text-decoration:none; font-size:0.9rem; }
+  nav .brand { color: var(--text); font-weight:700; }
+  .pill { display:inline-block; font-size:0.75rem; letter-spacing:0.08em; text-transform:uppercase; color:var(--cyan); background:rgba(34,211,238,0.08); border:1px solid rgba(34,211,238,0.2); padding:4px 12px; border-radius:100px; margin-top:1.5rem; font-weight:600; }
+  h1 { font-size:2.2rem; line-height:1.15; margin:1rem 0 1rem; }
+  h2 { font-size:1.45rem; margin:2.2rem 0 1rem; color:var(--cyan); }
+  h3 { margin:0.6rem 0; font-size:1rem; }
+  p, li { margin-bottom:0.75rem; }
+  ul, ol { padding-left:1.25rem; }
+  .card { background: var(--card); border:1px solid var(--border); border-radius:12px; padding:1.25rem; margin:1rem 0; }
+  .grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:1rem; margin:1rem 0; }
+  .grid .card h3 { color:var(--cyan); }
+  .cta { display:inline-block; background:var(--cyan); color:#000; padding:0.8rem 1.2rem; border-radius:8px; text-decoration:none; font-weight:700; }
+  .secondary { color:var(--cyan); text-decoration:underline; margin-left:1rem; }
+  .quote { border-left:3px solid var(--cyan); padding:0.75rem 1rem; margin:1rem 0; color:var(--muted); font-style:italic; }
+  .table-clean { width:100%; border-collapse:collapse; margin:1rem 0; font-size:0.95rem; }
+  .table-clean th, .table-clean td { border-bottom:1px solid var(--border); padding:0.6rem 0.5rem; text-align:left; vertical-align:top; }
+  .table-clean th { color:var(--cyan); font-weight:600; font-size:0.85rem; text-transform:uppercase; letter-spacing:0.05em; }
+</style>
+</head>
+<body>
+<nav>
+  <a href="/" class="brand">ThumbGate</a>
+  <a href="/guide">Guide</a>
+  <a href="/dashboard">Dashboard demo</a>
+  <a href="/#workflow-sprint-intake">Workflow Hardening Sprint</a>
+  <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
+</nav>
+<div class="container">
+  <span class="pill">Built for the Agent Manager</span>
+  <h1>You own CLAUDE.md, the plugin marketplace, permissions, and which skills ship. ThumbGate is the enforcement layer underneath.</h1>
+  <p>Anthropic named the role: the <strong>Agent Manager</strong> — a hybrid PM/engineer single DRI who owns the Claude Code configuration that every developer in the org actually feels. Without that role, enterprise rollouts stall in phase two; with it, the model improving is no longer the bottleneck. ThumbGate is the pre-action runtime that role needs at the tool-call boundary.</p>
+
+  <h2>What the Agent Manager owns, and what ThumbGate ships for each</h2>
+  <table class="table-clean">
+    <thead><tr><th>You own</th><th>ThumbGate ships</th></tr></thead>
+    <tbody>
+      <tr>
+        <td><strong>CLAUDE.md hierarchy</strong><br>Keeping the policy that the model reads on every session current and consistent across repos.</td>
+        <td>Prevention rules auto-distilled from real <code>👎</code> feedback and written into <code>CLAUDE.md</code> by <code>scripts/feedback-to-rules.js</code>. Org-wide rule library on the hosted dashboard.</td>
+      </tr>
+      <tr>
+        <td><strong>Plugin marketplace</strong><br>Deciding which Claude Code / Cursor / Codex plugins are blessed and which are not.</td>
+        <td>ThumbGate ships as a Claude Code plugin, a Cursor extension, a Codex plugin, and a Gemini CLI hook. One install, every supported agent. Adapter compatibility matrix kept current as runtimes change.</td>
+      </tr>
+      <tr>
+        <td><strong>Permissions policy</strong><br>What an agent is allowed to execute, against which surfaces, with which evidence required.</td>
+        <td>PreToolUse hooks at the tool-call boundary. Each block carries the rule that fired, the evidence that triggered it, and a reason the agent can use to choose a safer plan. No "tell the model to be more careful."</td>
+      </tr>
+      <tr>
+        <td><strong>Which skills ship</strong><br>The set of in-context skills, prompts, and snippets every developer's agent has access to.</td>
+        <td>Skill ship matrix in <code>adapters/*</code> — Claude, Cursor, Codex, Gemini, Amp, Cline, OpenCode. Each adapter is version-pinned and CI-checked against the upstream runtime.</td>
+      </tr>
+      <tr>
+        <td><strong>Keep them current</strong><br>When Claude Code ships a breaking change to hooks or to the plugin API, your rollout cannot wait a quarter.</td>
+        <td>24×7 ops on the adapter matrix. SonarCloud regressions fixed in &lt;24h. The hosted tier is the operator the role does not have to be themselves.</td>
+      </tr>
+    </tbody>
+  </table>
+
+  <h2>Why this role exists in the first place</h2>
+  <p>Every enterprise Claude Code rollout hits the same wall: the model gets better, the setup does not, and nobody owns it. The teams that get past phase one and into actual adoption all turn out to have a single DRI behind CLAUDE.md, the plugin policy, the permissions, and the skill ship list. The teams that do not, stall.</p>
+  <div class="quote">"The minimum viable version is a DRI: one person with ownership over the Claude Code configuration, the authority to make calls on settings, permissions policy, the plugin marketplace, and CLAUDE.md conventions, and the responsibility to keep them current."</div>
+
+  <h2>The three-phase pattern, and where ThumbGate fits</h2>
+  <div class="grid">
+    <div class="card">
+      <h3>Phase 1 — Quiet investment</h3>
+      <p>Individual engineers install agents. CLAUDE.md is whatever they wrote. The Agent Manager role is unfilled or shared. ThumbGate enters as the free <code>npx thumbgate init</code> wedge — one repo, one repeated failure, one Pre-Action Check.</p>
+    </div>
+    <div class="card">
+      <h3>Phase 2 — Rollout lands</h3>
+      <p>Infrastructure is ready; the first wave finds it productive. This is where the Agent Manager becomes a named role. ThumbGate's hosted dashboard, org-wide rule library, and DPO export are what that role uses to keep CLAUDE.md and the permissions policy consistent across repos.</p>
+    </div>
+    <div class="card">
+      <h3>Phase 3 — Adoption spreads</h3>
+      <p>The team becomes the harness. The Agent Manager stops being a bottleneck because the policy enforces itself at the tool-call boundary. ThumbGate's Workflow Hardening Sprint locks down the patterns that earned trust in phase two so the next 10x of engineers do not regress them.</p>
+    </div>
+  </div>
+
+  <h2>How to start</h2>
+  <ol>
+    <li><strong>Install free.</strong> <code>npx thumbgate init</code> in one repo. Captures thumbs-up/down feedback locally; auto-promotes repeated failures into prevention rules.</li>
+    <li><strong>Wire one Pre-Action Check.</strong> Pick the most-repeated agent mistake your org has felt this month. Promote that one to a rule. Watch the next attempt get blocked at the tool-call boundary, with the rule that fired in the agent's reasoning trace.</li>
+    <li><strong>Run the Workflow Hardening Sprint.</strong> When phase 2 hits — when you need shared rules, org dashboard visibility, and adapter coverage you do not have to maintain yourself — the sprint is the path from local proof to managed rollout.</li>
+  </ol>
+
+  <div class="card">
+    <p><strong>Anthropic named the role. ThumbGate is the runtime that role needs.</strong> The free CLI is real, MIT-licensed, and the gates work locally without a hosted account. The paid tier is what we operate so the Agent Manager does not have to.</p>
+    <p>
+      <a href="/#workflow-sprint-intake" class="cta">Start the Workflow Hardening Sprint</a>
+      <a href="/checkout/pro?utm_source=website&utm_medium=agent_manager_page&utm_campaign=pro_upgrade&cta_id=agent_manager_pro_checkout&cta_placement=agent_manager_page&plan_id=pro" class="secondary">Or start Pro at $19/mo →</a>
+    </p>
+  </div>
+
+  <h2>Related reading</h2>
+  <ul>
+    <li><a href="/use-cases/platform-teams">ThumbGate for platform teams</a> — when the Agent Manager role lives in the platform org.</li>
+    <li><a href="/use-cases/regulated-workflows">ThumbGate for regulated workflows</a> — DORA / EU AI Act / HIPAA pressure on the same role.</li>
+    <li><a href="/compare/ai-experience-orchestration">Orchestration vs enforcement</a> — what the Agent Manager picks <em>under</em> a broader orchestration suite.</li>
+  </ul>
+</div>
+</body>
+</html>

package/public/compare.html

@@ -263,7 +263,7 @@
 
 <div class="card">
   <h3>Evaluating Rein for AI agent governance?</h3>
-  <p>Rein is a Python decorator that wraps tool functions with policy checks, audit trails, and circuit breakers — targeted at production apps in trading, healthcare, and legal. ThumbGate is the coding-agent specialist with a learning feedback loop and MIT licensing. Same category (pre-action gates), different layer and stack.</p>
+  <p>Rein is a Python decorator that wraps tool functions with policy checks, audit trails, and circuit breakers — targeted at production apps in trading, healthcare, and legal. ThumbGate is the coding-agent specialist with a learning feedback loop and MIT licensing. Same category (infrastructure firewalls), different layer and stack.</p>
   <p><a href="/compare/rein" class="cta">Read ThumbGate vs Rein</a></p>
 </div>
 

package/public/dashboard.html

@@ -247,9 +247,9 @@
 
   <!-- STATS -->
   <div class="stats-grid" id="statsGrid">
-    <a class="stat-card" data-card-action="all" onclick="selectCard(this,'all')" href="/lessons" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view all feedback → Lessons page"><div class="stat-label">Total Feedback</div><div class="stat-value cyan" id="statTotal">—</div></a>
-    <a class="stat-card" data-card-action="up" onclick="selectCard(this,'up')" href="/lessons?signal=positive" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view positive feedback → Lessons page"><div class="stat-label">👍 Positive</div><div class="stat-value green" id="statPositive">—</div></a>
-    <a class="stat-card" data-card-action="down" onclick="selectCard(this,'down')" href="/lessons?signal=negative" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view negative feedback → Lessons page"><div class="stat-label">👎 Negative</div><div class="stat-value red" id="statNegative">—</div></a>
+    <a class="stat-card" data-card-action="all" onclick="selectCard(this,'all')" href="/lessons?signal=all" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view all feedback → Lessons page"><div class="stat-label">Total Feedback</div><div class="stat-value cyan" id="statTotal">—</div></a>
+    <a class="stat-card" data-card-action="up" onclick="selectCard(this,'up')" href="/lessons?signal=up" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view positive feedback → Lessons page"><div class="stat-label">👍 Positive</div><div class="stat-value green" id="statPositive">—</div></a>
+    <a class="stat-card" data-card-action="down" onclick="selectCard(this,'down')" href="/lessons?signal=down" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view negative feedback → Lessons page"><div class="stat-label">👎 Negative</div><div class="stat-value red" id="statNegative">—</div></a>
     <a class="stat-card" data-card-action="gates" onclick="selectCard(this,'gates');return false;" href="#" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view active checks"><div class="stat-label">Active Gates</div><div class="stat-value cyan" id="statGates">—</div></a>
   </div>
 

package/public/guide.html

@@ -246,6 +246,29 @@ npx thumbgate init --agent codex
 npx thumbgate init --agent cursor
 npx thumbgate init --agent gemini</code></pre>
 
+<h3>Install scope: machine-wide vs per-project</h3>
+<p>ThumbGate supports two install scopes. Pick once when you install — you can switch later by re-running with the other flag.</p>
+<table>
+  <thead>
+    <tr><th>Scope</th><th>Command</th><th>Where lessons + dashboard live</th><th>When to use</th></tr>
+  </thead>
+  <tbody>
+    <tr>
+      <td><strong>Machine-wide</strong> (default)</td>
+      <td><code>npx thumbgate init</code></td>
+      <td><code>~/.claude/memory/feedback/</code> — <strong>one shared dashboard across every repo on the machine</strong></td>
+      <td>Solo developer. A lesson learned in <code>repo-A</code> automatically blocks the same mistake in <code>repo-B</code>.</td>
+    </tr>
+    <tr>
+      <td><strong>Per-project</strong></td>
+      <td><code>npx thumbgate init --project</code> (run inside the repo)</td>
+      <td><code>&lt;repo&gt;/.claude/memory/feedback/</code> — <strong>separate dashboard per repo</strong></td>
+      <td>Client work, compliance, or multi-tenant. Lessons stay isolated; the audit trail belongs to the repo.</td>
+    </tr>
+  </tbody>
+</table>
+<p>Both scopes wire the same MCP server and PreToolUse / UserPromptSubmit / PostToolUse / SessionStart hooks — only the storage location differs. Machine-wide is the right default for most developers. Per-project lesson DBs live under each repo's <code>.claude/memory/feedback/</code> and <strong>must stay gitignored</strong>; ThumbGate's bundled <code>.gitignore</code> handles that.</p>
+
 <h2>How It Works</h2>
 
 <h3>1. You give feedback</h3>