thumbgate 1.21.0 → 1.21.1

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate-marketplace",
-  "version": "1.21.0",
+  "version": "1.21.1",
   "owner": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com"
@@ -14,7 +14,7 @@
         "source": "npm",
         "package": "thumbgate"
       },
-      "version": "1.21.0",
+      "version": "1.21.1",
       "author": {
         "name": "Igor Ganapolsky",
         "email": "ig5973700@gmail.com",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.21.0",
+  "version": "1.21.1",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.21.0",
+  "version": "1.21.1",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate-production.up.railway.app",
   "transport": "stdio",

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.21.0", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.21.1", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.21.0", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.21.1", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/mcp/server-stdio.js

@@ -216,7 +216,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.21.0' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.21.1' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.21.0",
+        "thumbgate@1.21.1",
         "thumbgate",
         "serve"
       ],

package/bin/cli.js

@@ -396,6 +396,26 @@ function whichExists(cmd) {
 function setupClaude() {
   const mcpChanged = mergeMcpJson(path.join(CWD, '.mcp.json'), 'Claude Code', 'project');
 
+  // Wire the canonical ThumbGate gate hooks (PreToolUse pre-action check,
+  // UserPromptSubmit, PostToolUse, SessionStart) through the shared wiring
+  // path so `init`, `init --agent claude-code`, and `install` all produce the
+  // same hook set. Before this, `install` shipped a Claude config with no
+  // PreToolUse gate — the core ThumbGate feature was silently missing.
+  let wireChanged = false;
+  try {
+    const { wireHooks } = require(path.join(PKG_ROOT, 'scripts', 'auto-wire-hooks'));
+    const wireResult = wireHooks({ agent: 'claude-code' });
+    if (wireResult.error) {
+      console.log(`  Claude Code: ${wireResult.error}`);
+    } else if (wireResult.changed) {
+      wireChanged = true;
+      const lifecycles = [...new Set(wireResult.added.map((h) => h.lifecycle))].join(', ');
+      console.log(`  Claude Code: wired gate hooks (${lifecycles})`);
+    }
+  } catch (err) {
+    console.log(`  Claude Code: hook wiring skipped (${err.message})`);
+  }
+
   // Upsert Stop hook into .claude/settings.json for autonomous self-scoring
   const settingsPath = path.join(CWD, '.claude', 'settings.json');
   const stopHookCommand = 'bash scripts/hook-stop-self-score.sh';
@@ -452,7 +472,7 @@ function setupClaude() {
     fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
   }
 
-  return mcpChanged || hooksChanged;
+  return mcpChanged || hooksChanged || wireChanged;
 }
 
 function setupCodex() {
@@ -724,6 +744,7 @@ function init(cliArgs = parseArgs(process.argv.slice(3))) {
   let configured = 0;
 
   const platforms = [
+    { name: 'Claude Code', detect: [() => whichExists('claude'), () => fs.existsSync(path.join(HOME, '.claude'))], setup: setupClaude },
     { name: 'Codex', detect: [() => whichExists('codex'), () => fs.existsSync(path.join(HOME, '.codex'))], setup: setupCodex },
     { name: 'Gemini', detect: [() => whichExists('gemini'), () => fs.existsSync(path.join(HOME, '.gemini'))], setup: setupGemini },
     { name: 'Amp', detect: [() => whichExists('amp'), () => fs.existsSync(path.join(HOME, '.amp'))], setup: setupAmp },
@@ -2458,6 +2479,11 @@ if (COMMAND === 'daemon' || COMMAND === 'serve-daemon') {
 }
 
 switch (COMMAND) {
+  case '--version':
+  case '-v':
+  case 'version':
+    console.log(pkgVersion());
+    break;
   case 'init':
     init();
     upgradeNudge();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.21.0",
+  "version": "1.21.1",
   "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 33 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
   "homepage": "https://thumbgate-production.up.railway.app",
   "repository": {
@@ -639,6 +639,10 @@
     "test:competitive-positioning-marketing": "node --test tests/competitive-positioning-marketing.test.js tests/knowledge-graph-guardrails.test.js tests/supply-chain-guardrails.test.js",
     "test:medium-weekly": "node --test tests/medium-weekly.test.js",
     "test:dashboard-deeplink-e2e": "node --test tests/dashboard-deeplink-e2e.test.js",
+    "test:e2e:playwright": "playwright test",
+    "test:e2e:playwright:headed": "playwright test --headed",
+    "test:e2e:playwright:ui": "playwright test --ui",
+    "test:e2e:playwright:report": "playwright show-report",
     "test:public-package-parity": "node --test tests/public-package-parity.test.js",
     "prepare": "bash bin/install-hooks.sh >/dev/null 2>&1 || true",
     "install:hooks": "bash bin/install-hooks.sh",
@@ -730,6 +734,7 @@
   "devDependencies": {
     "@changesets/changelog-github": "^0.7.0",
     "@changesets/cli": "^2.31.0",
+    "@playwright/test": "^1.60.0",
     "c8": "^11.0.0",
     "undici": "^8.2.0"
   }

package/public/dashboard.html

@@ -247,9 +247,9 @@
 
   <!-- STATS -->
   <div class="stats-grid" id="statsGrid">
-    <a class="stat-card" data-card-action="all" onclick="selectCard(this,'all')" href="/lessons" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view all feedback → Lessons page"><div class="stat-label">Total Feedback</div><div class="stat-value cyan" id="statTotal">—</div></a>
-    <a class="stat-card" data-card-action="up" onclick="selectCard(this,'up')" href="/lessons?signal=positive" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view positive feedback → Lessons page"><div class="stat-label">👍 Positive</div><div class="stat-value green" id="statPositive">—</div></a>
-    <a class="stat-card" data-card-action="down" onclick="selectCard(this,'down')" href="/lessons?signal=negative" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view negative feedback → Lessons page"><div class="stat-label">👎 Negative</div><div class="stat-value red" id="statNegative">—</div></a>
+    <a class="stat-card" data-card-action="all" onclick="selectCard(this,'all')" href="/lessons?signal=all" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view all feedback → Lessons page"><div class="stat-label">Total Feedback</div><div class="stat-value cyan" id="statTotal">—</div></a>
+    <a class="stat-card" data-card-action="up" onclick="selectCard(this,'up')" href="/lessons?signal=up" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view positive feedback → Lessons page"><div class="stat-label">👍 Positive</div><div class="stat-value green" id="statPositive">—</div></a>
+    <a class="stat-card" data-card-action="down" onclick="selectCard(this,'down')" href="/lessons?signal=down" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view negative feedback → Lessons page"><div class="stat-label">👎 Negative</div><div class="stat-value red" id="statNegative">—</div></a>
     <a class="stat-card" data-card-action="gates" onclick="selectCard(this,'gates');return false;" href="#" style="cursor:pointer;text-decoration:none;color:inherit;display:block;" title="Click to view active checks"><div class="stat-label">Active Gates</div><div class="stat-value cyan" id="statGates">—</div></a>
   </div>
 

package/public/index.html

@@ -19,7 +19,7 @@ __GOOGLE_SITE_VERIFICATION_META__
 <meta property="og:image" content="https://thumbgate-production.up.railway.app/og.png">
 <meta name="twitter:card" content="summary_large_image">
 <meta name="twitter:image" content="https://thumbgate-production.up.railway.app/og.png">
-<meta name="thumbgate-version" content="1.21.0">
+<meta name="thumbgate-version" content="1.21.1">
 <meta name="keywords" content="ThumbGate, thumbgate, AI agent orchestration, AI experience orchestration, agent enforcement layer, save LLM tokens, reduce Claude API cost, reduce OpenAI cost, AI agent token savings, prevent LLM retries, prevent hallucination retries, stop AI token waste, pre-action checks, agent governance, Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, workflow hardening, context engineering, AI authenticity, brand authenticity AI">
 <link rel="apple-touch-icon" href="/apple-touch-icon.png">
 
@@ -1492,7 +1492,7 @@ __GA_BOOTSTRAP__
       <a href="https://www.linkedin.com/in/igorganapolsky" target="_blank" rel="noopener">LinkedIn</a>
       <a href="/blog">Blog</a>
     </div>
-    <span class="footer-copy">© 2026 ThumbGate · MIT License · npm v1.21.0</span>
+    <span class="footer-copy">© 2026 ThumbGate · MIT License · npm v1.21.1</span>
   </div>
 </footer>
 

package/public/lessons.html

@@ -922,6 +922,28 @@ async function loadLive() {
 }
 
 loadLive().then(function() {
+  // Handle ?signal= query param from dashboard stat-card navigation.
+  // Vocabulary: 'up' | 'down' | 'all' (canonical). Also accepts the legacy
+  // 'positive' | 'negative' aliases the dashboard once emitted.
+  var qsSignal = new URLSearchParams(window.location.search).get('signal');
+  if (qsSignal) {
+    var signalMap = { positive: 'up', negative: 'down', up: 'up', down: 'down', all: 'all' };
+    var mapped = signalMap[qsSignal];
+    if (mapped) {
+      switchTab('timeline');
+      filterTimeline(mapped, null);
+      var filterBtns = document.querySelectorAll('#tab-timeline .filter-btn');
+      filterBtns.forEach(function(b) {
+        var label = b.textContent.trim().toLowerCase();
+        var match = (mapped === 'all' && label === 'all') ||
+                    (mapped === 'up' && (label.indexOf('👍') !== -1 || label.indexOf('positive') !== -1 || label === 'up')) ||
+                    (mapped === 'down' && (label.indexOf('👎') !== -1 || label.indexOf('negative') !== -1 || label === 'down'));
+        b.classList.toggle('active', match);
+      });
+      return;
+    }
+  }
+
   // Default: highlight Active Rules card on page load
   highlightCard(0);
 

package/public/numbers.html

@@ -25,7 +25,7 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.21.0",
+  "softwareVersion": "1.21.1",
   "url": "https://thumbgate-production.up.railway.app/numbers",
   "dateModified": "2026-05-07",
   "creator": {
@@ -202,7 +202,7 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-05-07 · Version 1.21.0</div>
+  <div class="freshness">Updated: 2026-05-07 · Version 1.21.1</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>

package/scripts/workflow-sentinel.js

@@ -1178,10 +1178,15 @@ function chooseDecision({ riskScore, integrity, memoryGuard, learnedPolicy, blas
   if (lowRiskHandoff) {
     return 'allow';
   }
+  // Background customer-system actions checkpoint (warn), never hard-deny.
+  // The checkpoint IS the mitigation — blocking outright prevents legitimate work.
+  if (backgroundAgent && customerSystemAction) {
+    return 'warn';
+  }
   if (destructiveBypass || learnedHardStop || repeatedHighBlast || (hasOperationalBlockers && riskScore >= 0.72) || riskScore >= 0.86) {
     return 'deny';
   }
-  if (economicAction || (backgroundAgent && customerSystemAction) || (backgroundAgent && riskScore >= 0.3)) {
+  if (economicAction || (backgroundAgent && riskScore >= 0.3)) {
     return 'warn';
   }
   if ((workflowControl && workflowControl.mode === 'warn') || (costControl && costControl.mode === 'warn') || riskScore >= 0.45 || (learnedWarning && riskScore >= 0.3) || (learnedRecall && riskScore >= 0.34)) {