thumbgate 1.22.0 → 1.23.1

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate-marketplace",
-  "version": "1.22.0",
+  "version": "1.23.1",
   "owner": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com"
@@ -14,7 +14,7 @@
         "source": "npm",
         "package": "thumbgate"
       },
-      "version": "1.22.0",
+      "version": "1.23.1",
       "author": {
         "name": "Igor Ganapolsky",
         "email": "ig5973700@gmail.com",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.22.0",
+  "version": "1.23.1",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.22.0",
+  "version": "1.23.1",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate-production.up.railway.app",
   "transport": "stdio",

package/README.md

@@ -474,6 +474,7 @@ Pro ($19/mo or $149/yr) removes the rule cap and adds history-aware lesson recal
 - [Agent Workflow Contract](WORKFLOW.md) — the agent-run contract for all ThumbGate operations
 - [Ready for Agent Intake](https://github.com/IgorGanapolsky/ThumbGate/issues/new?template=ready-for-agent.yml) — ready-for-agent intake template
 - [SEO Guide: Claude Code Guardrails](docs/learn/claude-code-guardrails.md)
+- [Unsupervised Learning Signals](docs/UL.md) — silent-failure clustering (experimental, behind `THUMBGATE_SILENT_FAILURE_CLUSTERING=1`; only useful on workspaces with ≥ 50 tool calls/day)
 - [ThumbGate-Core](https://github.com/IgorGanapolsky/ThumbGate-Core) — private core for hosted overlays, ranking, policy synthesis, billing intelligence, and org/team workflows
 
 ---

package/adapters/chatgpt/openapi.yaml

@@ -72,6 +72,11 @@ components:
           description: Optional domain tags. If omitted, ThumbGate infers one from the feedback text before promotion.
         skill:
           type: string
+        source:
+          type: string
+          enum: [chatgpt_gpt]
+          default: chatgpt_gpt
+          description: Attribution marker for ThumbGate analytics. The published ThumbGate GPT should send `chatgpt_gpt` so owner dashboards can distinguish GPT Action calls from local API calls.
     IntentPlanRequest:
       type: object
       required: [intentId]
@@ -880,6 +885,11 @@ paths:
                 toolName:
                   type: string
                   description: Tool name is optional when provider-native tool call payload is supplied.
+                source:
+                  type: string
+                  enum: [chatgpt_gpt]
+                  default: chatgpt_gpt
+                  description: Attribution marker for ThumbGate analytics. The published ThumbGate GPT should send `chatgpt_gpt` so owner dashboards can distinguish GPT Action calls from local API calls.
                 provider:
                   type: string
                 model:

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.22.0", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.23.1", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.22.0", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.23.1", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/mcp/server-stdio.js

@@ -216,7 +216,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.22.0' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.23.1' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.22.0",
+        "thumbgate@1.23.1",
         "thumbgate",
         "serve"
       ],

package/bin/cli.js

@@ -52,6 +52,25 @@ const PKG_ROOT = path.join(__dirname, '..');
 
 const PRO_URL = 'https://thumbgate-production.up.railway.app';
 const PRO_CHECKOUT_URL = PRO_MONTHLY_PAYMENT_LINK;
+const TRIAL_DAYS = 14;
+
+function checkoutUrlFor(source, content) {
+  try {
+    const url = new URL(PRO_CHECKOUT_URL);
+    url.searchParams.set('utm_source', source || 'cli');
+    url.searchParams.set('utm_medium', 'cli');
+    url.searchParams.set('utm_campaign', 'pro_conversion');
+    if (content) url.searchParams.set('utm_content', content);
+    return url.toString();
+  } catch (_) {
+    return PRO_CHECKOUT_URL;
+  }
+}
+
+function trialDeadlineLabel(now = new Date()) {
+  const deadline = new Date(now.getTime() + (TRIAL_DAYS * 24 * 60 * 60 * 1000));
+  return deadline.toISOString().slice(0, 10);
+}
 
 function upgradeNudge() {
   if (process.env.THUMBGATE_NO_NUDGE === '1') return;
@@ -139,25 +158,46 @@ function proNudge(context) {
     const { isProTier } = require(path.join(PKG_ROOT, 'scripts', 'rate-limiter'));
     if (isProTier()) return;
   } catch (_) { /* if rate-limiter is unavailable, fall through and nudge */ }
+  const checkoutUrl = checkoutUrlFor('cli_nudge', context || COMMAND || 'general');
   const messages = [
-    `\n  💡 Unlock Pro (${PRO_PRICE_LABEL}): searchable dashboard, DPO export, multi-repo sync\n     ${PRO_CHECKOUT_URL}\n`,
-    `\n  💡 Pro tip: export your feedback as DPO training pairs to improve your models.\n     Get Pro: ${PRO_CHECKOUT_URL}\n`,
-    `\n  💡 ThumbGate Pro: search, edit, and sync lessons across repos. ${PRO_PRICE_LABEL}.\n     ${PRO_CHECKOUT_URL}\n`,
+    `\n  💡 Unlock Pro (${PRO_PRICE_LABEL}): searchable dashboard, DPO export, multi-repo sync\n     ${checkoutUrl}\n`,
+    `\n  💡 Pro tip: export your feedback as DPO training pairs to improve your models.\n     Get Pro: ${checkoutUrl}\n`,
+    `\n  💡 ThumbGate Pro: search, edit, and sync lessons across repos. ${PRO_PRICE_LABEL}.\n     ${checkoutUrl}\n`,
   ];
   // Rotate message daily — no Math.random (security policy)
   const msg = messages[Math.floor(Date.now() / 86400000) % messages.length];
   process.stderr.write(msg);
 }
 
-function limitNudge(action) {
+function limitNudge(action, limitResult = {}) {
   if (process.env.THUMBGATE_NO_NUDGE === '1') return;
+  const checkoutUrl = checkoutUrlFor('cli_limit', action);
+  const usageLine = Number.isFinite(limitResult.used) && Number.isFinite(limitResult.limit)
+    ? `     Usage: ${limitResult.used}/${limitResult.limit} (${limitResult.limitType || 'limit'}).\n`
+    : '';
+  const reason = limitResult.message
+    ? String(limitResult.message).split('\n')[0]
+    : 'Free tier limit reached.';
   process.stderr.write(
-    `\n  ⚠️  Free tier limit reached. Upgrade to Pro for unlimited: https://thumbgate-production.up.railway.app/pro\n` +
-    `     ${action} daily limit reached. Upgrade to Pro for unlimited usage — ${PRO_PRICE_LABEL}:\n` +
-    `     ${PRO_CHECKOUT_URL}\n\n`
+    `\n  🔒 ${reason}\n` +
+    usageLine +
+    `     Upgrade to Pro (${PRO_PRICE_LABEL}) to continue ${action.replace(/_/g, ' ')}:\n` +
+    `     ${checkoutUrl}\n\n`
   );
 }
 
+function printInitConversionPrompt(email) {
+  if (process.env.THUMBGATE_NO_NUDGE === '1') return;
+  const checkoutUrl = checkoutUrlFor('cli_init', email ? 'init_email' : 'init_no_email');
+  console.log('');
+  console.log('  ┌──────────────────────────────────────────────────────────┐');
+  console.log(`  │  14-day Pro trial active through ${trialDeadlineLabel()}.              │`);
+  console.log('  │  Pro unlocks lesson search, recall, dashboard, exports. │');
+  console.log('  │  Add onboarding: npx thumbgate init --email you@company.com │');
+  console.log(`  │  Upgrade: ${checkoutUrl}`);
+  console.log('  └──────────────────────────────────────────────────────────┘');
+}
+
 function parseArgs(argv) {
   const args = {};
   argv.forEach((arg, index) => {
@@ -613,6 +653,18 @@ function quickStart() {
 
 function init(cliArgs = parseArgs(process.argv.slice(3))) {
   const args = { ...cliArgs };
+  if (args.help || args.h) {
+    console.log('Usage: npx thumbgate init [--agent <name>] [--wire-hooks] [--email you@company.com]');
+    console.log('');
+    console.log('Scaffold ThumbGate in the current project and wire detected agent integrations.');
+    console.log('');
+    console.log('Options:');
+    console.log('  --agent <name>           Wire a specific agent: claude-code, codex, gemini, amp, cursor, cline');
+    console.log('  --wire-hooks             Wire hooks only; do not scaffold project files');
+    console.log('  --email <email>          Subscribe installer to the setup guide and trial reminders');
+    console.log('  --dry-run                Show hook changes without writing them');
+    return;
+  }
 
   // --wire-hooks only mode: skip scaffolding, just wire hooks
   if (args['wire-hooks']) {
@@ -746,16 +798,48 @@ function init(cliArgs = parseArgs(process.argv.slice(3))) {
   }
 
   console.log('');
-  console.log(`thumbgate v${pkgVersion()} initialized.`);
-  console.log('Run: npx thumbgate help');
+  console.log(`✅ thumbgate v${pkgVersion()} initialized.`);
+  const onboardingEmail = typeof args.email === 'string'
+    ? args.email.trim()
+    : (typeof args['onboarding-email'] === 'string' ? args['onboarding-email'].trim() : '');
+  if (onboardingEmail) {
+    try {
+      execFileSync(process.execPath, [__filename, 'subscribe', onboardingEmail], {
+        cwd: CWD,
+        env: process.env,
+        stdio: 'inherit',
+      });
+      trackEvent('cli_init_email_subscribed', { command: 'init', source: 'init_email' });
+    } catch (_) {
+      console.log(`  Retry onboarding email: npx thumbgate subscribe ${onboardingEmail}`);
+    }
+  }
   trackEvent('cli_init', { command: 'init' });
-  proNudge();
+
+  // ---------------------------------------------------------------------------
+  // Activation guide: the ONE thing the user should do next.
+  // 98.5% of init users never promote their first prevention rule.
+  // This is the funnel break — not conversion, not nudges — activation.
+  // ---------------------------------------------------------------------------
   console.log('');
-  console.log('  ┌──────────────────────────────────────────────────────────┐');
-  console.log('  │  Teams: shared enforcement, CI gates, audit trails      │');
-  console.log('  │  One correction protects every agent on your team.      │');
-  console.log('  │  https://thumbgate-production.up.railway.app/pro        │');
-  console.log('  └──────────────────────────────────────────────────────────┘');
+  console.log('  ╭──────────────────────────────────────────────────────────╮');
+  console.log('  │  NEXT: Create your first prevention rule (30 seconds)   │');
+  console.log('  │                                                         │');
+  console.log('  │  When your AI agent makes a mistake, capture it:        │');
+  console.log('  │                                                         │');
+  console.log('  │  npx thumbgate capture --feedback=down \\               │');
+  console.log('  │    --context="agent deleted prod config" \\              │');
+  console.log('  │    --what-went-wrong="ran rm on .env" \\                 │');
+  console.log('  │    --what-to-change="never delete .env files"           │');
+  console.log('  │                                                         │');
+  console.log('  │  ThumbGate auto-promotes this to a prevention rule      │');
+  console.log('  │  that blocks the mistake from happening again.          │');
+  console.log('  ╰──────────────────────────────────────────────────────────╯');
+  console.log('');
+  printInitConversionPrompt(onboardingEmail);
+  if (!onboardingEmail) {
+    console.log('  Get trial reminders: npx thumbgate init --email you@company.com');
+  }
 
   try {
     const { appendFunnelEvent } = require(path.join(PKG_ROOT, 'scripts', 'billing'));
@@ -785,7 +869,7 @@ function capture() {
   const { getUsage } = require(path.join(PKG_ROOT, 'scripts', 'rate-limiter'));
   const capLimit = checkLimit('capture_feedback');
   if (!capLimit.allowed) {
-    limitNudge('capture_feedback');
+    limitNudge('capture_feedback', capLimit);
     process.exit(1);
   }
   trackEvent('cli_capture', { command: 'capture' });
@@ -855,6 +939,17 @@ function capture() {
       }
     }
     console.log('');
+    try {
+      const { buildCaptureReceipt } = require(path.join(PKG_ROOT, 'scripts', 'commercial-offer'));
+      console.log(buildCaptureReceipt({
+        signal: normalized,
+        feedbackId: ev.id,
+        memoryId: mem.id,
+        actionType: ev.actionType,
+      }));
+    } catch (_) {
+      // Receipt is a conversion aid, not part of feedback persistence.
+    }
     proNudge();
   } else {
     if (args.json) {
@@ -938,6 +1033,13 @@ function stats() {
   } else {
     console.log('\n✅ System is currently high-reliability. No immediate revenue loss detected.');
   }
+  try {
+    const { buildStatsReceipt } = require(path.join(PKG_ROOT, 'scripts', 'commercial-offer'));
+    const receipt = buildStatsReceipt(payload);
+    if (receipt) console.log(receipt);
+  } catch (_) {
+    // Keep stats resilient if the receipt helper is unavailable in old installs.
+  }
   proNudge();
 }
 
@@ -1187,6 +1289,13 @@ function lessons() {
   const tags = String(args.tags || '').split(',').map((t) => t.trim()).filter(Boolean);
   const query = args.query || process.argv.slice(3).find((a) => !a.startsWith('--')) || '';
   const limit = Number(args.limit || 10);
+  const { checkLimit } = require(path.join(PKG_ROOT, 'scripts', 'rate-limiter'));
+  const searchLimit = checkLimit('search_lessons');
+  if (!searchLimit.allowed) {
+    trackEvent('cli_upgrade_prompt', { command: 'lessons', action: 'search_lessons', limitType: searchLimit.limitType || null });
+    limitNudge('search_lessons', searchLimit);
+    process.exit(1);
+  }
 
   // --remote: fetch from hosted Railway instance
   if (args.remote) {
@@ -1453,13 +1562,10 @@ function risk() {
 }
 
 function exportDpo() {
-  const { isProTier } = require(path.join(PKG_ROOT, 'scripts', 'rate-limiter'));
-  if (!isProTier(null)) {
-    process.stderr.write(
-      `\n  🔒 DPO Export requires Pro (${PRO_PRICE_LABEL}).\n` +
-      `     Your feedback would generate valuable training pairs.\n` +
-      `     Upgrade: ${PRO_CHECKOUT_URL}\n\n`
-    );
+  const { checkLimit } = require(path.join(PKG_ROOT, 'scripts', 'rate-limiter'));
+  const exportLimit = checkLimit('export_dpo');
+  if (!exportLimit.allowed) {
+    limitNudge('export_dpo', exportLimit);
     process.exit(1);
   }
   const extraArgs = process.argv.slice(3).join(' ');
@@ -1476,13 +1582,10 @@ function exportDpo() {
 }
 
 function exportDatabricks() {
-  const { isProTier } = require(path.join(PKG_ROOT, 'scripts', 'rate-limiter'));
-  if (!isProTier(null)) {
-    process.stderr.write(
-      `\n  🔒 Databricks Export requires Pro (${PRO_PRICE_LABEL}).\n` +
-      `     Export feedback logs + proof artifacts for analytics.\n` +
-      `     Upgrade: ${PRO_CHECKOUT_URL}\n\n`
-    );
+  const { checkLimit } = require(path.join(PKG_ROOT, 'scripts', 'rate-limiter'));
+  const exportLimit = checkLimit('export_databricks');
+  if (!exportLimit.allowed) {
+    limitNudge('export_databricks', exportLimit);
     process.exit(1);
   }
   const extraArgs = process.argv.slice(3).join(' ');
@@ -2461,6 +2564,39 @@ if (COMMAND === 'daemon' || COMMAND === 'serve-daemon') {
   process.exit(0);
 }
 
+// ---------------------------------------------------------------------------
+// Global --help interceptor: `thumbgate <cmd> --help` shows per-command help
+// instead of running the command. Commands with their own --help guard (init)
+// handle it internally; everything else falls through here.
+// ---------------------------------------------------------------------------
+const _cliSubArgs = process.argv.slice(3);
+const _wantsHelp = _cliSubArgs.includes('--help') || _cliSubArgs.includes('-h');
+
+const SUBCOMMAND_HELP = {
+  capture:       'Usage: npx thumbgate capture --feedback=up|down --context="..." [--what-worked="..."] [--what-went-wrong="..."] [--what-to-change="..."] [--tags=a,b]',
+  feedback:      'Usage: npx thumbgate feedback --feedback=up|down --context="..." [--what-worked="..."] [--what-went-wrong="..."] [--what-to-change="..."] [--tags=a,b]',
+  stats:         'Usage: npx thumbgate stats\n\nShow gate enforcement statistics: blocked/warned counts, active gates, time saved.',
+  trial:         'Usage: npx thumbgate trial\n\nShow Pro trial status, remaining days, and upgrade path.',
+  pro:           'Usage: npx thumbgate pro [--activate <key>]\n\nLaunch the local Pro dashboard or activate a Pro license key.',
+  subscribe:     'Usage: npx thumbgate subscribe <email>\n\nSubscribe to the 5-minute setup guide + trial reminders.',
+  lessons:       'Usage: npx thumbgate lessons [--query="..."] [--limit=N]\n\nSearch the lesson database (Pro feature).',
+  search:        'Usage: npx thumbgate search <query>\n\nSearch ThumbGate knowledge base (Pro feature).',
+  'gate-check':  'Usage: npx thumbgate gate-check\n\nPreToolUse hook interface: reads tool call JSON from stdin, outputs gate verdict.',
+  'export-dpo':  'Usage: npx thumbgate export-dpo [--format=jsonl|csv]\n\nExport feedback as DPO training pairs (Pro feature).',
+  status:        'Usage: npx thumbgate status\n\nShow ThumbGate system health and active configuration.',
+  watch:         'Usage: npx thumbgate watch\n\nWatch for feedback changes and auto-regenerate prevention rules.',
+  compact:       'Usage: npx thumbgate compact\n\nCompact the lesson database and reclaim disk space.',
+  'context-packs': 'Usage: npx thumbgate context-packs\n\nGenerate context packs from top failure patterns.',
+  suggest:       'Usage: npx thumbgate suggest <gate-id>\n\nSuggest fixes for a specific gate based on lesson history.',
+  cost:          'Usage: npx thumbgate cost [--json] [--stats <path>] [--mix \'{"claude-sonnet-4-5":0.8,...}\']\n\nShow cumulative $ and tokens saved by PreToolUse gate blocks. Reads ~/.thumbgate/gate-stats.json.',
+  savings:       'Usage: npx thumbgate savings [--json] [--stats <path>] [--mix \'{"claude-sonnet-4-5":0.8,...}\']\n\nAlias for `thumbgate cost`.',
+};
+
+if (_wantsHelp && COMMAND && SUBCOMMAND_HELP[COMMAND]) {
+  console.log(SUBCOMMAND_HELP[COMMAND]);
+  process.exit(0);
+}
+
 switch (COMMAND) {
   case '--version':
   case '-v':
@@ -2515,6 +2651,17 @@ switch (COMMAND) {
   case 'revenue':
     cfo();
     break;
+  case 'cost':
+  case 'savings':
+  case 'costs': {
+    const { main: costMain } = require(path.join(PKG_ROOT, 'scripts', 'cost-cli'));
+    process.exit(costMain(process.argv.slice(3)));
+    // process.exit doesn't return, but keep an explicit break so the switch
+    // cannot accidentally fall through to case 'billing:setup' if a future
+    // refactor wraps costMain in try/finally that intercepts the exit, or
+    // a test runner stubs process.exit (flagged by gitar-bot on PR #2281).
+    break;
+  }
   case 'billing:setup':
     require(path.join(PKG_ROOT, 'scripts', 'billing-setup'));
     break;
@@ -2773,6 +2920,41 @@ switch (COMMAND) {
   case 'self-heal':
     selfHeal();
     break;
+  case 'trial': {
+    // Show trial status — connects the 4K monthly npm installers to checkout
+    const { isProTier, isInTrialPeriod, trialDaysRemaining, getInstallAgeDays } = require(path.join(PKG_ROOT, 'scripts', 'rate-limiter'));
+    const ageDays = getInstallAgeDays();
+    const inTrial = isInTrialPeriod();
+    const remaining = trialDaysRemaining();
+    const isPro = isProTier();
+    console.log('');
+    console.log('  ThumbGate Pro Trial');
+    console.log('  ──────────────────');
+    if (isPro && !inTrial) {
+      console.log('  Status: ✅ Pro (active license or API key)');
+    } else if (inTrial) {
+      const expiryDate = new Date(Date.now() + remaining * 86400000).toLocaleDateString('en-US', { month: 'long', day: 'numeric', year: 'numeric' });
+      console.log(`  Status: 🎁 Active (${remaining} day${remaining === 1 ? '' : 's'} remaining)`);
+      console.log(`  Expires: ${expiryDate}`);
+      console.log('');
+      console.log('  All Pro features unlocked:');
+      console.log('    • Unlimited prevention rules (free tier: 5)');
+      console.log('    • Recall, lesson search, DPO export');
+      console.log('    • Cross-machine sync via API key');
+    } else {
+      console.log('  Status: ⏰ Expired');
+      if (ageDays !== null) {
+        console.log(`  Installed: ${Math.floor(ageDays)} days ago`);
+      }
+      console.log('');
+      console.log('  Free tier: 5 active rules, no recall/search/export');
+    }
+    console.log('');
+    console.log(`  Keep Pro: ${PRO_CHECKOUT_URL}`);
+    console.log(`  Or set: THUMBGATE_API_KEY=<your-key>`);
+    console.log('');
+    break;
+  }
   case 'pro':
     pro();
     break;

package/config/post-deploy-marketing-pages.json

@@ -27,6 +27,11 @@
       "sentinel": "ThumbGate",
       "description": "First-party numbers / data transparency page"
     },
+    {
+      "route": "/ai-malpractice-prevention",
+      "sentinel": "AI Intake Risk Controls for Law Firms",
+      "description": "Legal AI intake risk-controls page for law-firm pilot conversations"
+    },
     {
       "route": "/llm-context.md",
       "sentinel": "## What ThumbGate Is",

package/openapi/openapi.yaml

@@ -72,6 +72,11 @@ components:
           description: Optional domain tags. If omitted, ThumbGate infers one from the feedback text before promotion.
         skill:
           type: string
+        source:
+          type: string
+          enum: [chatgpt_gpt]
+          default: chatgpt_gpt
+          description: Attribution marker for ThumbGate analytics. The published ThumbGate GPT should send `chatgpt_gpt` so owner dashboards can distinguish GPT Action calls from local API calls.
     IntentPlanRequest:
       type: object
       required: [intentId]
@@ -880,6 +885,11 @@ paths:
                 toolName:
                   type: string
                   description: Tool name is optional when provider-native tool call payload is supplied.
+                source:
+                  type: string
+                  enum: [chatgpt_gpt]
+                  default: chatgpt_gpt
+                  description: Attribution marker for ThumbGate analytics. The published ThumbGate GPT should send `chatgpt_gpt` so owner dashboards can distinguish GPT Action calls from local API calls.
                 provider:
                   type: string
                 model:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.22.0",
+  "version": "1.23.1",
   "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 33 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
   "homepage": "https://thumbgate-production.up.railway.app",
   "repository": {
@@ -162,10 +162,12 @@
     "scripts/security-scanner.js",
     "scripts/self-distill-agent.js",
     "scripts/self-heal.js",
+    "scripts/self-healing-check.js",
     "scripts/semantic-dedup.js",
     "scripts/semantic-layer.js",
     "scripts/seo-gsd.js",
     "scripts/settings-hierarchy.js",
+    "scripts/silent-failure-cluster.js",
     "scripts/single-use-credential-gate.js",
     "scripts/skill-generator.js",
     "scripts/skill-rag-router.js",
@@ -224,6 +226,8 @@
     "public/agent-manager.html",
     "public/blog.html",
     "public/codex-enterprise.html",
+    "public/agents-cost-savings.html",
+    "public/ai-malpractice-prevention.html",
     "public/codex-plugin.html",
     "public/compare.html",
     "public/dashboard.html",
@@ -334,7 +338,7 @@
     "social:prospect:bluesky:dry": "node scripts/social-bluesky-prospecting.js --dry-run",
     "social:reply-publish:bluesky:dry": "node scripts/social-reply-monitor-bluesky.js --publish-approved --dry-run",
     "test:python": "python3 -m pytest tests/*.py",
-    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:zernio && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:post-everywhere-zernio-default && npm run test:zernio-canonical-pollers && npm run test:zernio-status && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:plan-gate && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:bot-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:community-course-platform-launch-kit && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:social-dedupe-cleanup && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:demo-voiceover && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes",
+    "test": "npm run test:python && npm run test:schema && npm run test:loop && npm run test:dpo && npm run test:kto && npm run test:api && npm run test:proof && npm run test:e2e && npm run test:rlaif && npm run test:attribution && npm run test:quality && npm run test:intelligence && npm run test:training-export && npm run test:deployment && npm run test:operational-integrity && npm run test:workflow && npm run test:billing && npm run test:cli && npm run test:watcher && npm run test:autoresearch && npm run test:ops && npm run test:session-analyzer && npm run test:tessl && npm run test:gates && npm run test:evoskill && npm run test:gates-hardening && npm run test:workers && npm run test:social-analytics && npm run test:memalign && npm run test:xmemory-lite && npm run test:filesystem-search && npm run test:zernio && npm run test:platform-limits && npm run test:post-video && npm run test:post-everywhere-instagram && npm run test:post-everywhere-channels && npm run test:post-everywhere-zernio-default && npm run test:zernio-canonical-pollers && npm run test:zernio-status && npm run test:obsidian-export && npm run test:lesson-db && npm run test:lesson-rotation && npm run test:memory-dedup && npm run test:feedback-quality && npm run test:sync-version && npm run test:check-congruence && npm run test:tool-registry && npm run test:feedback-to-rules && npm run test:memory-firewall && npm run test:memory-scope-readiness && npm run test:belief-update && npm run test:hosted-config && npm run test:operational-summary && npm run test:operational-dashboard && npm run test:operator-artifacts && npm run test:operator-key-auth && npm run test:cloudflare-sandbox && npm run test:mcp-config && npm run test:plan-gate && npm run test:pulse && npm run test:semantic-layer && npm run test:data-pipeline && npm run test:optimize-context && npm run test:principle-extractor && npm run test:analytics-window && npm run test:funnel-analytics && npm run test:experiment-tracker && npm run test:build-metadata && npm run test:context-engine && npm run test:hf-papers && npm run test:marketing-experiment && npm run test:seo-gsd && npm run test:verify-run && npm run test:export-dpo-pairs && npm run test:export-hf-dataset && npm run test:license && npm run test:bot-detector && npm run test:audit-pr-bot-contamination && npm run test:stripe-bootstrap-saas-catalog && npm run test:postinstall && npm run test:funnel-invariants && npm run test:cli-telemetry && npm run test:pro-parity && npm run test:model-tier-router && npm run test:computer-use-firewall && npm run test:skill-exporter && npm run test:statusline && npm run test:evolution && npm run test:org-dashboard && npm run test:multi-hop-recall && npm run test:synthetic-dpo && npm run test:thumbgate-skill && npm run test:learn-hub && npm run test:feedback-fallback && npm run test:metaclaw && npm run test:server-lock && npm run test:control-tower && npm run test:pii-scanner && npm run test:data-governance && npm run test:lesson-inference && npm run test:semantic-dedup && npm run test:fs-utils && npm run test:cli-schema && npm run test:explore && npm run test:lesson-reranker && npm run test:lesson-retrieval && npm run test:cross-encoder && npm run test:reflector-agent && npm run test:feedback-session && npm run test:feedback-history-distiller && npm run test:hallucination-detector && npm run test:history-distiller && npm run test:predictive-insights && npm run test:prove-predictive-insights && npm run test:statusbar-cli && npm run test:generate-instagram-card && npm run test:instagram-thumbgate-post && npm run test:publish-instagram-thumbgate && npm run test:lesson-synthesis && npm run test:lesson-canonical && npm run test:background-governance && npm run test:memory-migration && npm run test:prompt-dlp && npm run test:ephemeral-store && npm run test:agent-security && npm run test:skill-progressive && npm run test:per-step-scoring && npm run test:weekly-auto-post && npm run test:social-post-hourly && npm run test:social-quality-gate && npm run test:a2ui-engine && npm run test:gate-satisfy && npm run test:money-watcher && npm run test:budget && npm run test:quick-start && npm run test:utm && npm run test:product-feedback && npm run test:feedback-root-consolidator && npm run test:engagement-audit && npm run test:install-growth-automation && npm run test:publish-thumbgate-launch && npm run test:community-course-platform-launch-kit && npm run test:reconcile-thumbgate-campaign && npm run test:reddit-publisher && npm run test:schedule-thumbgate-campaign && npm run test:social-reply-monitor && npm run test:social-dedupe-cleanup && npm run test:sync-launch-assets && npm run test:ai-search-visibility && npm run test:perplexity && npm run test:security-scanner && npm run test:llm-client && npm run test:managed-lesson-agent && npm run test:self-distill && npm run test:meta-agent && npm run test:harness-selector && npm run test:thumbgate-bench && npm run test:seo-guides && npm run test:enforcement-loop && npm run test:cli-agent-experience && npm run test:bot-detection && npm run test:checkout-archived-product-guard && npm run test:postgres-guard && npm run test:checkout-bot-guard && npm run test:checkout-pro-confirmation-gate && npm run test:session-health && npm run test:session-episodes && npm run test:spec-gate && npm run test:decision-trace && npm run test:dashboard-insights && npm run test:telemetry-tracked-link-slug && npm run test:prompt-eval && npm run test:demo-voiceover && npm run test:gate-coherence && npm run test:gate-eval && npm run test:high-roi && npm run test:public-static-assets && npm run test:token-savings && npm run test:numbers-page && npm run test:workflow-gate-checkpoint && npm run test:lesson-export-import && npm run test:landing-page-claims && npm run test:competitive-positioning-marketing && npm run test:medium-weekly && npm run test:dashboard-deeplink-e2e && npm run test:public-package-parity && npm run test:token-savings-dashboard && npm run test:cursor-wiring && npm run test:pretooluse-injection && npm run test:recent-corrective-context && npm run test:durability-step && npm run test:mailer && npm run test:brand-assets && npm run test:enforcement-teeth && npm run test:bayes-optimal-gate && npm run test:swarm-coordinator && npm run test:session-report && npm run test:agent-reasoning-traces && npm run test:judge-reward && npm run test:llm-behavior-monitor && npm run test:prompting-os && npm run test:single-use-credential-gate && npm run test:structured-prompt-driven && npm run test:require-evidence-gate && npm run test:rule-validator && npm run test:bluesky-atproto && npm run test:social-reply-monitor-bluesky && npm run test:bluesky-delete-replies && npm run test:architect-kit-memory-bridge && npm run test:sonar-review-hotspots && npm run test:actionable-remediations && npm run test:gemini-embedding-policy && npm run test:agent-design-governance && npm run test:public-core-boundary && npm run test:hook-stop-verify-deploy && npm run test:hook-stop-anti-claim && npm run test:plausible-server-events && npm run test:activation-tracker && npm run test:unified-revenue-rollup && npm run test:conversion-rate-stats && npm run test:external-customer-audit && npm run test:telemetry-export && npm run test:stripe-checkout-diagnostic && npm run test:stripe-business-identity-probe && npm run test:revenue-observability-doctor && npm run test:public-bundle-ratchet && npm run test:stripe-payment-link-update && npm run test:ci-cd-hygiene-audit && npm run test:verify-marketing-pages-deployed && npm run test:install-email-capture && npm run test:install-shim && npm run test:hook-runtime-subcommands && npm run test:implementation-notes && npm run test:daily-block-cap && npm run test:free-to-paid-conversion-units && npm run test:metrics-real-endpoint && npm run test:cli-trial-and-help && npm run test:cost-cli && npm run test:silent-failure-cluster",
     "test:hook-stop-verify-deploy": "node --test tests/hook-stop-verify-deploy.test.js",
     "test:hook-stop-anti-claim": "node --test tests/hook-stop-anti-claim.test.js",
     "test:plausible-server-events": "node --test tests/plausible-server-events.test.js",
@@ -444,7 +448,7 @@
     "test:evolution": "node --test tests/workspace-evolver.test.js",
     "test:watcher": "node --test tests/jsonl-watcher.test.js",
     "test:autoresearch": "node --test tests/autoresearch.test.js",
-    "test:ops": "node --test tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/gate-stats.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js",
+    "test:ops": "node --test tests/adk-consolidator.test.js tests/anthropic-partner-strategy.test.js tests/auto-promote-gates.test.js tests/auto-wire-hooks.test.js tests/claude-skill.test.js tests/codegraph-context.test.js tests/commercial-signals.test.js tests/decision-journal.test.js tests/delegation-runtime.test.js tests/disagreement-mining.test.js tests/failure-diagnostics.test.js tests/gate-stats.test.js tests/gates-engine-upgrade-cta.test.js tests/git-hook-installer.test.js tests/github-billing.test.js tests/intervention-policy.test.js tests/markdown-escape.test.js tests/mcp-tools-gates.test.js tests/native-messaging-audit.test.js tests/project-bayes-e2e.test.js tests/project-bayes.test.js tests/rate-limiter.test.js tests/schedule-manager.test.js tests/session-handoff.test.js tests/skill-generator.test.js tests/smart-learning.test.js tests/spike-and-sink.test.js tests/stripe-revenue.test.js tests/stripe-webhook-route.test.js tests/stripe-webhook-rotation.test.js tests/train-from-feedback.test.js tests/workflow-hardening-sprint.test.js tests/workflow-sentinel.test.js tests/test-suite-parity.test.js tests/a2ui-engine.test.js tests/webhook-delivery.test.js tests/auto-context-packs.test.js tests/daily-block-cap.test.js",
     "test:session-analyzer": "node --test tests/session-analyzer.test.js",
     "test:tessl": "node --test tests/tessl-export.test.js",
     "test:gates": "node --test tests/gate-templates.test.js tests/gates-engine.test.js tests/claim-verification.test.js tests/secret-scanner.test.js tests/secret-fixture-safety.test.js tests/prompt-guard.test.js tests/audit-trail.test.js tests/profile-router.test.js tests/workflow-sentinel.test.js tests/docker-sandbox-planner.test.js tests/mcp-tools-suggest-fix.test.js",
@@ -599,6 +603,7 @@
     "agent:schedule": "node scripts/schedule-manager.js install --label managed-lesson-agent --spec 'daily 02:00' --command 'npm run agent:run' --workingDirectory .",
     "feedback:rules:llm": "node scripts/feedback-to-rules.js --llm",
     "test:self-distill": "node --test tests/self-distill-agent.test.js",
+    "test:silent-failure-cluster": "node --test tests/silent-failure-cluster.test.js",
     "test:seo-guides": "node --test tests/seo-guides.test.js",
     "self-distill:run": "node scripts/self-distill-agent.js",
     "self-distill:dry": "node scripts/self-distill-agent.js --dry-run",
@@ -633,6 +638,7 @@
     "test:high-roi": "node --test tests/high-roi.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/openclaw-agent-governance-kit.test.js",
     "test:public-static-assets": "node --test tests/public-static-assets.test.js",
     "test:token-savings": "node --test tests/token-savings.test.js",
+    "test:cost-cli": "node --test tests/cost-cli.test.js tests/conversion-receipt.test.js",
     "test:numbers-page": "node --test tests/numbers-page.test.js",
     "test:workflow-gate-checkpoint": "node --test tests/workflow-gate-checkpoint.test.js tests/autonomous-workflow.test.js",
     "workflow:autonomous": "node scripts/autonomous-workflow.js",
@@ -665,6 +671,10 @@
     "test:install-shim": "node --test tests/install-shim.test.js",
     "test:hook-runtime-subcommands": "node --test tests/hook-runtime-subcommands.test.js",
     "test:implementation-notes": "node --test tests/implementation-notes.test.js",
+    "test:daily-block-cap": "node --test tests/daily-block-cap.test.js",
+    "test:free-to-paid-conversion-units": "node --test tests/free-to-paid-conversion-units.test.js",
+    "test:metrics-real-endpoint": "node --test tests/metrics-real-endpoint.test.js",
+    "test:cli-trial-and-help": "node --test tests/cli-trial-and-help.test.js",
     "test:lessons-page-clickability": "playwright test tests/e2e/lessons-page-clickability.spec.js",
     "test:index-page-clickability": "playwright test tests/e2e/index-page-clickability.spec.js",
     "test:dashboard-page-clickability": "playwright test tests/e2e/dashboard-page-clickability.spec.js",