thumbgate 1.26.5 → 1.26.6

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate-marketplace",
-  "version": "1.26.5",
+  "version": "1.26.6",
   "owner": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com"
@@ -14,7 +14,7 @@
         "source": "npm",
         "package": "thumbgate"
       },
-      "version": "1.26.5",
+      "version": "1.26.6",
       "author": {
         "name": "Igor Ganapolsky",
         "email": "ig5973700@gmail.com",

package/.claude-plugin/plugin.json

@@ -1,14 +1,14 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.26.5",
+  "version": "1.26.6",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",
     "url": "https://thumbgate.ai"
   },
   "homepage": "https://thumbgate.ai",
-  "repository": "git+https://github.com/IgorGanapolsky/ThumbGate",
+  "repository": "https://github.com/IgorGanapolsky/ThumbGate",
   "license": "MIT",
   "category": "developer-tools",
   "keywords": [

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.26.5",
+  "version": "1.26.6",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate.ai",
   "transport": "stdio",

package/README.md

@@ -335,8 +335,36 @@ npx thumbgate dashboard  # open local dashboard
 npx thumbgate serve      # start MCP server on stdio
 npx thumbgate bench      # run reliability benchmark
 npx thumbgate bench --programbench-smoke  # include cleanroom whole-repo proof lane
+npx thumbgate break-glass --reason="ThumbGate over-fired"  # short TTL recovery for gate over-fire
 ```
 
+### Recovery if a gate over-fires
+
+ThumbGate should block repeated unsafe actions, not trap the operator. If a noisy rule or stale memory pattern blocks the hook/settings change you need to recover, open a short-lived break-glass window:
+
+```bash
+npx thumbgate break-glass --reason="ThumbGate over-fired and blocked operator recovery"
+```
+
+What this unlocks for up to 5 minutes:
+
+- Edits to `.claude/settings.local.json`, `.claude/settings.json`, `.codex/config.toml`, and the same files inside nested workspaces.
+- The short-lived proof gates used for PR recovery: `pr_create_allowed` and `pr_threads_checked`.
+
+What stays gated:
+
+- Force pushes, protected-branch pushes, broad `rm -rf`, unsafe `chmod`, package publishes/releases, and local-only remote side effects.
+- Arbitrary protected files such as `README.md`, `AGENTS.md`, policy bundles, or credentials.
+
+Verify the recovery window and runtime health before continuing:
+
+```bash
+npx thumbgate break-glass --reason="verify recovery path" --json
+npx thumbgate doctor
+```
+
+If you change MCP or hook settings, restart the affected agent session so Claude Code, Cursor, Codex, or another runtime reloads `.mcp.json` and local settings.
+
 ---
 
 ## Pricing

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.26.5", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.26.6", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.26.5", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.26.6", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/mcp/server-stdio.js

@@ -231,7 +231,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.26.5' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.26.6' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.26.5",
+        "thumbgate@1.26.6",
         "thumbgate",
         "serve"
       ],

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "thumbgate",
-  "version": "1.26.5",
+  "version": "1.26.6",
   "description": "ThumbGate self-improving agent governance: thumbs-up/down turns every mistake into a prevention rule and blocks repeat patterns. 36 pre-action checks, budget enforcement, and self-protection for Claude Code, Cursor, Codex, Gemini CLI, and Amp.",
   "homepage": "https://thumbgate.ai",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/IgorGanapolsky/ThumbGate.git"
+    "url": "https://github.com/IgorGanapolsky/ThumbGate.git"
   },
   "bugs": {
     "url": "https://github.com/IgorGanapolsky/ThumbGate/issues"

package/public/dashboard.html

@@ -646,25 +646,29 @@ async function connect(options) {
   var input = document.getElementById('apiKey');
   API_KEY = String(opts.key || input.value || '').trim();
   if (!API_KEY) return;
+  
+  const isEnterprise = API_KEY.startsWith('tg_op_') || API_KEY.startsWith('tg_creator_');
+  const tierName = isEnterprise ? 'Enterprise' : 'Pro';
+
   const status = document.getElementById('authStatus');
   const btn = document.getElementById('connectBtn');
   btn.disabled = true;
   status.className = 'auth-status';
-  status.textContent = opts.localPro ? 'Connecting local dashboard...' : 'Connecting...';
+  status.textContent = opts.localPro ? `Connecting local dashboard...` : 'Connecting...';
   try {
     const res = await fetch('/v1/feedback/stats', { headers: getHeaders() });
     if (!res.ok) throw new Error('Invalid API key');
     const data = await res.json();
     status.className = 'auth-status ok';
-    status.textContent = opts.localPro ? '✓ Local Pro dashboard connected' : '✓ Connected';
+    status.textContent = opts.localPro ? `✓ Local ${tierName} connected` : '✓ Connected';
     document.getElementById('dashboardContent').style.display = 'block';
     if (opts.localPro) {
       input.value = 'local-license';
       input.disabled = true;
-      input.placeholder = 'Local Pro auto-connected';
+      input.placeholder = `Local ${tierName} auto-connected`;
       btn.disabled = true;
       document.getElementById('demoBtn').style.display = 'none';
-      document.getElementById('authHelp').textContent = 'Local Pro is active on this machine. Your personal dashboard is using the saved license key automatically.';
+      document.getElementById('authHelp').textContent = `Local ${tierName} is active on this machine. Your dashboard is using the saved license key automatically.`;
     }
     renderStats(data);
     setSelectedCard('all');
@@ -677,7 +681,7 @@ async function connect(options) {
     status.className = 'auth-status err';
     status.textContent = '✗ ' + e.message;
     if (opts.localPro) {
-      document.getElementById('authHelp').textContent = 'Local Pro bootstrap failed. Paste your THUMBGATE_API_KEY manually or retry the local launcher.';
+      document.getElementById('authHelp').textContent = `Local ${tierName} bootstrap failed. Paste your THUMBGATE_API_KEY manually or retry the local launcher.`;
     }
   }
   if (!opts.localPro) {

package/public/index.html

@@ -20,7 +20,7 @@ __GOOGLE_SITE_VERIFICATION_META__
 <meta property="og:image" content="https://thumbgate.ai/og.png">
 <meta name="twitter:card" content="summary_large_image">
 <meta name="twitter:image" content="https://thumbgate.ai/og.png">
-<meta name="thumbgate-version" content="1.26.5">
+<meta name="thumbgate-version" content="1.26.6">
 <meta name="keywords" content="ThumbGate, thumbgate, AI agent orchestration, AI experience orchestration, agentic development cycle, AC/DC framework, Guide Generate Verify Solve, agent enforcement layer, save LLM tokens, reduce Claude API cost, reduce OpenAI cost, AI agent token savings, prevent LLM retries, prevent hallucination retries, stop AI token waste, pre-action checks, agent governance, Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, workflow hardening, context engineering, AI authenticity, brand authenticity AI">
 <link rel="canonical" href="__APP_ORIGIN__/">
 <link rel="alternate" type="text/markdown" title="ThumbGate LLM context" href="__APP_ORIGIN__/llm-context.md">
@@ -1594,7 +1594,7 @@ __GA_BOOTSTRAP__
       <a href="https://www.linkedin.com/in/igorganapolsky" target="_blank" rel="noopener">LinkedIn</a>
       <a href="/blog">Blog</a>
     </div>
-    <span class="footer-copy">© 2026 ThumbGate · MIT License · npm v1.26.5</span>
+    <span class="footer-copy">© 2026 ThumbGate · MIT License · npm v1.26.6</span>
   </div>
 </footer>
 

package/public/numbers.html

@@ -25,7 +25,7 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.26.5",
+  "softwareVersion": "1.26.6",
   "url": "https://thumbgate.ai/numbers",
   "dateModified": "2026-05-07",
   "creator": {
@@ -202,7 +202,7 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-05-07 · Version 1.26.5</div>
+  <div class="freshness">Updated: 2026-05-07 · Version 1.26.6</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>

package/scripts/statusline-meta.js

@@ -8,10 +8,20 @@ function getStatuslineMeta(options = {}) {
   const pkg = require(path.join(__dirname, '..', 'package.json'));
   const env = options.env || process.env;
   const homeDir = options.homeDir || env.HOME || env.USERPROFILE || '.';
+  
+  // Enterprise detection based on key prefix
+  const apiKey = env.THUMBGATE_API_KEY || env.THUMBGATE_OPERATOR_KEY || '';
+  let activeTier = 'Free';
+  
+  if (apiKey.startsWith('tg_op_') || apiKey.startsWith('tg_creator_')) {
+    activeTier = 'Enterprise';
+  } else if (isProLicensed({ homeDir }) || apiKey.startsWith('tg_pro_')) {
+    activeTier = 'Pro';
+  }
 
   return {
     version: String(pkg.version || '').trim() || 'unknown',
-    tier: isProLicensed({ homeDir }) ? 'Pro' : 'Free',
+    tier: activeTier,
   };
 }
 

package/scripts/statusline.sh

@@ -206,10 +206,10 @@ LINE="${LINE:+${LINE} · }ThumbGate v${TG_VERSION} · ${TG_TIER}"
 if [[ "$UP" = "0" && "$DOWN" = "0" ]]; then
   LINE="${D}${LINE}${RST} · no feedback yet"
   [[ -n "$PR_LABEL" ]] && LINE="${LINE} · ${D}${PR_LABEL}${RST}"
-  if [[ "$STATUSLINE_VERBOSE" = "1" ]]; then
-    LINE="${LINE} · ${C}${DASHBOARD_LINK}${RST} · ${M}${LESSONS_LINK}${RST}"
-    [[ -n "$LATEST_LESSON_LINK" ]] && LINE="${LINE} · ${D}${LATEST_LESSON_LINK}${RST}"
-  fi
+  
+  LINE="${LINE} · ${C}${DASHBOARD_LINK}${RST} · ${M}${LESSONS_LINK}${RST}"
+  [[ -n "$LATEST_LESSON_LINK" ]] && LINE="${LINE} · ${D}${LATEST_LESSON_LINK}${RST}"
+  
   printf '%b\n' "$LINE"
 else
   LINE="${LINE} · ${G}${BD}${UP}${RST}${UP_LINK} ${R}${BD}${DOWN}${RST}${DOWN_LINK} ${ARROW}"
@@ -219,10 +219,9 @@ else
   [[ "${AT_RISK:-0}" -gt 0 ]] && LINE="${LINE} ${R}${AT_RISK}⚠${RST}"
   [[ "${ANOMALIES:-0}" -gt 0 ]] && LINE="${LINE} ${R}${ANOMALIES}☠${RST}"
   [[ -n "$PR_LABEL" ]] && LINE="${LINE} · ${D}${PR_LABEL}${RST}"
-  if [[ "$STATUSLINE_VERBOSE" = "1" ]]; then
-    LINE="${LINE} · ${C}${DASHBOARD_LINK}${RST} · ${M}${LESSONS_LINK}${RST}"
-    [[ -n "$LATEST_LESSON_LINK" ]] && LINE="${LINE} · ${D}${LATEST_LESSON_LINK}${RST}"
-  fi
-
+  
+  LINE="${LINE} · ${C}${DASHBOARD_LINK}${RST} · ${M}${LESSONS_LINK}${RST}"
+  [[ -n "$LATEST_LESSON_LINK" ]] && LINE="${LINE} · ${D}${LATEST_LESSON_LINK}${RST}"
+  
   printf '%b\n' "$LINE"
 fi