thumbgate 1.27.16 → 1.27.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (165) hide show
  1. package/.claude-plugin/marketplace.json +85 -0
  2. package/.claude-plugin/plugin.json +3 -4
  3. package/.well-known/llms.txt +12 -33
  4. package/.well-known/mcp/server-card.json +8 -8
  5. package/README.md +30 -215
  6. package/adapters/chatgpt/openapi.yaml +1695 -0
  7. package/adapters/claude/.mcp.json +2 -2
  8. package/adapters/gemini/function-declarations.json +0 -1
  9. package/adapters/mcp/server-stdio.js +11 -263
  10. package/adapters/opencode/opencode.json +1 -1
  11. package/bench/thumbgate-bench.json +2 -2
  12. package/bin/cli.js +122 -1421
  13. package/bin/postinstall.js +27 -11
  14. package/config/gate-templates.json +0 -216
  15. package/config/gates/claim-verification.json +0 -12
  16. package/config/gates/default.json +2 -31
  17. package/config/github-about.json +2 -2
  18. package/config/mcp-allowlists.json +13 -23
  19. package/config/merge-quality-checks.json +1 -0
  20. package/config/model-candidates.json +6 -121
  21. package/openapi/openapi.yaml +0 -12
  22. package/package.json +98 -228
  23. package/public/blog.html +4 -4
  24. package/public/codex-plugin.html +20 -72
  25. package/public/compare.html +8 -31
  26. package/public/dashboard.html +166 -930
  27. package/public/federal.html +2 -2
  28. package/public/guide.html +9 -33
  29. package/public/index.html +116 -495
  30. package/public/learn.html +18 -191
  31. package/public/lessons.html +10 -168
  32. package/public/numbers.html +7 -7
  33. package/public/pro.html +11 -34
  34. package/scripts/agent-memory-lifecycle.js +0 -211
  35. package/scripts/agent-readiness.js +3 -167
  36. package/scripts/agent-reward-model.js +1 -53
  37. package/scripts/auto-promote-gates.js +10 -82
  38. package/scripts/auto-wire-hooks.js +0 -14
  39. package/scripts/billing.js +1 -93
  40. package/scripts/build-metadata.js +10 -50
  41. package/scripts/cli-feedback.js +6 -18
  42. package/scripts/cli-schema.js +0 -90
  43. package/scripts/cli-telemetry.js +1 -6
  44. package/scripts/commercial-offer.js +2 -82
  45. package/scripts/context-manager.js +6 -74
  46. package/scripts/dashboard.js +2 -68
  47. package/scripts/durability/step.js +3 -3
  48. package/scripts/export-databricks-bundle.js +1 -5
  49. package/scripts/export-dpo-pairs.js +2 -7
  50. package/scripts/feedback-loop.js +1 -123
  51. package/scripts/feedback-quality.js +0 -87
  52. package/scripts/filesystem-search.js +10 -35
  53. package/scripts/gate-stats.js +0 -89
  54. package/scripts/gates-engine.js +85 -1105
  55. package/scripts/gemini-embedding-policy.js +1 -2
  56. package/scripts/hook-runtime.js +14 -20
  57. package/scripts/hook-thumbgate-cache-updater.js +2 -18
  58. package/scripts/hybrid-feedback-context.js +7 -142
  59. package/scripts/lesson-inference.js +3 -8
  60. package/scripts/lesson-search.js +1 -17
  61. package/scripts/license.js +1 -0
  62. package/scripts/llm-client.js +9 -390
  63. package/scripts/local-model-profile.js +8 -15
  64. package/scripts/memory-scope-readiness.js +0 -159
  65. package/scripts/meta-agent-loop.js +0 -36
  66. package/scripts/operational-integrity.js +5 -39
  67. package/scripts/oss-pr-opportunity-scout.js +5 -35
  68. package/scripts/plausible-server-events.js +6 -9
  69. package/scripts/pro-local-dashboard.js +4 -4
  70. package/scripts/proxy-pointer-rag-guardrails.js +1 -42
  71. package/scripts/rate-limiter.js +13 -64
  72. package/scripts/secret-scanner.js +5 -44
  73. package/scripts/security-scanner.js +10 -260
  74. package/scripts/self-distill-agent.js +1 -3
  75. package/scripts/seo-gsd.js +2 -916
  76. package/scripts/statusline-cache-path.js +2 -17
  77. package/scripts/statusline-local-stats.js +1 -9
  78. package/scripts/statusline-meta.js +2 -28
  79. package/scripts/statusline.sh +4 -20
  80. package/scripts/telemetry-analytics.js +0 -357
  81. package/scripts/thompson-sampling.js +10 -31
  82. package/scripts/thumbgate-bench.js +1 -16
  83. package/scripts/thumbgate-search.js +19 -85
  84. package/scripts/tool-registry.js +1 -169
  85. package/scripts/vector-store.js +0 -45
  86. package/scripts/workflow-sentinel.js +53 -286
  87. package/scripts/workspace-evolver.js +2 -62
  88. package/src/api/server.js +290 -2578
  89. package/.claude/commands/dashboard.md +0 -15
  90. package/.claude/commands/thumbgate-blocked.md +0 -27
  91. package/.claude/commands/thumbgate-dashboard.md +0 -15
  92. package/.claude/commands/thumbgate-doctor.md +0 -30
  93. package/.claude/commands/thumbgate-guard.md +0 -36
  94. package/.claude/commands/thumbgate-protect.md +0 -30
  95. package/.claude/commands/thumbgate-rules.md +0 -30
  96. package/.well-known/agentic-verify.txt +0 -1
  97. package/adapters/gcp/dfcx-webhook-gate.js +0 -295
  98. package/adapters/letta/README.md +0 -41
  99. package/adapters/letta/thumbgate-letta-adapter.js +0 -133
  100. package/adapters/policy-engine/ethicore-guardian-client.js +0 -68
  101. package/adapters/policy-engine/thumbgate-policy-engine-adapter.js +0 -260
  102. package/bench/observability-eval-suite.json +0 -26
  103. package/bin/dashboard-cli.js +0 -7
  104. package/commands/dashboard.md +0 -15
  105. package/commands/thumbgate-dashboard.md +0 -15
  106. package/config/builtin-lessons.json +0 -23
  107. package/config/gate-classifier-routing.json +0 -98
  108. package/config/post-deploy-marketing-pages.json +0 -61
  109. package/public/about.html +0 -162
  110. package/public/agent-manager.html +0 -179
  111. package/public/agents-cost-savings.html +0 -153
  112. package/public/ai-malpractice-prevention.html +0 -818
  113. package/public/assets/brand/github-social-preview.png +0 -0
  114. package/public/assets/brand/thumbgate-icon-512.png +0 -0
  115. package/public/assets/brand/thumbgate-icon-pro-512.png +0 -0
  116. package/public/assets/brand/thumbgate-icon-team-512.png +0 -0
  117. package/public/assets/brand/thumbgate-logo-1200x360.png +0 -0
  118. package/public/assets/brand/thumbgate-logo-transparent.svg +0 -22
  119. package/public/assets/brand/thumbgate-mark-inline-v3.svg +0 -19
  120. package/public/assets/brand/thumbgate-mark-pro.svg +0 -23
  121. package/public/assets/brand/thumbgate-mark-team.svg +0 -26
  122. package/public/assets/brand/thumbgate-mark.svg +0 -21
  123. package/public/assets/brand/thumbgate-wordmark.svg +0 -20
  124. package/public/assets/claude-thumbgate-statusbar.svg +0 -8
  125. package/public/assets/codex-thumbgate-statusbar-test.svg +0 -9
  126. package/public/assets/legal-intake-control-flow.svg +0 -66
  127. package/public/brand/thumbgate-mark.svg +0 -19
  128. package/public/brand/thumbgate-og.svg +0 -16
  129. package/public/chatgpt-app.html +0 -330
  130. package/public/codex-enterprise.html +0 -123
  131. package/public/js/buyer-intent.js +0 -672
  132. package/public/pricing.html +0 -399
  133. package/scripts/action-receipts.js +0 -324
  134. package/scripts/activation-quickstart.js +0 -187
  135. package/scripts/agent-operations-planner.js +0 -621
  136. package/scripts/ai-component-inventory.js +0 -367
  137. package/scripts/async-eval-observability.js +0 -236
  138. package/scripts/audit.js +0 -65
  139. package/scripts/aws-blocks-guardrails.js +0 -228
  140. package/scripts/classifier-routing.js +0 -130
  141. package/scripts/dashboard-chat.js +0 -332
  142. package/scripts/feedback-aggregate.js +0 -281
  143. package/scripts/feedback-sanitizer.js +0 -105
  144. package/scripts/hob-pack.js +0 -591
  145. package/scripts/hook-stop-anti-claim.js +0 -301
  146. package/scripts/install-shim.js +0 -87
  147. package/scripts/mcp-oauth.js +0 -293
  148. package/scripts/noop-detect.js +0 -285
  149. package/scripts/omlx-smoke.js +0 -192
  150. package/scripts/parallel-workflow-orchestrator.js +0 -293
  151. package/scripts/plan-gate.js +0 -243
  152. package/scripts/plausible-domain-config.js +0 -99
  153. package/scripts/qa-scenario-planner.js +0 -136
  154. package/scripts/repeat-metric.js +0 -137
  155. package/scripts/secret-fixture-tokens.js +0 -61
  156. package/scripts/secret-redaction.js +0 -166
  157. package/scripts/self-harness-optimizer.js +0 -141
  158. package/scripts/self-healing-check.js +0 -193
  159. package/scripts/silent-failure-cluster.js +0 -531
  160. package/scripts/statusline-cache-read.js +0 -57
  161. package/scripts/sync-telemetry-from-prod.js +0 -374
  162. package/scripts/tool-contract-validator.js +0 -76
  163. package/scripts/trajectory-scorer.js +0 -63
  164. package/scripts/verify-marketing-pages-deployed.js +0 -195
  165. package/scripts/visitor-journey.js +0 -172
@@ -4,8 +4,8 @@
4
4
  "workloads": {
5
5
  "pretool-gating": {
6
6
  "label": "PreTool gating",
7
- "summary": "Fast, reliable gate judgments for tool-use and agentic coding decisions before commands run. Hybrid local-cloud candidates (e.g. perplexity/hybrid-local) excel here for privacy + low latency on sensitive paths.",
8
- "desiredStrengths": ["agentic-coding", "tool-use", "reliability", "privacy", "fast-inference"],
7
+ "summary": "Fast, reliable gate judgments for tool-use and agentic coding decisions before commands run.",
8
+ "desiredStrengths": ["agentic-coding", "tool-use", "reliability"],
9
9
  "targetContextWindow": 64000,
10
10
  "benchmarkCommands": [
11
11
  "npx thumbgate eval --from-feedback --json --min-score=0",
@@ -43,8 +43,8 @@
43
43
  },
44
44
  "cheap-fast-path": {
45
45
  "label": "Cheap fast path",
46
- "summary": "Low-cost first-pass model for cheap approval triage before escalating ambiguous work. Perplexity hybrid-local is ideal: on-device for speed/privacy, escalate only when needed via orchestrator.",
47
- "desiredStrengths": ["agentic-coding", "tool-use", "fast-inference", "privacy", "cost-efficiency"],
46
+ "summary": "Low-cost first-pass model for cheap approval triage before escalating ambiguous work.",
47
+ "desiredStrengths": ["agentic-coding", "tool-use"],
48
48
  "targetContextWindow": 32000,
49
49
  "benchmarkCommands": [
50
50
  "npx thumbgate eval --from-feedback --json --min-score=0",
@@ -60,8 +60,8 @@
60
60
  },
61
61
  "dashboard-analysis": {
62
62
  "label": "Dashboard and dataset analysis",
63
- "summary": "Evaluate frontier models for dataset analysis, chart generation, dashboard planning, and proof-backed insight quality before routing expensive analytical work. Perplexity hybrid excels for sensitive lessons/feedback data (local for privacy, cloud for depth).",
64
- "desiredStrengths": ["data-analysis", "dashboard-creation", "charting", "long-context", "reliability", "privacy"],
63
+ "summary": "Evaluate frontier models for dataset analysis, chart generation, dashboard planning, and proof-backed insight quality before routing expensive analytical work.",
64
+ "desiredStrengths": ["data-analysis", "dashboard-creation", "charting", "long-context", "reliability"],
65
65
  "targetContextWindow": 200000,
66
66
  "benchmarkCommands": [
67
67
  "npx thumbgate eval --from-feedback --json --min-score=0",
@@ -77,27 +77,6 @@
77
77
  "costPerAnalysisUsd"
78
78
  ]
79
79
  },
80
- "claw-style-enterprise-agent": {
81
- "label": "Claw-style enterprise agent governance",
82
- "summary": "Governance, gating, and feedback for autonomous 'claw-style' agents (Automation Anywhere EnterpriseClaw, Nvidia OpenShell-inspired) that have device file system access, runtime dynamic tool creation, screen/UI interaction, and multi-platform orchestration. Especially relevant for on-prem/air-gapped/hybrid enterprise data realities.",
83
- "desiredStrengths": ["agentic-coding", "tool-use", "reliability", "security", "orchestration", "audit-trail", "privacy"],
84
- "targetContextWindow": 128000,
85
- "benchmarkCommands": [
86
- "npx thumbgate eval --from-feedback --json --min-score=0",
87
- "node scripts/gate-eval.js run",
88
- "npx thumbgate bench --json --min-score=90"
89
- ],
90
- "metrics": [
91
- "passRate",
92
- "falsePositiveRate",
93
- "agentIdentitySeparation",
94
- "dynamicToolSafety",
95
- "screenInteractionAudit",
96
- "orchestrationCompliance",
97
- "medianLatencyMs",
98
- "costPer1kActionsUsd"
99
- ]
100
- },
101
80
  "tokenizer-brittleness": {
102
81
  "label": "Tokenizer brittleness and byte-level robustness",
103
82
  "summary": "Evaluate models for malformed JSONL, Unicode confusables, stack traces, secrets, SQL snippets, file paths, and code-symbol-heavy inputs before routing log, code, or security workloads.",
@@ -116,23 +95,6 @@
116
95
  "medianLatencyMs",
117
96
  "memoryBandwidthEstimate"
118
97
  ]
119
- },
120
- "self-improving-agent-skill-synthesis": {
121
- "label": "Self-improving agent skill synthesis",
122
- "summary": "Evaluate models on their ability to self-improve, generate safe Markdown skills, and correctly check synthesized skills against existing gate/prevention rules.",
123
- "desiredStrengths": ["agentic-coding", "tool-use", "self-evolving", "skill-synthesis", "reliability"],
124
- "targetContextWindow": 128000,
125
- "benchmarkCommands": [
126
- "npx thumbgate eval --from-feedback --json --min-score=0",
127
- "node scripts/gate-eval.js run"
128
- ],
129
- "metrics": [
130
- "passRate",
131
- "skillSafetyCheckAccuracy",
132
- "ruleBypassDetectionRate",
133
- "medianLatencyMs",
134
- "costPerEvolutionUsd"
135
- ]
136
98
  }
137
99
  },
138
100
  "candidates": [
@@ -252,83 +214,6 @@
252
214
  "costClass": "low",
253
215
  "strengths": ["agentic-coding", "tool-use", "fast-inference"],
254
216
  "notes": "Cheapest Tinker candidate for the fast gate path; use when latency/cost matter most."
255
- },
256
- {
257
- "id": "perplexity/hybrid-local-cloud",
258
- "vendor": "Perplexity",
259
- "family": "hybrid",
260
- "provider": "perplexity",
261
- "model": "hybrid-local-cloud-orchestrator",
262
- "contextWindow": 200000,
263
- "costClass": "variable",
264
- "strengths": ["agentic-coding", "tool-use", "privacy", "cost-efficiency", "fast-inference", "long-context", "reliability"],
265
- "notes": "Perplexity hybrid local-cloud inference orchestrator (announced Computex 2026, part of Personal Computer). Autonomously routes: sensitive/privacy work to local on-device models, complex reasoning to frontier cloud. High-ROI for pretool-gating (local fast/privacy path), cheap-fast-path, and dashboard-analysis with sensitive data/lessons. Pair with ThumbGate hybrid-routing gates (see adapters/perplexity/HYBRID.md). Coming July 2026 for local inference."
266
- },
267
- {
268
- "id": "perplexity/hybrid-local",
269
- "vendor": "Perplexity",
270
- "family": "hybrid",
271
- "provider": "perplexity",
272
- "model": "local-inference",
273
- "contextWindow": 128000,
274
- "costClass": "low",
275
- "strengths": ["fast-inference", "privacy", "tool-use", "reliability"],
276
- "notes": "Local-only mode of Perplexity hybrid for on-device pre-action gating, sensitivity classification, and low-latency checks on AI PCs (Intel, NVIDIA). Escalate via orchestrator for full capability. Use for cheap-fast-path and pretool-gating workloads."
277
- },
278
- {
279
- "id": "automation-anywhere/enterprise-claw",
280
- "vendor": "Automation Anywhere",
281
- "family": "claw-style",
282
- "provider": "automation-anywhere",
283
- "model": "enterprise-claw",
284
- "contextWindow": 200000,
285
- "costClass": "variable",
286
- "strengths": ["agentic-coding", "tool-use", "orchestration", "audit-trail", "security", "on-prem", "airgap", "dynamic-tool-creation", "screen-interaction"],
287
- "notes": "Claw-style autonomous enterprise agents (EnterpriseClaw, inspired by Nvidia OpenShell). Device-level access, runtime tool creation, screen/UI interaction, multi-platform orchestration. Governance infrastructure (ThumbGate) is explicitly called out as catching up. High-ROI for enterprise on-prem/hybrid use cases. Pair with perplexity/hybrid for inference routing. See adapters/claw/CLAW.md and new gate templates."
288
- },
289
- {
290
- "id": "nvidia/openshell-claw",
291
- "vendor": "NVIDIA",
292
- "family": "claw-style",
293
- "provider": "nvidia",
294
- "model": "openshell",
295
- "contextWindow": 128000,
296
- "costClass": "medium",
297
- "strengths": ["agentic-coding", "tool-use", "dynamic-tool-creation", "screen-interaction", "on-prem", "self-evolving"],
298
- "notes": "Nvidia OpenShell runtime for autonomous self-evolving claw-style agents (basis for Automation Anywhere EnterpriseClaw). Run locally/on-prem. ThumbGate provides the missing governance layer (gates, feedback, rules). Use with hybrid local-cloud for full enterprise deployment."
299
- },
300
- {
301
- "id": "nousresearch/hermes-3-llama-3.1-70b",
302
- "vendor": "Nous Research",
303
- "family": "hermes",
304
- "provider": "openrouter",
305
- "model": "hermes-3-llama-3.1-70b",
306
- "contextWindow": 128000,
307
- "costClass": "medium",
308
- "strengths": ["agentic-coding", "tool-use", "self-evolving", "skill-synthesis", "multi-platform", "reasoning"],
309
- "notes": "Nous Research's Hermes 3 model family, optimized for autonomous reasoning, tool-use, and self-improvement loops. Benchmark KV caching, trace-length constraints, and dynamic skill synthesis validation rules before deploying."
310
- },
311
- {
312
- "id": "anthropic/claude-opus-4-8",
313
- "vendor": "Anthropic",
314
- "family": "claude",
315
- "provider": "anthropic",
316
- "model": "claude-opus-4.8",
317
- "contextWindow": 200000,
318
- "costClass": "high",
319
- "strengths": ["agentic-coding", "tool-use", "reliability", "long-context", "long-horizon-coding", "multi-agent"],
320
- "notes": "Frontier coding model with 56.7 Coding Index. Grew 140% WoW on OpenRouter to 1.33T tokens. Ideal for long trace reviews and complex reasoning steps, despite higher latency and cost."
321
- },
322
- {
323
- "id": "google/gemini-3.1-pro-preview",
324
- "vendor": "Google",
325
- "family": "gemini",
326
- "provider": "google",
327
- "model": "gemini-3.1-pro-preview",
328
- "contextWindow": 2000000,
329
- "costClass": "medium",
330
- "strengths": ["agentic-coding", "tool-use", "reliability", "long-context", "data-analysis", "cost-efficiency"],
331
- "notes": "Google's 3.1 Pro Preview model with 55.5 Coding Index and massive 2M token context window. Strong choice for complex RAG tasks, repository-scale auditing, and long-context trace analysis."
332
217
  }
333
218
  ]
334
219
  }
@@ -72,11 +72,6 @@ components:
72
72
  description: Optional domain tags. If omitted, ThumbGate infers one from the feedback text before promotion.
73
73
  skill:
74
74
  type: string
75
- source:
76
- type: string
77
- enum: [chatgpt_gpt]
78
- default: chatgpt_gpt
79
- description: Attribution marker for ThumbGate analytics. The published ThumbGate GPT should send `chatgpt_gpt` so owner dashboards can distinguish GPT Action calls from local API calls.
80
75
  IntentPlanRequest:
81
76
  type: object
82
77
  required: [intentId]
@@ -94,8 +89,6 @@ components:
94
89
  delegationMode:
95
90
  type: string
96
91
  enum: [off, auto, sequential]
97
- enforcePlanQuality:
98
- type: boolean
99
92
  approved:
100
93
  type: boolean
101
94
  repoPath:
@@ -887,11 +880,6 @@ paths:
887
880
  toolName:
888
881
  type: string
889
882
  description: Tool name is optional when provider-native tool call payload is supplied.
890
- source:
891
- type: string
892
- enum: [chatgpt_gpt]
893
- default: chatgpt_gpt
894
- description: Attribution marker for ThumbGate analytics. The published ThumbGate GPT should send `chatgpt_gpt` so owner dashboards can distinguish GPT Action calls from local API calls.
895
883
  provider:
896
884
  type: string
897
885
  model: