thumbgate 1.27.18 → 1.27.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (96) hide show
  1. package/.claude-plugin/marketplace.json +6 -6
  2. package/.claude-plugin/plugin.json +4 -3
  3. package/.well-known/agentic-verify.txt +1 -0
  4. package/.well-known/llms.txt +33 -12
  5. package/.well-known/mcp/server-card.json +8 -8
  6. package/README.md +249 -30
  7. package/adapters/chatgpt/openapi.yaml +12 -0
  8. package/adapters/claude/.mcp.json +2 -2
  9. package/adapters/codex/config.toml +2 -2
  10. package/adapters/gemini/function-declarations.json +1 -0
  11. package/adapters/mcp/server-stdio.js +263 -11
  12. package/adapters/opencode/opencode.json +1 -1
  13. package/bench/thumbgate-bench.json +2 -2
  14. package/bin/cli.js +1429 -121
  15. package/bin/postinstall.js +1 -8
  16. package/config/gate-classifier-routing.json +98 -0
  17. package/config/gate-templates.json +216 -0
  18. package/config/gates/claim-verification.json +12 -0
  19. package/config/gates/default.json +31 -2
  20. package/config/github-about.json +2 -2
  21. package/config/mcp-allowlists.json +23 -13
  22. package/config/merge-quality-checks.json +0 -1
  23. package/config/model-candidates.json +121 -6
  24. package/config/post-deploy-marketing-pages.json +80 -0
  25. package/config/tessl-tiles.json +1 -3
  26. package/openapi/openapi.yaml +12 -0
  27. package/package.json +1 -1
  28. package/public/blog.html +4 -4
  29. package/public/codex-plugin.html +72 -20
  30. package/public/compare.html +31 -8
  31. package/public/dashboard.html +930 -166
  32. package/public/federal.html +2 -2
  33. package/public/guide.html +33 -13
  34. package/public/index.html +469 -111
  35. package/public/learn.html +183 -18
  36. package/public/lessons.html +168 -10
  37. package/public/numbers.html +7 -7
  38. package/public/pro.html +34 -11
  39. package/scripts/agent-memory-lifecycle.js +211 -0
  40. package/scripts/agent-readiness.js +20 -3
  41. package/scripts/agent-reward-model.js +53 -1
  42. package/scripts/auto-promote-gates.js +82 -10
  43. package/scripts/auto-wire-hooks.js +14 -0
  44. package/scripts/billing.js +93 -1
  45. package/scripts/bot-detection.js +61 -3
  46. package/scripts/build-metadata.js +50 -10
  47. package/scripts/cli-feedback.js +4 -2
  48. package/scripts/cli-schema.js +97 -0
  49. package/scripts/cli-telemetry.js +6 -1
  50. package/scripts/commercial-offer.js +82 -2
  51. package/scripts/context-manager.js +74 -6
  52. package/scripts/dashboard.js +68 -2
  53. package/scripts/export-databricks-bundle.js +5 -1
  54. package/scripts/export-dpo-pairs.js +7 -2
  55. package/scripts/feedback-loop.js +123 -1
  56. package/scripts/feedback-quality.js +87 -0
  57. package/scripts/filesystem-search.js +35 -10
  58. package/scripts/gate-stats.js +89 -0
  59. package/scripts/gates-engine.js +1176 -85
  60. package/scripts/gemini-embedding-policy.js +2 -1
  61. package/scripts/hook-runtime.js +20 -14
  62. package/scripts/hook-thumbgate-cache-updater.js +18 -2
  63. package/scripts/hybrid-feedback-context.js +142 -7
  64. package/scripts/lesson-inference.js +8 -3
  65. package/scripts/lesson-search.js +17 -1
  66. package/scripts/license.js +10 -10
  67. package/scripts/llm-client.js +169 -4
  68. package/scripts/local-model-profile.js +15 -8
  69. package/scripts/mcp-config.js +7 -1
  70. package/scripts/memory-scope-readiness.js +159 -0
  71. package/scripts/meta-agent-loop.js +36 -0
  72. package/scripts/operational-integrity.js +39 -5
  73. package/scripts/oss-pr-opportunity-scout.js +35 -5
  74. package/scripts/plausible-server-events.js +9 -6
  75. package/scripts/pro-local-dashboard.js +4 -4
  76. package/scripts/proxy-pointer-rag-guardrails.js +42 -1
  77. package/scripts/published-cli.js +0 -8
  78. package/scripts/rate-limiter.js +64 -13
  79. package/scripts/secret-scanner.js +44 -5
  80. package/scripts/security-scanner.js +260 -10
  81. package/scripts/self-distill-agent.js +3 -1
  82. package/scripts/seo-gsd.js +916 -7
  83. package/scripts/statusline-cache-path.js +17 -2
  84. package/scripts/statusline-local-stats.js +9 -1
  85. package/scripts/statusline-meta.js +28 -2
  86. package/scripts/statusline.sh +20 -4
  87. package/scripts/telemetry-analytics.js +357 -0
  88. package/scripts/thompson-sampling.js +31 -10
  89. package/scripts/thumbgate-bench.js +16 -1
  90. package/scripts/thumbgate-search.js +85 -19
  91. package/scripts/tool-registry.js +169 -1
  92. package/scripts/vector-store.js +45 -0
  93. package/scripts/workflow-sentinel.js +286 -53
  94. package/scripts/workspace-evolver.js +62 -2
  95. package/src/api/server.js +2683 -319
  96. package/scripts/bot-detector.js +0 -50
@@ -16,7 +16,7 @@ __GOOGLE_SITE_VERIFICATION_META__
16
16
  <meta property="og:image" content="/og.png">
17
17
  <meta name="keywords" content="ThumbGate federal, AI agent governance federal, NIST 800-53 AI agent, OMB M-24-10, EO 14110, FedRAMP AI coding agent, federal AI use case inventory, agent audit log, agency AI policy enforcement, Bedrock GovCloud, Azure Government AI, SBIR AI governance">
18
18
 
19
- <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
19
+ <script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
20
20
  __GA_BOOTSTRAP__
21
21
 
22
22
  <script>
@@ -179,7 +179,7 @@ __GA_BOOTSTRAP__
179
179
  <nav>
180
180
  <div class="container">
181
181
  <a class="nav-logo" href="/">
182
- <img class="logo-mark" src="/assets/brand/thumbgate-mark.svg" alt="" />
182
+ <img class="logo-mark" src="/assets/brand/thumbgate-mark-inline-v3.svg" alt="" />
183
183
  ThumbGate <span>/ federal</span>
184
184
  </a>
185
185
  <div class="nav-links">
package/public/guide.html CHANGED
@@ -5,14 +5,14 @@
5
5
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
6
  <title>How to Stop AI Coding Agents From Repeating Mistakes — ThumbGate Guide</title>
7
7
  <!-- Privacy-friendly analytics by Plausible -->
8
- <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
8
+ <script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
9
9
  <meta name="description" content="The complete guide to preventing AI coding agent mistakes with pre-action checks, history-aware lesson distillation, and automatic prevention rules.">
10
10
  <meta name="keywords" content="AI agent mistakes, Claude Code force push, AI coding agent memory, MCP server guardrails, pre-action checks, vibe coding safety, PreToolUse hooks, ThumbGate, SpecLock alternative, Mem0 alternative">
11
11
  <meta property="og:title" content="How to Stop AI Coding Agents From Repeating Mistakes">
12
12
  <meta property="og:description" content="Pre-action checks that physically block AI agents from repeating known mistakes. The complete guide.">
13
13
  <meta property="og:type" content="article">
14
- <meta property="og:url" content="https://thumbgate-production.up.railway.app/guide">
15
- <link rel="canonical" href="https://thumbgate-production.up.railway.app/guide">
14
+ <meta property="og:url" content="https://thumbgate.ai/guide">
15
+ <link rel="canonical" href="https://thumbgate.ai/guide">
16
16
 
17
17
  <script type="application/ld+json">
18
18
  {
@@ -28,11 +28,11 @@
28
28
  "publisher": {
29
29
  "@type": "Organization",
30
30
  "name": "ThumbGate",
31
- "url": "https://thumbgate-production.up.railway.app"
31
+ "url": "https://thumbgate.ai"
32
32
  },
33
33
  "datePublished": "2026-03-27",
34
34
  "dateModified": "2026-04-25",
35
- "mainEntityOfPage": "https://thumbgate-production.up.railway.app/guide",
35
+ "mainEntityOfPage": "https://thumbgate.ai/guide",
36
36
  "about": [
37
37
  {"@type": "Thing", "name": "AI coding agents"},
38
38
  {"@type": "Thing", "name": "Model Context Protocol"},
@@ -246,6 +246,29 @@ npx thumbgate init --agent codex
246
246
  npx thumbgate init --agent cursor
247
247
  npx thumbgate init --agent gemini</code></pre>
248
248
 
249
+ <h3>Install scope: machine-wide vs per-project</h3>
250
+ <p>ThumbGate supports two install scopes. Pick once when you install — you can switch later by re-running with the other flag.</p>
251
+ <table>
252
+ <thead>
253
+ <tr><th>Scope</th><th>Command</th><th>Where lessons + dashboard live</th><th>When to use</th></tr>
254
+ </thead>
255
+ <tbody>
256
+ <tr>
257
+ <td><strong>Machine-wide</strong> (default)</td>
258
+ <td><code>npx thumbgate init</code></td>
259
+ <td><code>~/.claude/memory/feedback/</code> — <strong>one shared dashboard across every repo on the machine</strong></td>
260
+ <td>Solo developer. A lesson learned in <code>repo-A</code> automatically blocks the same mistake in <code>repo-B</code>.</td>
261
+ </tr>
262
+ <tr>
263
+ <td><strong>Per-project</strong></td>
264
+ <td><code>npx thumbgate init --project</code> (run inside the repo)</td>
265
+ <td><code>&lt;repo&gt;/.claude/memory/feedback/</code> — <strong>separate dashboard per repo</strong></td>
266
+ <td>Client work, compliance, or multi-tenant. Lessons stay isolated; the audit trail belongs to the repo.</td>
267
+ </tr>
268
+ </tbody>
269
+ </table>
270
+ <p>Both scopes wire the same MCP server and PreToolUse / UserPromptSubmit / PostToolUse / SessionStart hooks — only the storage location differs. Machine-wide is the right default for most developers. Per-project lesson DBs live under each repo's <code>.claude/memory/feedback/</code> and <strong>must stay gitignored</strong>; ThumbGate's bundled <code>.gitignore</code> handles that.</p>
271
+
249
272
  <h2>How It Works</h2>
250
273
 
251
274
  <h3>1. You give feedback</h3>
@@ -307,7 +330,7 @@ npx thumbgate init --agent gemini</code></pre>
307
330
  <tr><td>Auto-generates rules</td><td>Yes — from repeated failures</td><td>No</td><td>No</td></tr>
308
331
  <tr><td>Agent support</td><td>Claude Code, Codex, Gemini, Amp, Cursor, OpenCode</td><td>Claude Code, Cursor, Windsurf, Cline</td><td>Claude, Cursor</td></tr>
309
332
  <tr><td>Install</td><td><code>npx thumbgate init</code></td><td><code>npx speclock setup</code></td><td>Cloud signup</td></tr>
310
- <tr><td>Cost</td><td>Free (Pro $19/mo or $149/yr, Team rollout $49/seat/mo)</td><td>Free</td><td>Free tier + paid</td></tr>
333
+ <tr><td>Cost</td><td>Free (Pro $19/mo or $149/yr, Enterprise custom pricing)</td><td>Free</td><td>Free tier + paid</td></tr>
311
334
  </table>
312
335
 
313
336
  <h2>Common Scenarios</h2>
@@ -343,21 +366,18 @@ npx thumbgate init --agent gemini</code></pre>
343
366
  <strong>Verification Evidence</strong>
344
367
  <span>Human-readable proof log for the engineering and workflow claims used across the site.</span>
345
368
  </a>
346
- <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/proof/automation/report.json" target="_blank" rel="noopener">
347
- <strong>Automation Proof</strong>
348
- <span>Machine-readable report for the feedback, enforcement, and automation surfaces behind ThumbGate.</span>
349
- </a>
350
369
  </div>
351
370
 
352
371
  <h2>Get Started</h2>
353
372
  <pre><code>npx thumbgate init</code></pre>
354
373
  <p>One command. Works with Claude Code, Cursor, Codex, Gemini, Amp, and OpenCode. Claude Code can also call Codex for review, adversarial review, and second-pass handoffs through the repo-local bridge plugin.</p>
355
374
  <a href="https://thumbgate.ai/checkout/pro?utm_source=guide&utm_medium=cta_button&utm_campaign=pro_pack" class="cta">Get Pro — $19/mo or $149/yr</a>
356
- <a rel="nofollow noopener noreferrer" target="_blank" href="https://buy.stripe.com/00w14neyUcXA5pL5e33sI0e" class="cta cta-secondary">Pay $499 diagnostic</a>
357
- <a rel="nofollow noopener noreferrer" target="_blank" href="https://buy.stripe.com/fZu9AT76saPsg4pbCr3sI0f" class="cta cta-secondary">Pay $1500 sprint</a>
375
+ <a href="__SPRINT_DIAGNOSTIC_CHECKOUT_URL__" class="cta cta-secondary">Pay $499 diagnostic</a>
376
+ <a href="__WORKFLOW_SPRINT_CHECKOUT_URL__" class="cta cta-secondary">Pay $1500 sprint</a>
358
377
  <a href="https://thumbgate.ai/#workflow-sprint-intake" class="cta cta-secondary">Send workflow first</a>
359
- <p style="color:var(--muted); font-size:0.85rem;">Free: unlimited captures, 5 active prevention rules, hook blocking. Pro: dashboard, recall, lesson search, unlimited rules, DPO export. Team: intake first, then $49/seat/mo with a 3-seat minimum.</p>
378
+ <p style="color:var(--muted); font-size:0.85rem;">Free: 2 captures/day, 10 total captures, 3 active prevention rules, hook blocking. Pro: hosted sync, dashboard, recall, lesson search, unlimited captures/rules, DPO export. Enterprise: intake first, then custom pricing scoped to your rollout.</p>
360
379
 
361
380
  </div>
381
+ <script src="/js/buyer-intent.js"></script>
362
382
  </body>
363
383
  </html>