thumbgate 1.27.18 → 1.27.20

package/.claude/commands/dashboard.md

@@ -0,0 +1,15 @@
+---
+name: dashboard
+description: Open the local HTTP dashboard for the current project in your web browser.
+---
+
+# Open Dashboard
+
+Open the local HTTP dashboard for the current project in your web browser.
+
+## Instructions
+Execute the following command in the project directory to open the browser dashboard scoped to the current repository:
+```bash
+thumbgate-dashboard
+```
+

package/.claude/commands/thumbgate-blocked.md

@@ -0,0 +1,27 @@
+---
+name: thumbgate-blocked
+description: Show what ThumbGate has actually blocked — gate enforcement stats and the full enforcement matrix. Use for "what has ThumbGate blocked", "show gate stats", "is enforcement working", "how many tokens did we save", "enforcement matrix".
+allowed-tools: mcp__thumbgate__gate_stats, mcp__thumbgate__enforcement_matrix, Bash(npx thumbgate gate-stats:*)
+---
+
+# ThumbGate Blocked
+
+Show the enforcement record: how many risky actions were blocked vs warned, which gates fire most, and the full feedback → check → rejection pipeline.
+
+This command wraps existing ThumbGate capability — **no new logic**. It reads the live enforcement counters.
+
+## Steps
+
+1. Call the `gate_stats` MCP tool for the headline numbers: blocked count, warned count, and the top gates by hits. (CLI fallback: `npx thumbgate gate-stats`.)
+2. Call the `enforcement_matrix` MCP tool for the full picture: feedback pipeline stats, active pre-action checks, and the rejection ledger with revival conditions.
+3. Summarize for the user:
+   - Total blocks (each block = a repeat mistake stopped before it spent tokens or did damage).
+   - Most-triggered gates.
+   - Anything in the rejection ledger that is close to revival.
+4. If counts are all zero, note that enforcement is wired but hasn't fired yet, and point to `/thumbgate-guard` to promote a rule.
+
+## Example
+
+```
+/thumbgate-blocked
+```

package/.claude/commands/thumbgate-dashboard.md

@@ -0,0 +1,15 @@
+---
+name: thumbgate-dashboard
+description: Open the local HTTP dashboard for the current project in your web browser.
+---
+
+# Open Scoped ThumbGate Dashboard
+
+Open the local HTTP dashboard for the current project in your web browser.
+
+## Instructions
+Execute the following command in the project directory to open the browser dashboard:
+```bash
+thumbgate-dashboard
+```
+

package/.claude/commands/thumbgate-doctor.md

@@ -0,0 +1,30 @@
+---
+name: thumbgate-doctor
+description: Health-check the ThumbGate wiring for this project — hooks, MCP server, and agent-readiness — and report what's broken. Use for "is ThumbGate wired up", "thumbgate doctor", "check my guardrails are installed", "why aren't my gates firing", "agent readiness".
+allowed-tools: Bash(npx thumbgate doctor:*), mcp__thumbgate__check_operational_integrity
+---
+
+# ThumbGate Doctor
+
+Audit whether ThumbGate is actually wired into this agent: PreToolUse / SessionStart hooks installed, MCP server reachable, lesson store present, and overall agent-readiness — then tell the user exactly what to fix.
+
+This command wraps existing ThumbGate capability — **no new logic**. It runs the existing doctor + integrity checks.
+
+## Steps
+
+1. Run the existing wiring/health audit:
+   ```bash
+   npx thumbgate doctor
+   ```
+   (Add `--json` for a machine-readable report.) It exits non-zero when the project is not `ready`.
+2. For deeper runtime state, call the `check_operational_integrity` MCP tool to verify the server-side enforcement path is live, not just the local config.
+3. Summarize:
+   - ✅ what's wired (hooks, MCP, store, statusline).
+   - ❌ what's missing, with the exact fix command (usually `npx thumbgate init`).
+4. If everything is green, say so plainly with the readiness status; if not, lead with the single highest-impact fix.
+
+## Example
+
+```
+/thumbgate-doctor
+```

package/.claude/commands/thumbgate-guard.md

@@ -0,0 +1,36 @@
+---
+name: thumbgate-guard
+description: Turn the last agent mistake into a hard prevention rule the agent cannot bypass. Use after a bad tool call, a wrong action, or a thumbs-down — "guard against this", "block this from happening again", "never do that again", "promote this to a rule".
+allowed-tools: mcp__thumbgate__capture_feedback, Bash(npx thumbgate force-gate:*), Bash(npx thumbgate quickstart:*)
+---
+
+# ThumbGate Guard
+
+Capture the mistake the agent just made and promote it into a Pre-Action Check (a `block` gate) so the same tool-call shape is intercepted before it runs again — in this and every future session, across Claude Code, Cursor, Codex, Gemini, Amp, and Cline.
+
+This command wraps existing ThumbGate capability. It adds **no new logic** — it routes to the real capture + force-promote path.
+
+## Steps
+
+1. Identify the specific bad action from the recent conversation (e.g. `git push --force origin main`, `DROP TABLE users`, deploy without tests). State it in one sentence.
+2. Record the signal with the `capture_feedback` MCP tool:
+   - `signal: "down"`
+   - `context`: one sentence describing what went wrong
+   - `whatWentWrong`: the concrete failure
+   - `whatToChange`: the prevention action
+   - `tags`: the domain (e.g. `git`, `database`, `deploy`)
+   - If the user only gave a vague signal, pass the recent turns through `conversationWindow` / `chatHistory` for history-aware distillation instead of refusing.
+3. Promote it to an enforced block gate using the existing force-promote path:
+   ```bash
+   npx thumbgate force-gate "<one-sentence context of the mistake>"
+   ```
+   This prints the new `gateId` and the total active gate count.
+4. Show the user the promoted rule and confirm it is now enforced as a PreToolUse block.
+
+> First rule of the project and want the guided walkthrough (capture → promote → watch it block once)? Run `npx thumbgate quickstart` instead.
+
+## Example
+
+```
+/thumbgate-guard the agent force-pushed to main and overwrote a teammate's commit
+```

package/.claude/commands/thumbgate-protect.md

@@ -0,0 +1,30 @@
+---
+name: thumbgate-protect
+description: Show this repo's branch/release governance and grant a scoped, time-limited approval for an action that touches protected files. Use for "protect this branch", "is main protected", "approve this protected change", "branch governance", "let me edit a protected file".
+allowed-tools: mcp__thumbgate__get_branch_governance, mcp__thumbgate__approve_protected_action
+---
+
+# ThumbGate Protect
+
+Inspect the protected-action posture for this project and, when the user explicitly approves, grant a scoped, expiring exception so a protected-file edit or publish can proceed under audit.
+
+This command wraps existing ThumbGate capability — **no new logic**. It reads governance state and records a time-boxed approval.
+
+## Steps
+
+1. Read the current posture with the `get_branch_governance` MCP tool: which branches are protected, release rules, and the protected-file globs in effect.
+2. Report it plainly: what is protected, and what the agent is currently blocked from touching without approval.
+3. **Only if the user explicitly asks to proceed**, grant a scoped approval with `approve_protected_action`:
+   - `pathGlobs`: the smallest set of protected globs the action needs.
+   - `reason`: why this is approved (one sentence).
+   - `evidence`: supporting note (tests passing, owner sign-off, etc.) when available.
+   - `ttlMs`: keep it short — default is 1 hour, never exceed what the task needs.
+4. Confirm the approval id, covered globs, and expiry. Approvals are deliberately temporary and audited; re-run for the next task.
+
+> This is for granting *narrow, temporary* exceptions, not for disabling protection. Never use it to bypass branch governance wholesale.
+
+## Example
+
+```
+/thumbgate-protect
+```

package/.claude/commands/thumbgate-rules.md

@@ -0,0 +1,30 @@
+---
+name: thumbgate-rules
+description: List the active prevention rules and learned lessons guarding this project. Use to answer "what is ThumbGate protecting me from", "show my gates/rules", "what has the agent learned", "what's blocked here".
+allowed-tools: mcp__thumbgate__prevention_rules, mcp__thumbgate__get_reliability_rules, mcp__thumbgate__search_lessons, Bash(npx thumbgate rules:*)
+---
+
+# ThumbGate Rules
+
+Show the guardrails currently in force for this project: the auto-promoted prevention rules, the reliability rules, and the promoted lessons behind them.
+
+This command wraps existing ThumbGate capability — **no new logic**. It reads the live rule + lesson stores.
+
+## Steps
+
+1. List the active prevention rules with the `prevention_rules` MCP tool (or the CLI fallback `npx thumbgate rules`).
+2. Pull the reliability rules with `get_reliability_rules` to show which tool-call shapes are gated.
+3. For each rule, surface the lesson it came from with `search_lessons` so the user sees *why* the rule exists, not just *what* it blocks.
+4. Present a compact table:
+
+   | Rule / Gate | Blocks | From lesson | State |
+   |-------------|--------|-------------|-------|
+   | … | … | … | active / archived |
+
+5. If there are zero active rules, point the user to `/thumbgate-guard` to promote their first one.
+
+## Example
+
+```
+/thumbgate-rules
+```

package/.claude-plugin/plugin.json

@@ -1,13 +1,13 @@
 {
   "name": "thumbgate",
-  "description": "One \ud83d\udc4e becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.20.0",
+  "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
+  "version": "1.27.20",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",
     "url": "https://thumbgate.ai"
   },
-  "homepage": "https://thumbgate-production.up.railway.app",
+  "homepage": "https://thumbgate.ai",
   "repository": "https://github.com/IgorGanapolsky/ThumbGate",
   "license": "MIT",
   "category": "developer-tools",
@@ -28,6 +28,7 @@
     "memory"
   ],
   "skills": "./skills/",
+  "commands": "./.claude/commands/",
   "mcpServers": {
     "thumbgate": {
       "command": "npx",

package/.well-known/agentic-verify.txt

@@ -0,0 +1 @@
+3588d0ad8f7b89fd7b9fbf771c1dd7dd09310e88aa6a7ae049b1decfa971650b

package/.well-known/llms.txt

@@ -1,5 +1,5 @@
 # ThumbGate — Stop AI agents before they make costly mistakes.
-# https://thumbgate-production.up.railway.app
+# https://thumbgate.ai
 # https://github.com/IgorGanapolsky/ThumbGate
 # https://www.npmjs.com/package/thumbgate
 
@@ -15,6 +15,7 @@
 - CLAUDE.md and .cursorrules files are suggestions agents can ignore
 - No memory between sessions means no learning from corrections
 - Teams have no shared safety rules across developers
+- AI crawlers and agents create machine traffic without proving buyer intent; teams need AI-discoverable proof plus runtime gates before internal agents act
 
 ## How it works
 
@@ -24,6 +25,15 @@
 4. PreToolUse hooks block the pattern before it executes again
 5. Thompson Sampling adapts gate confidence over time
 
+## Agentic development cycle fit
+
+ThumbGate maps to Guide, Generate, Verify, Solve by adding a pre-action execution gate:
+
+- Guide: feedback and policies become concrete rules
+- Generate: agents still produce plans, edits, and tool calls
+- Verify: risky actions require evidence before execution
+- Solve: blocked failures become reusable lessons and prevention gates
+
 ## Who it's for
 
 - Developers using Claude Code, Cursor, Codex, Gemini CLI, or any MCP-compatible agent
@@ -39,23 +49,34 @@ npx thumbgate init --agent claude-code
 
 ## Pricing
 
+- ChatGPT App / GPT Action: https://thumbgate.ai/chatgpt-app
 - Free GPT: advice, checkpointing, and setup help in ChatGPT
-- Free local CLI: unlimited feedback captures, up to 5 active prevention rules, and local Pre-Action Checks after install (recall and lesson search are Pro-only)
-- Pro: $19/mo or $149/yr — personal enforcement proof, local dashboard, check debugger, DPO export, and review-ready exports
-- Team: $49/seat/mo, 3-seat minimum after intake — shared lessons, org visibility, approval boundaries, and rollout proof
+- Codex Plugin: https://thumbgate.ai/codex-plugin
+- Free local CLI: 2 captures/day, 10 total captures, up to 3 active auto-promoted prevention rules, and local Pre-Action Checks after install (recall and lesson search are Pro-only)
+- Pro: $19/mo or $149/yr — personal enforcement proof, local dashboard, check debugger, DPO export, synced lessons/rules across machines, and review-ready exports
+- Enterprise: custom pricing, scoped after intake — shared hosted lesson database, org-wide dashboard, GCP/DFCX guardrails, VPC gating, and white-glove workflow hardening sprints
 
 ## Links
 
-- Agent discovery: https://thumbgate-production.up.railway.app/.well-known/mcp.json
-- Progressive tool index: https://thumbgate-production.up.railway.app/.well-known/mcp/tools.json
-- Context footprint report: https://thumbgate-production.up.railway.app/.well-known/mcp/footprint.json
-- Agent skills: https://thumbgate-production.up.railway.app/.well-known/mcp/skills.json
-- MCP applications: https://thumbgate-production.up.railway.app/.well-known/mcp/applications.json
-- Documentation: https://thumbgate-production.up.railway.app/guide
-- Dashboard: https://thumbgate-production.up.railway.app/dashboard
+- Home: https://thumbgate.ai/
+- Pricing: https://thumbgate.ai/pricing
+- Pro checkout: https://thumbgate.ai/checkout/pro
+- Agent discovery: https://thumbgate.ai/.well-known/mcp.json
+- Progressive tool index: https://thumbgate.ai/.well-known/mcp/tools.json
+- Context footprint report: https://thumbgate.ai/.well-known/mcp/footprint.json
+- Headroom context compression guardrails: https://thumbgate.ai/guides/headroom-context-compression-guardrails
+- Sovereign coding model guardrails: https://thumbgate.ai/guides/sovereign-coding-model-guardrails
+- Agentic web governance: https://thumbgate.ai/guides/agentic-web-governance
+- AI Mode ads and agent governance: https://thumbgate.ai/guides/ai-mode-ads-agent-governance
+- MCP tool governance: https://thumbgate.ai/guides/mcp-tool-governance
+- AI agent pre-action approval gates: https://thumbgate.ai/guides/ai-agent-pre-action-approval-gates
+- Agent skills: https://thumbgate.ai/.well-known/mcp/skills.json
+- MCP applications: https://thumbgate.ai/.well-known/mcp/applications.json
+- Documentation: https://thumbgate.ai/guide
+- Dashboard: https://thumbgate.ai/dashboard
 - GitHub: https://github.com/IgorGanapolsky/ThumbGate
 - npm: https://www.npmjs.com/package/thumbgate
-- Full LLM context: https://thumbgate-production.up.railway.app/public/llm-context.md
+- Full LLM context: https://thumbgate.ai/llm-context.md
 
 ## Compared to alternatives
 

package/.well-known/mcp/server-card.json

@@ -1,15 +1,15 @@
 {
   "name": "thumbgate",
-  "version": "1.20.0",
+  "version": "1.27.20",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
-  "homepage": "https://thumbgate-production.up.railway.app",
+  "homepage": "https://thumbgate.ai",
   "transport": "stdio",
   "discovery": {
-    "manifestUrl": "https://thumbgate-production.up.railway.app/.well-known/mcp.json",
-    "toolIndexUrl": "https://thumbgate-production.up.railway.app/.well-known/mcp/tools.json",
-    "toolSchemaUrlTemplate": "https://thumbgate-production.up.railway.app/.well-known/mcp/tools/{name}.json",
-    "footprintUrl": "https://thumbgate-production.up.railway.app/.well-known/mcp/footprint.json",
-    "skillsUrl": "https://thumbgate-production.up.railway.app/.well-known/mcp/skills.json",
-    "applicationsUrl": "https://thumbgate-production.up.railway.app/.well-known/mcp/applications.json"
+    "manifestUrl": "https://thumbgate.ai/.well-known/mcp.json",
+    "toolIndexUrl": "https://thumbgate.ai/.well-known/mcp/tools.json",
+    "toolSchemaUrlTemplate": "https://thumbgate.ai/.well-known/mcp/tools/{name}.json",
+    "footprintUrl": "https://thumbgate.ai/.well-known/mcp/footprint.json",
+    "skillsUrl": "https://thumbgate.ai/.well-known/mcp/skills.json",
+    "applicationsUrl": "https://thumbgate.ai/.well-known/mcp/applications.json"
   }
 }