npm - thumbgate - Versions diffs - 1.27.19 → 1.28.0 - Mend

thumbgate 1.27.19 → 1.28.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (116) hide show

package/.claude/commands/dashboard.md +15 -0
package/.claude/commands/thumbgate-blocked.md +27 -0
package/.claude/commands/thumbgate-dashboard.md +15 -0
package/.claude/commands/thumbgate-doctor.md +30 -0
package/.claude/commands/thumbgate-guard.md +36 -0
package/.claude/commands/thumbgate-protect.md +30 -0
package/.claude/commands/thumbgate-rules.md +30 -0
package/.claude-plugin/plugin.json +1 -1
package/.well-known/mcp/server-card.json +1 -1
package/README.md +63 -45
package/adapters/claude/.mcp.json +2 -2
package/adapters/gcp/dfcx-webhook-gate.js +295 -0
package/adapters/letta/README.md +41 -0
package/adapters/letta/thumbgate-letta-adapter.js +133 -0
package/adapters/mcp/server-stdio.js +1 -1
package/adapters/opencode/opencode.json +1 -1
package/adapters/policy-engine/ethicore-guardian-client.js +68 -0
package/adapters/policy-engine/thumbgate-policy-engine-adapter.js +260 -0
package/bench/observability-eval-suite.json +26 -0
package/bin/cli.js +52 -9
package/bin/dashboard-cli.js +7 -0
package/bin/postinstall.js +14 -23
package/commands/dashboard.md +15 -0
package/commands/thumbgate-dashboard.md +15 -0
package/config/entitlement-public-keys.json +6 -0
package/config/gates/default.json +1 -1
package/config/github-about.json +2 -2
package/config/merge-quality-checks.json +3 -0
package/package.json +233 -100
package/public/about.html +159 -0
package/public/agent-manager.html +179 -0
package/public/agents-cost-savings.html +153 -0
package/public/ai-malpractice-prevention.html +818 -0
package/public/assets/brand/github-social-preview.png +0 -0
package/public/assets/brand/thumbgate-icon-512.png +0 -0
package/public/assets/brand/thumbgate-icon-pro-512.png +0 -0
package/public/assets/brand/thumbgate-icon-team-512.png +0 -0
package/public/assets/brand/thumbgate-logo-1200x360.png +0 -0
package/public/assets/brand/thumbgate-logo-transparent.svg +28 -0
package/public/assets/brand/thumbgate-mark-inline-v3.svg +18 -0
package/public/assets/brand/thumbgate-mark-pro.svg +23 -0
package/public/assets/brand/thumbgate-mark-team.svg +26 -0
package/public/assets/brand/thumbgate-mark.svg +21 -0
package/public/assets/brand/thumbgate-wordmark.svg +20 -0
package/public/assets/claude-thumbgate-statusbar.svg +8 -0
package/public/assets/codex-thumbgate-statusbar-test.svg +9 -0
package/public/assets/legal-intake-control-flow.svg +66 -0
package/public/blog.html +12 -9
package/public/brand/thumbgate-mark.svg +19 -0
package/public/brand/thumbgate-og.svg +16 -0
package/public/chatgpt-app.html +330 -0
package/public/codex-enterprise.html +123 -0
package/public/codex-plugin.html +5 -5
package/public/compare.html +10 -10
package/public/dashboard.html +1 -1
package/public/diagnostic.html +345 -0
package/public/federal.html +2 -2
package/public/guide.html +14 -14
package/public/index.html +81 -70
package/public/install.html +193 -0
package/public/js/buyer-intent.js +672 -0
package/public/learn.html +4 -17
package/public/numbers.html +2 -2
package/public/pricing.html +392 -0
package/public/pro.html +2 -2
package/scripts/action-receipts.js +324 -0
package/scripts/activation-quickstart.js +187 -0
package/scripts/agent-operations-planner.js +621 -0
package/scripts/agent-reward-model.js +13 -0
package/scripts/ai-component-inventory.js +367 -0
package/scripts/async-eval-observability.js +236 -0
package/scripts/audit.js +65 -0
package/scripts/aws-blocks-guardrails.js +272 -0
package/scripts/bayes-optimal-gate.js +6 -1
package/scripts/classifier-routing.js +130 -0
package/scripts/cli-feedback.js +17 -1
package/scripts/commercial-offer.js +3 -3
package/scripts/dashboard-chat.js +332 -0
package/scripts/entitlement.js +250 -0
package/scripts/export-databricks-bundle.js +5 -0
package/scripts/export-dpo-pairs.js +6 -0
package/scripts/export-hf-dataset.js +5 -0
package/scripts/feedback-aggregate.js +281 -0
package/scripts/feedback-sanitizer.js +105 -0
package/scripts/gates-engine.js +15 -3
package/scripts/hook-stop-anti-claim.js +301 -0
package/scripts/imperative-detector.js +85 -0
package/scripts/install-shim.js +87 -0
package/scripts/intervention-policy.js +13 -0
package/scripts/mcp-oauth.js +293 -0
package/scripts/noop-detect.js +285 -0
package/scripts/parallel-workflow-orchestrator.js +293 -0
package/scripts/plan-gate.js +243 -0
package/scripts/plausible-domain-config.js +99 -0
package/scripts/pr-manager.js +9 -22
package/scripts/pro-local-dashboard.js +198 -0
package/scripts/qa-scenario-planner.js +136 -0
package/scripts/repeat-metric.js +137 -0
package/scripts/risk-scorer.js +6 -0
package/scripts/secret-fixture-tokens.js +61 -0
package/scripts/secret-redaction.js +166 -0
package/scripts/self-harness-optimizer.js +141 -0
package/scripts/self-healing-check.js +193 -0
package/scripts/self-protection.js +90 -0
package/scripts/seo-gsd.js +2 -2
package/scripts/silent-failure-cluster.js +531 -0
package/scripts/statusline-cache-read.js +57 -0
package/scripts/sync-telemetry-from-prod.js +374 -0
package/scripts/thompson-sampling.js +11 -2
package/scripts/tool-contract-validator.js +76 -0
package/scripts/trajectory-scorer.js +63 -0
package/scripts/verify-marketing-pages-deployed.js +212 -0
package/scripts/visitor-journey.js +172 -0
package/src/api/server.js +81 -10
package/.claude-plugin/marketplace.json +0 -85
package/adapters/chatgpt/openapi.yaml +0 -1707

package/public/chatgpt-app.html ADDED Viewed

@@ -0,0 +1,330 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>ThumbGate for ChatGPT - GPT Action + Agent Guardrails</title>
+  <meta name="description" content="Open the ThumbGate GPT, import the GPT Action schema, and connect ChatGPT lessons to local Codex, Claude Code, Cursor, and MCP agent enforcement.">
+  <link rel="canonical" href="https://thumbgate.ai/chatgpt-app">
+  <link rel="alternate" type="text/markdown" title="ThumbGate LLM context" href="https://thumbgate.ai/llm-context.md">
+  <meta property="og:title" content="ThumbGate for ChatGPT">
+  <meta property="og:description" content="A first-class ChatGPT entrypoint for preflighting risky agent actions and feeding typed lessons into ThumbGate enforcement.">
+  <meta property="og:type" content="website">
+  <meta property="og:url" content="https://thumbgate.ai/chatgpt-app">
+  <meta property="og:image" content="https://thumbgate.ai/assets/brand/thumbgate-logo-1200x360.png">
+  <meta name="twitter:card" content="summary_large_image">
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@type": "SoftwareApplication",
+    "name": "ThumbGate for ChatGPT",
+    "applicationCategory": "DeveloperApplication",
+    "operatingSystem": "Web, macOS, Linux, Windows",
+    "url": "https://thumbgate.ai/chatgpt-app",
+    "description": "ChatGPT GPT Action entrypoint for checking risky agent actions and carrying typed thumbs-up/down lessons into ThumbGate local enforcement.",
+    "offers": [
+      { "@type": "Offer", "price": "0", "priceCurrency": "USD", "name": "Free GPT entrypoint" },
+      { "@type": "Offer", "price": "19", "priceCurrency": "USD", "name": "ThumbGate Pro", "url": "https://thumbgate.ai/checkout/pro" }
+    ]
+  }
+  </script>
+  <style>
+    :root {
+      color-scheme: dark;
+      --bg: #050607;
+      --panel: #111418;
+      --panel-2: #171b20;
+      --line: #2a3038;
+      --cyan: #20d8ef;
+      --green: #55e38b;
+      --text: #f3f6f8;
+      --muted: #aab3bd;
+      --warning: #ffd166;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      background: var(--bg);
+      color: var(--text);
+      font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      letter-spacing: 0;
+    }
+    a { color: inherit; }
+    .shell { max-width: 1120px; margin: 0 auto; padding: 28px 20px 72px; }
+    .nav { display: flex; align-items: center; justify-content: space-between; gap: 18px; padding: 6px 0 28px; }
+    .brand { display: inline-flex; align-items: center; gap: 12px; font-weight: 800; text-decoration: none; }
+    .brand img { width: 28px; height: 28px; }
+    .navlinks { display: flex; gap: 18px; flex-wrap: wrap; color: var(--muted); font-size: 14px; }
+    .navlinks a { text-decoration: none; }
+    .hero {
+      display: grid;
+      grid-template-columns: minmax(0, 1.04fr) minmax(320px, 0.96fr);
+      gap: 28px;
+      align-items: stretch;
+      padding: 34px 0 26px;
+    }
+    .eyebrow { color: var(--cyan); font-size: 13px; font-weight: 800; text-transform: uppercase; margin-bottom: 14px; }
+    h1 { font-size: clamp(42px, 6vw, 72px); line-height: 0.98; margin: 0 0 18px; letter-spacing: 0; max-width: 740px; }
+    .lead { color: var(--muted); font-size: 19px; line-height: 1.58; max-width: 720px; margin: 0 0 24px; }
+    .actions { display: flex; flex-wrap: wrap; gap: 12px; margin: 24px 0; }
+    .btn {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      min-height: 46px;
+      padding: 0 18px;
+      border-radius: 8px;
+      border: 1px solid var(--line);
+      background: var(--panel);
+      color: var(--text);
+      text-decoration: none;
+      font-weight: 800;
+      font-size: 14px;
+      white-space: nowrap;
+    }
+    .btn.primary { background: var(--cyan); color: #001316; border-color: var(--cyan); }
+    .btn.secondary { border-color: rgba(32, 216, 239, 0.55); color: var(--cyan); }
+    .proof {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 10px;
+      margin-top: 22px;
+      color: var(--muted);
+      font-size: 13px;
+    }
+    .pill { border: 1px solid var(--line); border-radius: 999px; padding: 7px 10px; background: rgba(255,255,255,0.03); }
+    .panel {
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      background: var(--panel);
+      overflow: hidden;
+      min-width: 0;
+    }
+    .panel-head {
+      display: flex;
+      justify-content: space-between;
+      gap: 12px;
+      border-bottom: 1px solid var(--line);
+      padding: 13px 14px;
+      color: var(--muted);
+      font-size: 13px;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+    }
+    .screen { padding: 16px; display: grid; gap: 12px; }
+    .message {
+      background: var(--panel-2);
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      padding: 14px;
+      font-size: 14px;
+      line-height: 1.55;
+    }
+    .message strong { color: var(--green); }
+    .code {
+      display: block;
+      background: #07090b;
+      border: 1px solid #222932;
+      border-radius: 8px;
+      padding: 13px;
+      overflow-x: auto;
+      color: #d8f7ff;
+      font-family: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace;
+      font-size: 13px;
+      line-height: 1.55;
+    }
+    section { padding: 34px 0; }
+    .section-title { font-size: 28px; margin: 0 0 12px; letter-spacing: 0; }
+    .section-copy { margin: 0 0 20px; color: var(--muted); line-height: 1.65; max-width: 840px; }
+    .grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 16px; }
+    .card {
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      background: var(--panel);
+      padding: 18px;
+      min-width: 0;
+    }
+    .card h3 { margin: 0 0 10px; font-size: 18px; letter-spacing: 0; }
+    .card p, .card li { color: var(--muted); line-height: 1.6; font-size: 14px; }
+    .card ul { padding-left: 18px; margin: 0; }
+    .steps { counter-reset: step; display: grid; gap: 12px; }
+    .step {
+      display: grid;
+      grid-template-columns: 46px minmax(0, 1fr);
+      gap: 14px;
+      align-items: start;
+      border: 1px solid var(--line);
+      border-radius: 8px;
+      background: var(--panel);
+      padding: 16px;
+    }
+    .step::before {
+      counter-increment: step;
+      content: counter(step);
+      display: grid;
+      place-items: center;
+      width: 34px;
+      height: 34px;
+      border-radius: 8px;
+      background: rgba(32, 216, 239, 0.12);
+      color: var(--cyan);
+      border: 1px solid rgba(32, 216, 239, 0.4);
+      font-weight: 900;
+    }
+    .step h3 { margin: 2px 0 7px; font-size: 17px; }
+    .step p { color: var(--muted); margin: 0; line-height: 1.6; }
+    .notice {
+      border: 1px solid rgba(255, 209, 102, 0.45);
+      background: rgba(255, 209, 102, 0.08);
+      color: #fff0bf;
+      border-radius: 8px;
+      padding: 15px 16px;
+      line-height: 1.6;
+      margin-top: 18px;
+    }
+    footer { color: var(--muted); border-top: 1px solid var(--line); padding-top: 24px; margin-top: 24px; font-size: 14px; }
+    @media (max-width: 860px) {
+      .hero { grid-template-columns: 1fr; }
+      .grid { grid-template-columns: 1fr; }
+      .nav { align-items: flex-start; flex-direction: column; }
+      h1 { font-size: 44px; }
+      .btn { width: 100%; }
+    }
+  </style>
+</head>
+<body>
+  <main class="shell">
+    <nav class="nav" aria-label="Primary">
+      <a class="brand" href="/">
+        <img src="/assets/brand/thumbgate-mark-inline-v3.svg" alt="ThumbGate logo">
+        <span>ThumbGate</span>
+      </a>
+      <div class="navlinks">
+        <a href="/codex-plugin">Codex plugin</a>
+        <a href="/guide">Install</a>
+        <a href="/pricing">Pricing</a>
+        <a href="https://github.com/IgorGanapolsky/ThumbGate" rel="noopener">GitHub</a>
+      </div>
+    </nav>
+    <section class="hero" aria-labelledby="chatgpt-title">
+      <div>
+        <div class="eyebrow">ChatGPT surface for ThumbGate</div>
+        <h1 id="chatgpt-title">ThumbGate for ChatGPT</h1>
+        <p class="lead">Use the live ThumbGate GPT to preflight risky agent actions, capture typed thumbs-up/down lessons, and route those lessons into local enforcement for Codex, Claude Code, Cursor, Gemini CLI, and MCP-compatible agents.</p>
+        <div class="actions">
+          <a class="btn primary" href="/go/gpt?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=chatgpt_app_install&cta_id=chatgpt_app_open_gpt&cta_placement=hero" target="_blank" rel="noopener">Open ThumbGate GPT</a>
+          <a class="btn secondary" href="/openapi.yaml?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=chatgpt_action_schema&cta_id=chatgpt_app_openapi&cta_placement=hero">Download GPT Action schema</a>
+          <a class="btn" href="/guide?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=local_enforcement&cta_id=chatgpt_app_local_install&cta_placement=hero">Install local enforcement</a>
+        </div>
+        <div class="proof" aria-label="Current proof">
+          <span class="pill">Live GPT link: /go/gpt</span>
+          <span class="pill">Action schema: /openapi.yaml</span>
+          <span class="pill">Local gate: npx thumbgate init</span>
+        </div>
+      </div>
+      <div class="panel" aria-label="ThumbGate ChatGPT workflow preview">
+        <div class="panel-head">
+          <span>ChatGPT + ThumbGate</span>
+          <span>typed feedback -> rules</span>
+        </div>
+        <div class="screen">
+          <div class="message">Before I run this migration, check whether this repeats a rejected deploy pattern.</div>
+          <div class="message"><strong>ThumbGate:</strong> Require evidence first: test output, rollback path, and the exact affected tables. Then install the local gate so future risky actions are flagged and logged before execution (and hard-blocked for catastrophic classes or under strict mode).</div>
+          <code class="code">thumbs down: agent claimed the release was published before checking npm and CI</code>
+          <code class="code">npx thumbgate init --agent codex</code>
+        </div>
+      </div>
+    </section>
+    <section aria-labelledby="what-ships">
+      <h2 class="section-title" id="what-ships">What ships today</h2>
+      <p class="section-copy">This is the ChatGPT-facing distribution page. It keeps the claim precise: ChatGPT is the discovery, advice, checkpointing, and typed-feedback surface. The enforcement — flag and log by default, hard-block for catastrophic classes or under strict mode — still runs in the local agent or CI lane.</p>
+      <div class="grid">
+        <article class="card">
+          <h3>Live GPT entrypoint</h3>
+          <p>The public GPT lets users paste proposed actions, risky commands, PR steps, deploys, refunds, and agent plans before running them.</p>
+        </article>
+        <article class="card">
+          <h3>GPT Action schema</h3>
+          <p>The OpenAPI schema is publicly served for GPT Actions import and kept in the package so installs do not depend on hidden docs.</p>
+        </article>
+        <article class="card">
+          <h3>Local enforcement path</h3>
+          <p>ThumbGate still flags repeated mistakes where work happens — and hard-blocks the catastrophic ones (or any rule under strict mode): Codex, Claude Code, Cursor, Gemini CLI, Amp, OpenCode, MCP, and CI.</p>
+        </article>
+      </div>
+    </section>
+    <section aria-labelledby="install-flow">
+      <h2 class="section-title" id="install-flow">Install flow</h2>
+      <div class="steps">
+        <div class="step">
+          <div>
+            <h3>Open the ThumbGate GPT</h3>
+            <p>Use the GPT for setup help, action review, and typed feedback. If the direct link does not open, search Explore GPTs for ThumbGate by Igor Ganapolsky.</p>
+          </div>
+        </div>
+        <div class="step">
+          <div>
+            <h3>Import the GPT Action schema when configuring a custom GPT</h3>
+            <p>Use <code>https://thumbgate.ai/openapi.yaml</code> as the Actions schema. API key auth uses a bearer token from the ThumbGate environment.</p>
+          </div>
+        </div>
+        <div class="step">
+          <div>
+            <h3>Install the local gate</h3>
+            <p>Run <code>npx thumbgate init</code> or the agent-specific command so lessons can become pre-action checks in the coding session.</p>
+          </div>
+        </div>
+      </div>
+      <div class="notice"><strong>Honest capture note:</strong> ChatGPT's native thumbs rating buttons are not the ThumbGate memory path. Type <code>thumbs up:</code> or <code>thumbs down:</code> with one concrete sentence so ThumbGate can store a structured lesson.</div>
+    </section>
+    <section aria-labelledby="enterprise">
+      <h2 class="section-title" id="enterprise">Enterprise packaging</h2>
+      <p class="section-copy">Teams can use ChatGPT as the human-facing review surface while ThumbGate enforces policy in the local or server-side execution lane. That gives buyers a simple story: one GPT for triage, one Codex plugin for coding, one shared lesson/rule store for repeat prevention.</p>
+      <div class="grid">
+        <article class="card">
+          <h3>Buyer-ready links</h3>
+          <ul>
+            <li><a href="/chatgpt-app">ChatGPT app page</a></li>
+            <li><a href="/codex-plugin">Codex plugin page</a></li>
+            <li><a href="/pricing">Team pricing</a></li>
+          </ul>
+        </article>
+        <article class="card">
+          <h3>Implementation docs</h3>
+          <ul>
+            <li><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/adapters/chatgpt/INSTALL.md" rel="noopener">ChatGPT Actions setup</a></li>
+            <li><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/chatgpt-gpt-instructions.md" rel="noopener">GPT instructions</a></li>
+            <li><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/plugins/codex-profile/INSTALL.md" rel="noopener">Codex plugin install</a></li>
+          </ul>
+        </article>
+        <article class="card">
+          <h3>Proof lane</h3>
+          <ul>
+            <li><a href="/dashboard">Local dashboard</a></li>
+            <li><a href="/llm-context.md">LLM context</a></li>
+            <li><a href="https://github.com/IgorGanapolsky/ThumbGate/releases/latest" rel="noopener">Latest release assets</a></li>
+          </ul>
+        </article>
+      </div>
+    </section>
+    <section aria-labelledby="next-step">
+      <h2 class="section-title" id="next-step">Use both OpenAI surfaces</h2>
+      <p class="section-copy">Codex gets the execution-side plugin. ChatGPT gets the review and lesson-capture entrypoint. Together they make ThumbGate visible before the mistake and enforceable when the agent reaches for tools.</p>
+      <div class="actions">
+        <a class="btn primary" href="/go/gpt?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=chatgpt_app_install&cta_id=chatgpt_app_footer_gpt&cta_placement=footer" target="_blank" rel="noopener">Open ThumbGate GPT</a>
+        <a class="btn secondary" href="/codex-plugin?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=codex_plugin_cross_sell&cta_id=chatgpt_app_footer_codex&cta_placement=footer">Install Codex plugin</a>
+        <a class="btn" href="/checkout/pro?utm_source=chatgpt_app&utm_medium=landing&utm_campaign=chatgpt_app_pro&cta_id=chatgpt_app_footer_checkout&cta_placement=footer">Upgrade to Pro</a>
+      </div>
+    </section>
+    <footer>
+      ThumbGate for ChatGPT is an owned ThumbGate distribution surface. It does not claim official OpenAI marketplace approval; it links the live GPT, public GPT Action schema, and local enforcement install path.
+    </footer>
+  </main>
+</body>
+</html>

package/public/codex-enterprise.html ADDED Viewed

@@ -0,0 +1,123 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>ThumbGate for Codex in the Enterprise — Governance for OpenAI Codex (Dell-Distributed or Self-Hosted)</title>
+<script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
+<meta name="description" content="OpenAI and Dell are distributing Codex into the enterprise. Codex in production needs a governance layer — capture every agent decision, promote repeat failures to PreToolUse gates, ship the audit trail procurement requires.">
+<meta property="og:title" content="ThumbGate for Codex in the Enterprise">
+<meta property="og:description" content="Dell-distributed or self-hosted, Codex agents repeat the same mistakes. ThumbGate is the governance layer underneath — capture, promote, audit.">
+<meta property="og:type" content="article">
+<meta property="og:image" content="https://thumbgate.ai/og.png">
+<link rel="canonical" href="https://thumbgate.ai/codex-enterprise">
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "TechArticle",
+  "headline": "ThumbGate for Codex in the Enterprise",
+  "description": "Dell-distributed or self-hosted, Codex agents in production need a governance layer. ThumbGate captures every agent decision, promotes repeat failures to PreToolUse gates, and ships the audit trail enterprise procurement requires.",
+  "datePublished": "2026-05-20",
+  "dateModified": "2026-05-20",
+  "author": { "@type": "Person", "name": "Igor Ganapolsky", "url": "https://github.com/IgorGanapolsky" },
+  "publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate.ai" },
+  "about": [
+    { "@type": "Thing", "name": "OpenAI Codex" },
+    { "@type": "Thing", "name": "Dell Codex Enterprise" },
+    { "@type": "Thing", "name": "Agent Governance" },
+    { "@type": "Thing", "name": "PreToolUse Gates" }
+  ]
+}
+</script>
+<style>
+  *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
+  :root { --bg:#0a0a0b; --card:#161618; --border:#222225; --text:#e8e8ec; --muted:#8b8b94; --cyan:#22d3ee; }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.7; }
+  .container { max-width: 860px; margin: 0 auto; padding: 2rem 1.5rem 4rem; }
+  nav { padding: 1rem 2rem; border-bottom: 1px solid var(--border); display:flex; gap:1.5rem; flex-wrap:wrap; }
+  nav a { color: var(--muted); text-decoration:none; font-size:0.9rem; }
+  nav .brand { color: var(--text); font-weight:700; }
+  .pill { display:inline-block; font-size:0.75rem; letter-spacing:0.08em; text-transform:uppercase; color:var(--cyan); background:rgba(34,211,238,0.08); border:1px solid rgba(34,211,238,0.2); padding:4px 12px; border-radius:100px; margin-top:1.5rem; font-weight:600; }
+  h1 { font-size:2.2rem; line-height:1.15; margin:1rem 0 1rem; }
+  h2 { font-size:1.45rem; margin:2.2rem 0 1rem; color:var(--cyan); }
+  h3 { margin:0.6rem 0; font-size:1rem; }
+  p, li { margin-bottom:0.75rem; }
+  ul, ol { padding-left:1.25rem; }
+  .card { background: var(--card); border:1px solid var(--border); border-radius:12px; padding:1.25rem; margin:1rem 0; }
+  .grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(220px,1fr)); gap:1rem; margin:1rem 0; }
+  .grid .card h3 { color:var(--cyan); }
+  .cta { display:inline-block; background:var(--cyan); color:#000; padding:0.8rem 1.2rem; border-radius:8px; text-decoration:none; font-weight:700; }
+  .secondary { color:var(--cyan); text-decoration:underline; margin-left:1rem; }
+  .quote { border-left:3px solid var(--cyan); padding:0.75rem 1rem; margin:1rem 0; color:var(--muted); font-style:italic; }
+  code, pre { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; background:#0f0f11; border:1px solid var(--border); border-radius:6px; padding:0.15rem 0.4rem; font-size:0.9rem; }
+  pre { padding:0.85rem 1rem; overflow-x:auto; }
+  .footer-links { margin-top:2.5rem; padding-top:1.25rem; border-top:1px solid var(--border); color:var(--muted); font-size:0.9rem; }
+  .footer-links a { color:var(--cyan); text-decoration:none; }
+</style>
+</head>
+<body>
+<nav>
+  <a href="/" class="brand">ThumbGate</a>
+  <a href="/guide">Guide</a>
+  <a href="/agent-manager">Agent Manager</a>
+  <a href="/codex-plugin">Codex plugin</a>
+  <a href="/dashboard">Dashboard demo</a>
+  <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
+</nav>
+<div class="container">
+  <span class="pill">Codex in the Enterprise</span>
+  <h1>Codex in production needs a governance layer. Dell-distributed or self-hosted, agents repeat the same mistakes.</h1>
+  <p>OpenAI and Dell <a href="https://openai.com/index/dell-codex-enterprise-partnership/" target="_blank" rel="noopener" style="color:var(--cyan)">just announced</a> a partnership to distribute Codex into the enterprise — Dell PCs, Dell servers, and Dell's enterprise sales motion become a delivery channel for OpenAI's coding agent. Codex's addressable market jumps from individual developer install to org-wide procurement. The governance gap jumps with it: every enterprise that turns Codex on now needs a runtime layer that captures what the agent did, flags the repeat failures (and hard-blocks the catastrophic ones, or any rule under strict enforcement), and produces the audit trail their security review will ask for.</p>
+  <p>ThumbGate already ships a <a href="/codex-plugin">Codex plugin</a>. The free CLI is real, MIT-licensed, and the gates work locally without a hosted account. This page is what that plugin maps to once Codex is no longer one developer's experiment but a procurement line item.</p>
+  <h2>What the governance layer ships</h2>
+  <div class="grid">
+    <div class="card">
+      <h3>Capture every agent decision as it happens</h3>
+      <p>The Thariq pattern — running implementation notes that record decisions, assumptions (marked VERIFIED or UNVERIFIED), tradeoffs, and corrections — productionized as a Codex hook. Every multi-step task gets a structured journal you can review async without re-reading the entire transcript.</p>
+    </div>
+    <div class="card">
+      <h3>Promote repeat failures to PreToolUse gates</h3>
+      <p>When the same agent mistake shows up twice, ThumbGate distills it into a prevention rule and flags the next attempt at the tool-call boundary — hard-blocking it for catastrophic classes or under strict enforcement — with the rule that fired in the agent's reasoning trace, so Codex chooses a safer plan instead of being told to "be more careful."</p>
+    </div>
+    <div class="card">
+      <h3>Audit trail enterprise procurement requires</h3>
+      <p>Per-tool-call evidence, per-rule provenance, exportable for SOC 2 / ISO 27001 / EU AI Act review. The hosted dashboard rolls this up across repos so the Agent Manager role has one surface instead of N developer machines.</p>
+    </div>
+  </div>
+  <h2>Why this matters now</h2>
+  <p>The Dell distribution channel changes who buys Codex. The individual-developer install is opt-in; the enterprise procurement install is policy-driven. The teams approving the Codex line item will ask three questions ThumbGate is built to answer:</p>
+  <ol>
+    <li><strong>What did the agent do?</strong> — capture, with evidence, on every tool call.</li>
+    <li><strong>What did we stop it from doing?</strong> — PreToolUse gates with the rule that fired and why.</li>
+    <li><strong>How do you keep this current as Codex updates?</strong> — adapter matrix that's CI-checked against upstream.</li>
+  </ol>
+  <div class="quote">"Dell-distributed Codex into the enterprise is the moment governance moves from optional to procurement-required. The runtime that captures, blocks, and audits is the line item underneath the line item."</div>
+  <h2>Install</h2>
+  <p>One repo, one command:</p>
+  <pre><code>npx thumbgate init --agent codex</code></pre>
+  <p>This wires the Codex hook, sets up the local lesson DB, and gives you the capture/promote/block loop without a hosted account. If you want the standalone Codex plugin as a self-contained zip — for offline distribution to Dell-managed machines or for security review — grab it from <a href="https://github.com/IgorGanapolsky/ThumbGate/releases" target="_blank" rel="noopener" style="color:var(--cyan)">GitHub releases</a> (look for <code>codex-plugin-*.zip</code>).</p>
+  <div class="card">
+    <p><strong>The free CLI is real. Pro adds the personal dashboard, recall, exports, and managed adapters. Enterprise is the hosted dashboard, the org-wide rule library, and the operator the Agent Manager doesn't have to be themselves.</strong></p>
+    <p>
+      <a href="/#workflow-sprint-intake?utm_source=website&amp;utm_medium=codex_enterprise_page&amp;utm_campaign=codex_enterprise_sprint&amp;cta_id=codex_enterprise_sprint_intake&amp;cta_placement=codex_enterprise_page" class="cta">Start the Workflow Hardening Sprint</a>
+      <a href="/checkout/pro?utm_source=website&amp;utm_medium=codex_enterprise_page&amp;utm_campaign=pro_upgrade&amp;cta_id=codex_enterprise_pro_checkout&amp;cta_placement=codex_enterprise_page&amp;plan_id=pro" class="secondary">Or start Pro at $19/mo →</a>
+    </p>
+  </div>
+  <h2>Related reading</h2>
+  <ul>
+    <li><a href="/agent-manager">ThumbGate for the Agent Manager</a> — the role inside the enterprise that owns Codex rollout policy.</li>
+    <li><a href="/codex-plugin">Codex plugin overview</a> — the standalone plugin surface this page rides on top of.</li>
+    <li><a href="/compare">Compare</a> — how governance compares to orchestration suites under the same Codex install.</li>
+  </ul>
+  <div class="footer-links">
+    Built for teams who turned on Codex and discovered "tell the model to be more careful" doesn't scale. See also <a href="/agent-manager">/agent-manager</a> for the role-level framing.
+  </div>
+</div>
+</body>
+</html>

package/public/codex-plugin.html CHANGED Viewed

@@ -224,7 +224,7 @@
   <section class="hero">
     <div class="wrap">
       <div class="eyebrow">Codex MCP plugin + Pre-Action Checks</div>
-      <h1>Give Codex a thumbs-down once. Block the repeat before it runs again.</h1>
+      <h1>Give Codex a thumbs-down once. Catch the repeat before it runs again.</h1>
       <p class="sub" style="font-size:13px;opacity:0.85;">Updated: <time datetime="2026-04-20">2026-04-20</time> · by <a href="https://github.com/IgorGanapolsky" style="color:inherit;">Igor Ganapolsky</a></p>
       <p class="sub">ThumbGate wires Codex into local-first feedback memory, MCP tools, and hook enforcement. The launcher resolves <code>thumbgate@latest</code> when Codex starts, so published npm fixes reach your active MCP server after a restart.</p>
       <div class="actions">
@@ -235,7 +235,7 @@
       <nav class="proof-bar" aria-label="Codex proof and conversion links">
         <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
         <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/COMMERCIAL_TRUTH.md" target="_blank" rel="noopener">Commercial truth</a>
-        <a href="/checkout/pro?utm_source=codex&utm_medium=plugin_page&utm_campaign=codex_plugin_follow_on&utm_content=pro&campaign_variant=pro_follow_on&offer_code=CODEX-PRO_FOLLOW_ON&cta_id=codex_pro_follow_on&cta_placement=plugin_page&plan_id=pro&surface=codex_plugin">Upgrade after one blocked repeat</a>
+        <a href="/checkout/pro?utm_source=codex&utm_medium=plugin_page&utm_campaign=codex_plugin_follow_on&utm_content=pro&campaign_variant=pro_follow_on&offer_code=CODEX-PRO_FOLLOW_ON&cta_id=codex_pro_follow_on&cta_placement=plugin_page&plan_id=pro&surface=codex_plugin">Upgrade after one caught repeat</a>
         <a href="/?utm_source=codex&utm_medium=plugin_page&utm_campaign=codex_team_follow_on&utm_content=workflow_sprint&campaign_variant=teams_follow_on&offer_code=CODEX-TEAMS_FOLLOW_ON&cta_id=codex_team_follow_on&cta_placement=plugin_page&surface=codex_plugin#workflow-sprint-intake">Team workflow sprint</a>
       </nav>
       <pre class="terminal">$ npx thumbgate init --agent codex
@@ -255,8 +255,8 @@ $ npx thumbgate feedback-self-test
       <p>The Codex launcher installs <code>thumbgate@latest</code> into <code>~/.thumbgate/runtime</code> before running MCP or gate checks. A new npm publish reaches Codex after the app restarts.</p>
     </div>
     <div class="tile">
-      <h3>Hard stop before action</h3>
-      <p>Pre-Action Checks evaluate commands, file edits, publishes, merges, and other high-risk actions before execution. Bad repeats get blocked before they burn time or tokens.</p>
+      <h3>Checks before action</h3>
+      <p>Pre-Action Checks evaluate commands, file edits, publishes, merges, and other high-risk actions before execution. Bad repeats are flagged and logged before they burn time or tokens — and hard-blocked for catastrophic classes (secret exfiltration, destructive deletes) or when strict enforcement is enabled.</p>
     </div>
   </section>
@@ -334,7 +334,7 @@ $ npx thumbgate feedback-self-test
   <section class="wrap grid" aria-label="Proof-backed next steps">
     <div class="tile">
       <h3>Pro only after proof</h3>
-      <p>Use the free Codex path to prove one real blocked repeat first. Upgrade to Pro only when you want the personal dashboard, proof-ready exports, and a review surface after that proof exists.</p>
+      <p>Use the free Codex path to prove one real caught repeat first. Upgrade to Pro only when you want the personal dashboard, proof-ready exports, and a review surface after that proof exists.</p>
     </div>
     <div class="tile">
       <h3>Commercial truth stays inspectable</h3>

package/public/compare.html CHANGED Viewed

@@ -46,7 +46,7 @@
       "name": "What is a pre-action check for AI coding agents?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests. ThumbGate implements pre-action checks via PreToolUse hooks that fire before every tool call."
+        "text": "A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks flag and log risky actions, and hard-block the most dangerous classes by default (secret exfiltration, supply-chain installs, and rm -rf-class deletes). Actions such as force-pushing to main, off-scope edits, or skipping tests warn by default and hard-block under strict enforcement mode (THUMBGATE_STRICT_ENFORCEMENT=1). ThumbGate implements pre-action checks via PreToolUse hooks that fire before every tool call."
       }
     },
     {
@@ -62,7 +62,7 @@
       "name": "Is ThumbGate free?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "ThumbGate has a free tier that includes local enforcement with 2 feedback captures/day, 10 total captures, up to 3 active auto-promoted prevention rules, and pre-action check blocking. Pro ($19/mo or $149/yr) adds hosted sync, a personal local dashboard, recall, lesson search, unlimited captures/rules, and DPO export. Enterprise (custom pricing, scoped after intake) adds a shared lesson database and org dashboard."
+        "text": "ThumbGate free includes local enforcement with 2 captures/day, 10 total captures, 3 active auto-promoted prevention rules, and pre-action blocking. Pro ($19/mo or $149/yr) adds personal recall, search, a local dashboard, managed adapters, unlimited captures/rules, and DPO export. Enterprise adds a shared hosted lesson DB and org dashboard."
       }
     },
     {
@@ -70,7 +70,7 @@
       "name": "How is ThumbGate different from .cursorrules or CLAUDE.md rules?",
       "acceptedAnswer": {
         "@type": "Answer",
-        "text": "Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is physically blocked before execution. Additionally, ThumbGate auto-generates prevention rules from feedback, so you never have to write rules manually."
+        "text": "Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is flagged and logged, and hard-blocked before execution for the most dangerous classes or under strict enforcement mode. Additionally, ThumbGate auto-generates prevention rules from feedback, so you never have to write rules manually."
       }
     },
     {
@@ -161,8 +161,8 @@
     <th>ESLint / Linters</th>
   </tr>
   <tr>
-    <td>Blocks bad actions before execution</td>
-    <td class="yes">Yes -- PreToolUse hooks</td>
+    <td>Intercepts bad actions before execution</td>
+    <td class="yes">Yes -- PreToolUse hooks warn by default; hard-block high-risk classes and strict mode</td>
     <td class="partial">Partially -- after PR only</td>
     <td class="no">No -- damage already done</td>
     <td class="partial">Partially -- suggestions only</td>
@@ -237,7 +237,7 @@
 <h2>Why ThumbGate Wins</h2>
 <ul>
-  <li><strong>Enforcement, not suggestions.</strong> Prompt rules in CLAUDE.md or .cursorrules are instructions the agent can ignore. ThumbGate intercepts tool calls at the PreToolUse hook level and physically blocks dangerous actions before they execute.</li>
+  <li><strong>Enforcement, not suggestions.</strong> Prompt rules in CLAUDE.md or .cursorrules are instructions the agent can ignore. ThumbGate intercepts tool calls at the PreToolUse hook level, flags and logs risky actions, and hard-blocks the most dangerous classes (secret exfiltration, supply-chain installs, rm -rf-class deletes) before they execute — with force-push, off-scope edits, and skip-tests escalated to hard blocks under strict enforcement mode.</li>
   <li><strong>Learns and adapts automatically.</strong> Every thumbs-down becomes a data point. After repeated failures with the same pattern, ThumbGate auto-generates a prevention rule. Checks adapt their sensitivity over time using Thompson Sampling -- aggressive checks that over-block get tuned down, effective checks get reinforced.</li>
   <li><strong>Works across all major AI coding agents.</strong> One install command covers Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, and OpenCode. No per-agent configuration needed.</li>
   <li><strong>Prevention is cheaper than recovery.</strong> Manual code review catches mistakes after the PR. Git revert catches them after the push. ThumbGate catches them before the tool call executes -- saving the time, context switches, and cleanup cost of undoing damage.</li>
@@ -271,7 +271,7 @@
 <p style="color:var(--muted);">Every head-to-head in one place. ThumbGate is the local-first, learning enforcement layer at the tool-call boundary — most of these tools sit at a different layer and are complementary.</p>
 <ul class="compare-index">
   <li><a href="/compare/sigmashake">ThumbGate vs SigmaShake</a> — learns the rule from your thumbs-down vs a hand-picked ruleset hub</li>
-  <li><a href="/compare/claude-code-hooks">ThumbGate vs claude-code-hooks</a> — hosted sync &amp; learning on top of local shell-script hooks</li>
+  <li><a href="/compare/claude-code-hooks">ThumbGate vs claude-code-hooks</a> — personal recall, exports, and managed adapters on top of local shell-script hooks</li>
   <li><a href="/compare/arcjet">ThumbGate vs Arcjet</a> — agent-outbound gate pairs with an app-inbound firewall</li>
   <li><a href="/compare/bumblebee">ThumbGate vs Bumblebee</a> — runtime enforcement pairs with static inventory</li>
   <li><a href="/compare/anthropic-containment">ThumbGate vs Anthropic's Claude Containment</a> — an IDE-agent extension of Anthropic's published architecture</li>
@@ -324,7 +324,7 @@
 <div class="card">
   <h3>What is a pre-action check?</h3>
-  <p>A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks physically block dangerous actions such as force-pushing to main, deleting production files, or committing code with failing tests.</p>
+  <p>A pre-action check is an enforcement layer that intercepts AI agent tool calls before they execute. Unlike prompt rules that agents can ignore, pre-action checks flag and log risky actions and hard-block the most dangerous classes by default (secret exfiltration, supply-chain installs, rm -rf-class deletes). Actions such as force-pushing to main, off-scope edits, or skipping tests warn by default and hard-block under strict enforcement mode.</p>
 </div>
 <div class="card">
@@ -334,12 +334,12 @@
 <div class="card">
   <h3>Is ThumbGate free?</h3>
-  <p>ThumbGate has a free tier that includes local enforcement with 2 feedback captures/day, 10 total captures, up to 3 active auto-promoted prevention rules, and pre-action check blocking. Pro ($19/mo or $149/yr) adds hosted sync, a personal local dashboard, recall, lesson search, unlimited captures/rules, and DPO export. Enterprise (custom pricing, scoped after intake) adds a shared lesson database and org dashboard.</p>
+  <p>ThumbGate free includes local enforcement with 2 captures/day, 10 total captures, 3 active auto-promoted prevention rules, and pre-action blocking. Pro ($19/mo or $149/yr) adds personal recall, search, a local dashboard, managed adapters, unlimited captures/rules, and DPO export. Enterprise adds a shared hosted lesson DB and org dashboard.</p>
 </div>
 <div class="card">
   <h3>How is ThumbGate different from .cursorrules or CLAUDE.md rules?</h3>
-  <p>Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is physically blocked before execution. Additionally, ThumbGate auto-generates prevention rules from feedback -- no manual rule writing.</p>
+  <p>Cursor rules and CLAUDE.md are prompt-level instructions that the AI agent can read, forget, or override. ThumbGate enforces rules at the tool-call level via PreToolUse hooks. When a tool call matches a known failure pattern, it is flagged and logged, and hard-blocked before execution for the most dangerous classes or under strict enforcement mode. Additionally, ThumbGate auto-generates prevention rules from feedback -- no manual rule writing.</p>
 </div>
 <div class="card">

package/public/dashboard.html CHANGED Viewed

@@ -756,7 +756,7 @@
           <div><span style="color:var(--green);">👍 "chosen"</span> — the response that worked</div>
           <div><span style="color:var(--red);">👎 "rejected"</span> — the response that failed</div>
         </div>
-        <p style="color:var(--text-muted);font-size:14px;line-height:1.65;">Use these pairs to fine-tune any model (OpenAI, Llama, Mistral) so it <strong style="color:var(--text);">actually learns from your corrections</strong> — not just blocks mistakes, but stops making them.</p>
+        <p style="color:var(--text-muted);font-size:14px;line-height:1.65;">Use these pairs to fine-tune any model (OpenAI, Llama, Mistral) so it <strong style="color:var(--text);">actually learns from your corrections</strong> — not just flags mistakes at the gate, but stops making them.</p>
       </div>
       <button class="export-btn" onclick="exportDpo()">📥 Download DPO Pairs (JSON)</button>
       <div id="exportStatus" style="margin-top:12px;font-size:13px;color:var(--text-muted);"></div>