npm - thumbgate - Versions diffs - 1.27.8 → 1.27.10 - Mend

thumbgate 1.27.8 → 1.27.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (117) hide show

package/.claude-plugin/plugin.json +1 -1
package/.well-known/llms.txt +1 -2
package/.well-known/mcp/server-card.json +1 -1
package/README.md +4 -2
package/adapters/claude/.mcp.json +2 -2
package/adapters/mcp/server-stdio.js +1 -1
package/adapters/opencode/opencode.json +1 -1
package/bin/cli.js +259 -78
package/config/gate-templates.json +228 -0
package/config/gates/claim-verification.json +18 -0
package/package.json +14 -21
package/public/blog.html +30 -0
package/public/compare/adopt-ai.html +219 -0
package/public/compare/agentix-labs.html +197 -0
package/public/compare/ai-experience-orchestration.html +216 -0
package/public/compare/anthropic-claude-for-legal.html +260 -0
package/public/compare/anthropic-containment.html +280 -0
package/public/compare/arcade.html +175 -0
package/public/compare/arcjet.html +239 -0
package/public/compare/bumblebee.html +307 -0
package/public/compare/claude-code-hooks.html +294 -0
package/public/compare/databricks-unity-ai-gateway.html +215 -0
package/public/compare/fallow.html +351 -0
package/public/compare/heidi.html +233 -0
package/public/compare/mem0.html +342 -0
package/public/compare/oak-and-sparrow-gatekeeper.html +289 -0
package/public/compare/rein.html +236 -0
package/public/compare/sigmashake.html +256 -0
package/public/compare/speclock.html +342 -0
package/public/compare.html +2 -0
package/public/guides/agent-harness-optimization.html +342 -0
package/public/guides/agentic-web-governance.html +406 -0
package/public/guides/ai-agent-governance-sprint.html +415 -0
package/public/guides/ai-agent-pre-action-approval-gates.html +401 -0
package/public/guides/ai-agent-workflow-migration-checklist.html +392 -0
package/public/guides/ai-deployment-readiness.html +415 -0
package/public/guides/ai-mode-ads-agent-governance.html +401 -0
package/public/guides/ai-search-topical-presence.html +342 -0
package/public/guides/autoresearch-agent-safety.html +342 -0
package/public/guides/background-agent-governance.html +358 -0
package/public/guides/best-tools-stop-ai-agents-breaking-production.html +363 -0
package/public/guides/browser-automation-safety.html +342 -0
package/public/guides/chatgpt-ads-trust.html +353 -0
package/public/guides/claude-code-feedback.html +339 -0
package/public/guides/claude-code-prevent-repeated-mistakes.html +161 -0
package/public/guides/claude-code-skills-guardrails.html +343 -0
package/public/guides/claude-desktop.html +356 -0
package/public/guides/code-knowledge-graph-guardrails.html +365 -0
package/public/guides/codex-cli-guardrails.html +339 -0
package/public/guides/cursor-agent-guardrails.html +339 -0
package/public/guides/cursor-prevent-repeated-mistakes.html +161 -0
package/public/guides/database-agent-safety.html +406 -0
package/public/guides/deepseek-v4-runtime-guardrails.html +346 -0
package/public/guides/developer-machine-supply-chain-guardrails.html +358 -0
package/public/guides/gcp-mcp-guardrails.html +147 -0
package/public/guides/gemini-cli-feedback-memory.html +339 -0
package/public/guides/gpt-5-5-model-evaluation.html +358 -0
package/public/guides/internal-ai-engineering-stack-guardrails.html +348 -0
package/public/guides/long-running-agent-context-management.html +346 -0
package/public/guides/mcp-tool-governance.html +401 -0
package/public/guides/multica-thumbgate-setup.html +134 -0
package/public/guides/native-messaging-host-security.html +342 -0
package/public/guides/policy-engine-pre-action-gates.html +346 -0
package/public/guides/pre-action-checks.html +342 -0
package/public/guides/pretooluse-hooks-vs-advisory-prompt-rules.html +342 -0
package/public/guides/prompt-tricks-to-workflow-rules.html +365 -0
package/public/guides/proxy-pointer-rag-guardrails.html +352 -0
package/public/guides/rag-precision-tuning-guardrails.html +352 -0
package/public/guides/reasoning-compression-guardrails.html +346 -0
package/public/guides/relational-knowledge-ai-recommendations.html +342 -0
package/public/guides/roo-code-alternative-cline.html +339 -0
package/public/guides/semantic-programmatic-seo-guardrails.html +352 -0
package/public/guides/seo-agent-skills-guardrails.html +344 -0
package/public/guides/stop-repeated-ai-agent-mistakes.html +342 -0
package/public/index.html +192 -50
package/public/learn/ac-dc-runtime-enforcement.html +277 -0
package/public/learn/agent-harness-pattern.html +181 -0
package/public/learn/agent-identity-connector-governance.html +146 -0
package/public/learn/agent-swarms-shared-gates.html +173 -0
package/public/learn/agentic-enterprise-context-brain.html +117 -0
package/public/learn/agentic-os-team-governance.html +146 -0
package/public/learn/ai-agent-governance.html +158 -0
package/public/learn/ai-agent-persistent-memory.html +211 -0
package/public/learn/anthropomorphic-claim-gates.html +180 -0
package/public/learn/background-agent-control-layer.html +184 -0
package/public/learn/claude-code-goal-with-rubrics.html +205 -0
package/public/learn/codex-role-plugins-need-governance.html +125 -0
package/public/learn/cost-aware-agent-gate-routing.html +173 -0
package/public/learn/databricks-unity-ai-gateway-runtime-governance.html +157 -0
package/public/learn/deterministic-agent-workflows.html +185 -0
package/public/learn/feedback-loop-vs-decision-layer.html +283 -0
package/public/learn/from-prototype-to-production.html +223 -0
package/public/learn/learn.css +51 -0
package/public/learn/mcp-pre-action-checks-explained.html +172 -0
package/public/learn/pretix-stripe-connect-marketplaces.html +161 -0
package/public/learn/regulated-agent-execution-boundary.html +196 -0
package/public/learn/spec-driven-development.html +168 -0
package/public/learn/stop-ai-agent-force-push.html +134 -0
package/public/learn/vibe-coding-safety-net.html +142 -0
package/public/learn.html +34 -50
package/public/numbers.html +2 -2
package/public/pro.html +6 -6
package/scripts/cli-schema.js +10 -22
package/scripts/dashboard-chat.js +1 -2
package/scripts/document-intake.js +49 -1
package/scripts/gemini-embedding-policy.js +1 -2
package/scripts/hook-stop-anti-claim.js +103 -42
package/scripts/hosted-config.js +12 -0
package/scripts/plausible-domain-config.js +1 -3
package/scripts/reddit-browser-notification-watch.js +230 -0
package/scripts/seo-gsd.js +0 -239
package/scripts/tool-registry.js +2 -2
package/scripts/vector-store.js +0 -44
package/scripts/workspace-evolver.js +2 -62
package/src/api/server.js +126 -335
package/adapters/policy-engine/ethicore-guardian-client.js +0 -68
package/adapters/policy-engine/thumbgate-policy-engine-adapter.js +0 -260

package/public/guides/pre-action-checks.html ADDED Viewed

@@ -0,0 +1,342 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Pre-Action Checks for AI Coding Agents | ThumbGate Guide</title>
+  <meta name="description" content="Pre-action gates stop the risky move before the agent executes it. ThumbGate uses thumbs-up/down feedback to decide what should be reinforced, warned, or blo..." />
+  <meta property="og:title" content="Pre-Action Checks for AI Coding Agents | ThumbGate Guide" />
+  <meta property="og:description" content="Pre-action gates stop the risky move before the agent executes it. ThumbGate uses thumbs-up/down feedback to decide what should be reinforced, warned, or blo..." />
+  <meta property="og:type" content="article" />
+  <meta property="og:url" content="https://thumbgate.ai/guides/pre-action-checks" />
+  <link rel="canonical" href="https://thumbgate.ai/guides/pre-action-checks" />
+  <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
+  <link rel="icon" type="image/svg+xml" href="/thumbgate-icon.png" />
+  <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
+  <meta property="og:image" content="/og.png" />
+  <style>
+    :root {
+      --bg: #0a0a0b;
+      --bg-raised: #111113;
+      --bg-card: #161618;
+      --line: #222225;
+      --text: #e8e8ec;
+      --muted: #8b8b96;
+      --cyan: #22d3ee;
+      --green: #4ade80;
+      --red: #f87171;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+      background: var(--bg);
+      color: var(--text);
+      line-height: 1.65;
+    }
+    a { color: var(--cyan); text-decoration: none; }
+    a:hover { text-decoration: underline; }
+    .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
+    .topbar {
+      position: sticky;
+      top: 0;
+      z-index: 20;
+      backdrop-filter: blur(12px);
+      background: rgba(10, 10, 11, 0.88);
+      border-bottom: 1px solid var(--line);
+    }
+    .topbar .container {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      padding-top: 14px;
+      padding-bottom: 14px;
+    }
+    .brand {
+      font-weight: 700;
+      color: var(--text);
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      text-decoration: none;
+    }
+    .brand .logo-mark { width: 28px; height: 28px; display: block; }
+    .hero { padding: 72px 0 32px; }
+    .eyebrow {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 6px 12px;
+      border-radius: 999px;
+      border: 1px solid rgba(34, 211, 238, 0.22);
+      background: rgba(34, 211, 238, 0.1);
+      color: var(--cyan);
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+      font-size: 12px;
+      font-weight: 700;
+    }
+    h1 {
+      font-size: clamp(34px, 5vw, 56px);
+      line-height: 1.06;
+      letter-spacing: -0.04em;
+      margin: 16px 0;
+      max-width: 760px;
+    }
+    .hero p {
+      max-width: 720px;
+      color: var(--muted);
+      font-size: 18px;
+    }
+    .signal-row {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 12px;
+      margin: 28px 0 0;
+    }
+    .signal-pill {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 10px 14px;
+      border-radius: 999px;
+      border: 1px solid var(--line);
+      background: var(--bg-raised);
+      font-weight: 600;
+      font-size: 14px;
+    }
+    .signal-pill.up {
+      border-color: rgba(74, 222, 128, 0.28);
+      color: #b8f7c8;
+      background: rgba(74, 222, 128, 0.1);
+    }
+    .signal-pill.down {
+      border-color: rgba(248, 113, 113, 0.28);
+      color: #ffc0c0;
+      background: rgba(248, 113, 113, 0.1);
+    }
+    .grid {
+      display: grid;
+      grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr);
+      gap: 24px;
+      padding-bottom: 72px;
+    }
+    .card, .detail-section, .sidebar-card {
+      background: var(--bg-card);
+      border: 1px solid var(--line);
+      border-radius: 16px;
+    }
+    .card { padding: 24px; }
+    .detail-section { padding: 24px; margin-bottom: 18px; }
+    .detail-section h2 { margin: 0 0 12px; font-size: 24px; letter-spacing: -0.03em; }
+    .detail-section p { color: var(--muted); }
+    .detail-section ul, .card ul { padding-left: 18px; color: var(--muted); }
+    .card h2 { margin-top: 0; }
+    .sidebar {
+      display: flex;
+      flex-direction: column;
+      gap: 18px;
+    }
+    .sidebar-card {
+      padding: 20px;
+    }
+    /* Only the first sidebar card sticks. Stacking multiple stickies at the
+       same top offset makes them overlap each other on scroll. The related-
+       pages card flows normally below. */
+    .sidebar-card:first-child {
+      position: sticky;
+      top: 84px;
+      max-height: calc(100vh - 104px);
+      overflow-y: auto;
+      -webkit-overflow-scrolling: touch;
+    }
+    .proof-links {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 12px;
+      margin-top: 16px;
+    }
+    .cta-button {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      margin-top: 18px;
+      padding: 12px 16px;
+      border-radius: 10px;
+      background: var(--cyan);
+      color: #071116;
+      font-weight: 700;
+      text-decoration: none;
+    }
+    .faq-item {
+      border-top: 1px solid var(--line);
+      padding: 14px 0;
+    }
+    .faq-item summary {
+      cursor: pointer;
+      font-weight: 600;
+    }
+    .faq-item p {
+      color: var(--muted);
+    }
+    .related-card {
+      display: block;
+      padding: 14px;
+      border-radius: 12px;
+      border: 1px solid var(--line);
+      background: var(--bg-raised);
+      margin-top: 12px;
+      color: var(--text);
+    }
+    .related-label {
+      display: block;
+      color: var(--muted);
+      font-size: 12px;
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+      margin-bottom: 4px;
+    }
+    @media (max-width: 860px) {
+      .grid {
+        grid-template-columns: 1fr;
+      }
+      .sidebar-card:first-child {
+        position: static;
+        max-height: none;
+        overflow: visible;
+      }
+    }
+  </style>
+  <script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "TechArticle",
+  "headline": "What Are Pre-Action Checks?",
+  "description": "Pre-action gates stop the risky move before the agent executes it. ThumbGate uses thumbs-up/down feedback to decide what should be reinforced, warned, or blo...",
+  "about": [
+    "claude code masterclass guardrails",
+    "cursor prevent repeated mistakes",
+    "claude code prevent repeated mistakes",
+    "codex cli guardrails"
+  ],
+  "url": "https://thumbgate.ai/guides/pre-action-checks",
+  "publisher": {
+    "@type": "Organization",
+    "name": "ThumbGate",
+    "url": "https://thumbgate.ai"
+  },
+  "mainEntityOfPage": "https://thumbgate.ai/guides/pre-action-checks"
+}
+  </script>
+  <script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "FAQPage",
+  "mainEntity": [
+    {
+      "@type": "Question",
+      "name": "How are pre-action checks different from prompt rules?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "Prompt rules ask the model nicely. Pre-action gates intercept the tool call and block it before execution when the known-bad pattern matches."
+      }
+    },
+    {
+      "@type": "Question",
+      "name": "Can a thumbs up matter too?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "Yes. ThumbGate explicitly uses thumbs up to reinforce successful behavior so the system is not only punitive."
+      }
+    }
+  ]
+}
+  </script>
+</head>
+<body>
+  <div class="topbar">
+    <div class="container">
+      <a class="brand" href="/"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
+      <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
+    </div>
+  </div>
+  <main class="container">
+    <section class="hero">
+      <div class="eyebrow">guide | pre-action checks for ai coding agents</div>
+      <h1>What Are Pre-Action Checks?</h1>
+      <p>Pre-action gates stop the risky move before the agent executes it. ThumbGate uses thumbs-up/down feedback to decide what should be reinforced, warned, or blocked.</p>
+      <div class="signal-row">
+        <div class="signal-pill up">👍 Thumbs up reinforces good behavior</div>
+        <div class="signal-pill down">👎 Thumbs down blocks repeated mistakes</div>
+      </div>
+    </section>
+    <section class="grid">
+      <div>
+        <div class="card">
+          <h2>Why this page exists</h2>
+          <ul><li>Prompt rules are advisory. Pre-action gates are enforcement.</li><li>A repeated thumbs down can become a warning gate or a hard block.</li><li>The right proof asset is not the rule text alone but the evidence that the gate fired before damage.</li></ul>
+        </div>
+      <section class="detail-section">
+        <h2>Why this matters</h2>
+        <p>Most AI coding failures are not mysterious. They are repeated mistakes: force-pushes, destructive scripts, missed verification steps, or breaking architectural constraints.</p><p>A pre-action check turns that failure pattern into a runtime checkpoint. The agent sees the stop before the bad action lands.</p>
+      </section>
+      <section class="detail-section">
+        <h2>How ThumbGate makes the loop useful</h2>
+        <ul><li>Capture structured thumbs-up/down feedback.</li><li>Promote repeated failures into prevention rules.</li><li>Score and enforce the rules with Thompson Sampling and pre-action hooks.</li><li>Publish verification evidence so the system is auditable.</li></ul>
+      </section>
+      <section class="detail-section">
+        <h2>Best next step</h2>
+        <p>If a buyer is exploring the category, this page should move them to either a comparison page or the main product proof pack.</p>
+      </section>
+        <div class="detail-section">
+          <h2>FAQ</h2>
+      <details class="faq-item">
+        <summary>How are pre-action checks different from prompt rules?</summary>
+        <p>Prompt rules ask the model nicely. Pre-action gates intercept the tool call and block it before execution when the known-bad pattern matches.</p>
+      </details>
+      <details class="faq-item">
+        <summary>Can a thumbs up matter too?</summary>
+        <p>Yes. ThumbGate explicitly uses thumbs up to reinforce successful behavior so the system is not only punitive.</p>
+      </details>
+        </div>
+      </div>
+      <aside class="sidebar">
+        <div class="sidebar-card">
+          <h2>GSD execution brief</h2>
+          <p>This page was prioritized because it captures high-intent demand around pre-action checks for ai coding agents and feeds directly into ThumbGate's proof-led conversion path.</p>
+          <p><strong>Opportunity score:</strong> 83</p>
+          <p><strong>Primary persona:</strong> engineering-lead</p>
+          <p><strong>Keyword cluster:</strong> claude code masterclass guardrails, cursor prevent repeated mistakes, claude code prevent repeated mistakes, codex cli guardrails</p>
+          <p><strong>Pricing:</strong> Pro $19/mo or $149/yr. Team $49/seat/mo.</p>
+          <div class="proof-links"><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/proof/automation/report.json" target="_blank" rel="noopener">Automation proof</a><a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub repository</a></div>
+          <a class="cta-button" href="/checkout/pro?utm_source=website&amp;utm_medium=seo_page&amp;utm_campaign=guides_pre-action-checks&amp;cta_placement=seo_brief&amp;plan_id=pro" target="_blank" rel="noopener">Go Pro — $19/mo</a>
+        </div>
+        <div class="sidebar-card">
+          <h2>Related pages</h2>
+        <a class="related-card" href="/compare/speclock">
+          <span class="related-label">Related page</span>
+          <strong>ThumbGate vs SpecLock</strong>
+        </a>
+        <a class="related-card" href="/guides/claude-code-feedback">
+          <span class="related-label">Related page</span>
+          <strong>Claude Code Feedback Memory That Actually Enforces</strong>
+        </a>
+        </div>
+      </aside>
+    </section>
+  </main>
+</body>
+</html>

package/public/guides/pretooluse-hooks-vs-advisory-prompt-rules.html ADDED Viewed

@@ -0,0 +1,342 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>PreToolUse Hooks vs Advisory Prompt Rules: Secure AI Coding Agents | ThumbGate</title>
+  <meta name="description" content="Prompt files like .cursorrules or CLAUDE.md are advisory guidelines that agents can ignore or bypass. Learn why PreToolUse hooks provide deterministic security." />
+  <meta property="og:title" content="PreToolUse Hooks vs Advisory Prompt Rules: Secure AI Coding Agents | ThumbGate" />
+  <meta property="og:description" content="Prompt files like .cursorrules or CLAUDE.md are advisory guidelines that agents can ignore or bypass. Learn why PreToolUse hooks provide deterministic security." />
+  <meta property="og:type" content="article" />
+  <meta property="og:url" content="https://thumbgate.ai/guides/pretooluse-hooks-vs-advisory-prompt-rules" />
+  <link rel="canonical" href="https://thumbgate.ai/guides/pretooluse-hooks-vs-advisory-prompt-rules" />
+  <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
+  <link rel="icon" type="image/svg+xml" href="/thumbgate-icon.png" />
+  <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
+  <meta property="og:image" content="/og.png" />
+  <style>
+    :root {
+      --bg: #0a0a0b;
+      --bg-raised: #111113;
+      --bg-card: #161618;
+      --line: #222225;
+      --text: #e8e8ec;
+      --muted: #8b8b96;
+      --cyan: #22d3ee;
+      --green: #4ade80;
+      --red: #f87171;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+      background: var(--bg);
+      color: var(--text);
+      line-height: 1.65;
+    }
+    a { color: var(--cyan); text-decoration: none; }
+    a:hover { text-decoration: underline; }
+    .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
+    .topbar {
+      position: sticky;
+      top: 0;
+      z-index: 20;
+      backdrop-filter: blur(12px);
+      background: rgba(10, 10, 11, 0.88);
+      border-bottom: 1px solid var(--line);
+    }
+    .topbar .container {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      padding-top: 14px;
+      padding-bottom: 14px;
+    }
+    .brand {
+      font-weight: 700;
+      color: var(--text);
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      text-decoration: none;
+    }
+    .brand .logo-mark { width: 28px; height: 28px; display: block; }
+    .hero { padding: 72px 0 32px; }
+    .eyebrow {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 6px 12px;
+      border-radius: 999px;
+      border: 1px solid rgba(34, 211, 238, 0.22);
+      background: rgba(34, 211, 238, 0.1);
+      color: var(--cyan);
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+      font-size: 12px;
+      font-weight: 700;
+    }
+    h1 {
+      font-size: clamp(34px, 5vw, 56px);
+      line-height: 1.06;
+      letter-spacing: -0.04em;
+      margin: 16px 0;
+      max-width: 760px;
+    }
+    .hero p {
+      max-width: 720px;
+      color: var(--muted);
+      font-size: 18px;
+    }
+    .signal-row {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 12px;
+      margin: 28px 0 0;
+    }
+    .signal-pill {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 10px 14px;
+      border-radius: 999px;
+      border: 1px solid var(--line);
+      background: var(--bg-raised);
+      font-weight: 600;
+      font-size: 14px;
+    }
+    .signal-pill.up {
+      border-color: rgba(74, 222, 128, 0.28);
+      color: #b8f7c8;
+      background: rgba(74, 222, 128, 0.1);
+    }
+    .signal-pill.down {
+      border-color: rgba(248, 113, 113, 0.28);
+      color: #ffc0c0;
+      background: rgba(248, 113, 113, 0.1);
+    }
+    .grid {
+      display: grid;
+      grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr);
+      gap: 24px;
+      padding-bottom: 72px;
+    }
+    .card, .detail-section, .sidebar-card {
+      background: var(--bg-card);
+      border: 1px solid var(--line);
+      border-radius: 16px;
+    }
+    .card { padding: 24px; }
+    .detail-section { padding: 24px; margin-bottom: 18px; }
+    .detail-section h2 { margin: 0 0 12px; font-size: 24px; letter-spacing: -0.03em; }
+    .detail-section p { color: var(--muted); }
+    .detail-section ul, .card ul { padding-left: 18px; color: var(--muted); }
+    .card h2 { margin-top: 0; }
+    .sidebar {
+      display: flex;
+      flex-direction: column;
+      gap: 18px;
+    }
+    .sidebar-card {
+      padding: 20px;
+    }
+    .sidebar-card:first-child {
+      position: sticky;
+      top: 84px;
+      max-height: calc(100vh - 104px);
+      overflow-y: auto;
+      -webkit-overflow-scrolling: touch;
+    }
+    .proof-links {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 12px;
+      margin-top: 16px;
+    }
+    .cta-button {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      margin-top: 18px;
+      padding: 12px 16px;
+      border-radius: 10px;
+      background: var(--cyan);
+      color: #071116;
+      font-weight: 700;
+      text-decoration: none;
+    }
+    .faq-item {
+      border-top: 1px solid var(--line);
+      padding: 14px 0;
+    }
+    .faq-item summary {
+      cursor: pointer;
+      font-weight: 600;
+    }
+    .faq-item p {
+      color: var(--muted);
+    }
+    .related-card {
+      display: block;
+      padding: 14px;
+      border-radius: 12px;
+      border: 1px solid var(--line);
+      background: var(--bg-raised);
+      margin-top: 12px;
+      color: var(--text);
+    }
+    .related-label {
+      display: block;
+      color: var(--muted);
+      font-size: 12px;
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+      margin-bottom: 4px;
+    }
+    @media (max-width: 860px) {
+      .grid {
+        grid-template-columns: 1fr;
+      }
+      .sidebar-card:first-child {
+        position: static;
+        max-height: none;
+        overflow: visible;
+      }
+    }
+  </style>
+  <script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "TechArticle",
+  "headline": "PreToolUse Hooks vs Advisory Prompt Rules: Secure AI Coding Agents",
+  "description": "Prompt files like .cursorrules or CLAUDE.md are advisory guidelines that agents can ignore or bypass. Learn why PreToolUse hooks provide deterministic security.",
+  "about": [
+    "pretooluse hooks vs advisory prompt rules",
+    "claude code security",
+    "cursor rules bypass",
+    "mcp security"
+  ],
+  "url": "https://thumbgate.ai/guides/pretooluse-hooks-vs-advisory-prompt-rules",
+  "publisher": {
+    "@type": "Organization",
+    "name": "ThumbGate",
+    "url": "https://thumbgate.ai"
+  },
+  "mainEntityOfPage": "https://thumbgate.ai/guides/pretooluse-hooks-vs-advisory-prompt-rules"
+}
+  </script>
+  <script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "FAQPage",
+  "mainEntity": [
+    {
+      "@type": "Question",
+      "name": "Why are CLAUDE.md and .cursorrules files insufficient for security?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "They are advisory prompt-level files. The agent can ignore them, overwrite them, suffer from context drift, or be jailbroken into bypassing them since they are not enforced at the runtime level."
+      }
+    },
+    {
+      "@type": "Question",
+      "name": "How does a PreToolUse hook protect the codebase?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "PreToolUse hooks intercept tool calls at the protocol layer before they are executed. If a command matches a blocked pattern, the hook denies execution, making safety deterministic rather than probabilistic."
+      }
+    }
+  ]
+}
+  </script>
+</head>
+<body>
+  <div class="topbar">
+    <div class="container">
+      <a class="brand" href="/"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
+      <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
+    </div>
+  </div>
+  <main class="container">
+    <section class="hero">
+      <div class="eyebrow">guide | pretooluse hooks vs advisory prompt rules</div>
+      <h1>PreToolUse Hooks vs Advisory Prompt Rules</h1>
+      <p>Why files like .cursorrules and CLAUDE.md cannot protect your codebase from high-risk agent operations, and how protocol-level PreToolUse hooks enforce deterministic safety.</p>
+      <div class="signal-row">
+        <div class="signal-pill up">👍 PreToolUse: Deterministic Protocol Blocking</div>
+        <div class="signal-pill down">👎 Prompt Rules: Easily Ignored or Jailbroken</div>
+      </div>
+    </section>
+    <section class="grid">
+      <div>
+        <div class="card">
+          <h2>Why this page exists</h2>
+          <ul>
+            <li>Advisory files like CLAUDE.md are hints that the model can choose to ignore under pressure.</li>
+            <li>Real security requires blocking unsafe operations before they hit the terminal or file system.</li>
+            <li>PreToolUse hooks provide protocol-level enforcement that cannot be bypassed by agent reasoning.</li>
+          </ul>
+        </div>
+        <section class="detail-section">
+          <h2>The Vulnerability of Prompt-Level Rules</h2>
+          <p>Files like <code>.cursorrules</code>, <code>CLAUDE.md</code>, or custom prompt instructions are simply part of the model's context window. They instruct the model on how it <em>should</em> behave. However, this model suffers from structural weaknesses:</p>
+          <ul>
+            <li><strong>Context Drift:</strong> As conversations grow, early prompt instructions are deprioritized or pushed out of attention.</li>
+            <li><strong>Jailbreaking:</strong> The user prompt or an external file read can override instructions, forcing the agent to bypass its own rules.</li>
+            <li><strong>Self-Modification:</strong> Agents with file-writing privileges can edit or delete <code>.cursorrules</code> files to bypass constraints.</li>
+          </ul>
+        </section>
+        <section class="detail-section">
+          <h2>Deterministic PreToolUse Hook Enforcement</h2>
+          <p>A <code>PreToolUse</code> hook intercepts execution at the Model Context Protocol (MCP) or platform layer. When the agent attempts to run a bash command, modify a file, or query a database, the call is evaluated by a local policy engine before execution.</p>
+          <p>If the action matches a known-bad pattern or violates a policy, the hook blocks it and returns a structured error response. The agent is physically stopped, preserving the system state and preventing the error before it can happen.</p>
+        </section>
+        <div class="detail-section">
+          <h2>FAQ</h2>
+          <details class="faq-item">
+            <summary>Why are CLAUDE.md and .cursorrules files insufficient for security?</summary>
+            <p>They are advisory prompt-level files. The agent can ignore them, overwrite them, suffer from context drift, or be jailbroken into bypassing them since they are not enforced at the runtime level.</p>
+          </details>
+          <details class="faq-item">
+            <summary>How does a PreToolUse hook protect the codebase?</summary>
+            <p>PreToolUse hooks intercept tool calls at the protocol layer before they are executed. If a command matches a blocked pattern, the hook denies execution, making safety deterministic rather than probabilistic.</p>
+          </details>
+        </div>
+      </div>
+      <aside class="sidebar">
+        <div class="sidebar-card">
+          <h2>GSD execution brief</h2>
+          <p>This guide explains the structural boundary between prompt-level guidelines and protocol-level pre-action gates to help teams move from advisory rules to hard enforcement.</p>
+          <p><strong>Opportunity score:</strong> 92</p>
+          <p><strong>Primary persona:</strong> security-engineer</p>
+          <p><strong>Keyword cluster:</strong> pretooluse hooks vs advisory prompt rules, claude code security, cursor rules bypass, mcp security</p>
+          <p><strong>Pricing:</strong> Pro $19/mo or $149/yr. Team $49/seat/mo.</p>
+          <div class="proof-links">
+            <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
+            <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/proof/automation/report.json" target="_blank" rel="noopener">Automation proof</a>
+            <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub repository</a>
+          </div>
+          <a class="cta-button" href="/checkout/pro?utm_source=website&amp;utm_medium=seo_page&amp;utm_campaign=guides_pretooluse-hooks-vs-advisory-prompt-rules&amp;cta_placement=seo_brief&amp;plan_id=pro" target="_blank" rel="noopener">Go Pro — $19/mo</a>
+        </div>
+        <div class="sidebar-card">
+          <h2>Related pages</h2>
+          <a class="related-card" href="/guides/pre-action-checks">
+            <span class="related-label">Related page</span>
+            <strong>What Are Pre-Action Checks?</strong>
+          </a>
+          <a class="related-card" href="/guides/claude-code-feedback">
+            <span class="related-label">Related page</span>
+            <strong>Claude Code Feedback Memory That Enforces</strong>
+          </a>
+        </div>
+      </aside>
+    </section>
+  </main>
+</body>
+</html>