thumbgate 1.28.3 → 1.28.4

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.28.3",
+  "version": "1.28.4",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.28.3",
+  "version": "1.28.4",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate.ai",
   "transport": "stdio",

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.28.3", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.28.4", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.28.3", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.28.4", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/forge/forge.yaml

@@ -9,12 +9,12 @@ version: "1"
 skills:
   thumbgate-gate-check:
     description: "ThumbGate PreToolUse gate — blocks known-bad tool calls"
-    command: "npx --yes --package thumbgate@0.9.13 thumbgate gate-check"
+    command: "npx --yes --package thumbgate@1.28.4 thumbgate gate-check"
     trigger: pre_tool_use
 
   thumbgate-feedback:
     description: "ThumbGate feedback capture — logs user prompt context"
-    command: "npx --yes --package thumbgate@0.9.13 thumbgate hook-auto-capture"
+    command: "npx --yes --package thumbgate@1.28.4 thumbgate hook-auto-capture"
     trigger: user_prompt
 
 mcp:
@@ -23,6 +23,6 @@ mcp:
     args:
       - "--yes"
       - "--package"
-      - "thumbgate@0.9.13"
+      - "thumbgate@1.28.4"
       - "thumbgate"
       - "serve"

package/adapters/mcp/server-stdio.js

@@ -305,7 +305,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.28.3' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.28.4' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.28.3",
+        "thumbgate@1.28.4",
         "thumbgate",
         "serve"
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.28.3",
+  "version": "1.28.4",
   "description": "ThumbGate Pre-Action Checks derive rules from repeated failures, flag risky tool calls, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {

package/public/index.html

@@ -20,7 +20,7 @@ __GOOGLE_SITE_VERIFICATION_META__
 <meta property="og:image" content="https://thumbgate.ai/og.png">
 <meta name="twitter:card" content="summary_large_image">
 <meta name="twitter:image" content="https://thumbgate.ai/og.png">
-<meta name="thumbgate-version" content="1.28.3">
+<meta name="thumbgate-version" content="1.28.4">
 <meta name="keywords" content="ThumbGate, thumbgate, AI agent orchestration, AI experience orchestration, agentic development cycle, AC/DC framework, Guide Generate Verify Solve, agent enforcement layer, pre-action checks, agent governance, Claude Code, Cursor, Codex, Gemini, Amp, Cline, OpenCode, workflow hardening, context engineering, AI authenticity, brand authenticity AI">
 <link rel="canonical" href="__APP_ORIGIN__/">
 <link rel="alternate" type="text/markdown" title="ThumbGate LLM context" href="__APP_ORIGIN__/llm-context.md">
@@ -1776,7 +1776,7 @@ __GA_BOOTSTRAP__
       <a href="https://www.linkedin.com/in/igorganapolsky" target="_blank" rel="noopener">LinkedIn</a>
       <a href="/blog">Blog</a>
     </div>
-    <span class="footer-copy">© 2026 ThumbGate · MIT License · npm v1.28.3</span>
+    <span class="footer-copy">© 2026 ThumbGate · MIT License · npm v1.28.4</span>
   </div>
 </footer>
 

package/public/numbers.html

@@ -25,7 +25,7 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.28.3",
+  "softwareVersion": "1.28.4",
   "url": "https://thumbgate.ai/numbers",
   "dateModified": "2026-05-07",
   "creator": {
@@ -202,7 +202,7 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-05-07 · Version 1.28.3</div>
+  <div class="freshness">Updated: 2026-05-07 · Version 1.28.4</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>

package/scripts/cli-feedback.js

@@ -118,7 +118,9 @@ function formatCliOutput(result) {
     }
     if (feedbackResult.promoted === false || !memoryId) {
       const clarification = feedbackResult.prompt || feedbackResult.message || feedbackResult.reason;
-      lines.push(`${D}  Reusable memory: not created${clarification ? ` — ${clarification}` : ''}${RST}`);
+      let reusableMemoryLine = `${D}  Reusable memory: not created`;
+      if (clarification) reusableMemoryLine += ` — ${clarification}`;
+      lines.push(`${reusableMemoryLine}${RST}`);
     }
   } else {
     lines.push(`${R}Feedback not accepted: ${feedbackResult?.reason || 'unknown'}${RST}`);

package/scripts/feedback-loop.js

@@ -94,7 +94,9 @@ function emitAnonymousFeedbackPing(signal) {
       return;
     }
 
-    const normalizedSignal = signal === 'positive' ? 'up' : signal === 'negative' ? 'down' : null;
+    let normalizedSignal = null;
+    if (signal === 'positive') normalizedSignal = 'up';
+    if (signal === 'negative') normalizedSignal = 'down';
     if (!normalizedSignal) return;
 
     // Reuse the canonical installId from cli-telemetry.js (persisted at
@@ -105,24 +107,24 @@ function emitAnonymousFeedbackPing(signal) {
     try {
       const { getInstallId } = require('./cli-telemetry');
       installId = getInstallId();
-    } catch (_) { /* fall through */ }
+    } catch {
+      installId = null;
+    }
     if (!installId) {
-      try {
-        installId = require('crypto').randomUUID();
-      } catch (_) {
-        return; // no crypto, no install id → drop silently
-      }
+      installId = crypto.randomUUID();
     }
 
     let tier = 'free';
     try {
       const { getStatuslineMeta } = require('./statusline-meta');
       const meta = getStatuslineMeta({ env });
-      const rawTier = String(meta && meta.tier ? meta.tier : 'free').toLowerCase();
+      const rawTier = String(meta?.tier || 'free').toLowerCase();
       if (rawTier === 'pro' || rawTier === 'enterprise' || rawTier === 'free') {
         tier = rawTier;
       }
-    } catch (_) { /* default to 'free' */ }
+    } catch {
+      tier = 'free';
+    }
 
     const base = env.THUMBGATE_PUBLIC_APP_ORIGIN
       || env.THUMBGATE_API_URL
@@ -141,13 +143,17 @@ function emitAnonymousFeedbackPing(signal) {
     if (typeof fetch !== 'function' || typeof AbortSignal === 'undefined' || typeof AbortSignal.timeout !== 'function') {
       return;
     }
-    fetch(`${base.replace(/\/+$/, '')}/v1/telemetry/ping`, {
+    let appOrigin = String(base);
+    while (appOrigin.endsWith('/')) appOrigin = appOrigin.slice(0, -1);
+    void fetch(`${appOrigin}/v1/telemetry/ping`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body,
       signal: AbortSignal.timeout(2000),
-    }).catch(() => { /* fire-and-forget */ });
-  } catch (_) { /* telemetry must never disrupt CLI */ }
+    }).catch(() => undefined);
+  } catch {
+    return;
+  }
 }
 
 function isAuditTrailEntry(entry = {}) {
@@ -1793,7 +1799,7 @@ function captureFeedback(params) {
         // AGENTS.md/GEMINI.md merely because a negative rule was promoted.
         if (isSelfHarnessOptimizerEnabled()) {
           try {
-            const { fork } = require('child_process');
+            const { fork } = require('node:child_process');
             const localOptimizerPath = path.join(process.cwd(), 'scripts', 'self-harness-optimizer.js');
             const packageOptimizerPath = path.join(__dirname, 'self-harness-optimizer.js');
 
@@ -1820,8 +1826,9 @@ function captureFeedback(params) {
             feedbackDir: FEEDBACK_DIR,
             outputDir: process.env.THUMBGATE_OBSIDIAN_VAULT_PATH,
           });
-        } catch (_err) {
-          // Non-critical, do not crash feedback loop
+        } catch {
+          resolve();
+          return;
         }
         resolve();
       });
@@ -2511,6 +2518,7 @@ function buildCorrectiveActionsReminder(correctiveActions = []) {
 
 module.exports = {
   captureFeedback: captureFeedbackIdempotent,
+  emitAnonymousFeedbackPing,
   buildFeedbackSourceIdentity,
   compactMemories,
   buildCorrectiveActionsReminder,

package/scripts/workflow-sentinel.js

@@ -3,7 +3,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execFileSync } = require('child_process');
+const { execFileSync } = require('node:child_process');
 
 const {
   DEFAULT_BASE_BRANCH,
@@ -90,7 +90,9 @@ function safeExecFileLines(binary, args, cwd) {
 }
 
 function normalizeGlob(glob) {
-  return normalizePosix(glob).replace(/\/+$/, '');
+  let normalized = normalizePosix(glob);
+  while (normalized.endsWith('/')) normalized = normalized.slice(0, -1);
+  return normalized;
 }
 
 function sanitizeGlobList(globs) {