npm - thumbgate - Versions diffs - 1.28.4 → 1.29.2 - Mend

thumbgate 1.28.4 → 1.29.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (87) hide show

package/.claude/commands/dashboard.md +11 -1
package/.claude/commands/thumbgate-dashboard.md +23 -8
package/.claude-plugin/plugin.json +1 -1
package/.well-known/llms.txt +18 -10
package/.well-known/mcp/server-card.json +1 -1
package/README.md +66 -3
package/adapters/claude/.mcp.json +2 -2
package/adapters/forge/forge.yaml +3 -3
package/adapters/mcp/server-stdio.js +88 -2
package/adapters/opencode/opencode.json +1 -1
package/bin/cli.js +8 -8
package/bin/postinstall.js +4 -13
package/commands/dashboard.md +11 -1
package/commands/thumbgate-dashboard.md +23 -8
package/config/agent-outcome-monitor-thresholds.json +63 -0
package/config/evals/agent-outcomes-baseline.json +17 -0
package/config/evals/agent-outcomes-golden.json +412 -0
package/config/evals/prompt-eval-baseline.json +23 -0
package/config/github-about.json +5 -4
package/config/post-deploy-marketing-pages.json +6 -6
package/config/schemas/task-outcome-receipt.schema.json +296 -0
package/docs/integrations/grafana/README.md +109 -0
package/docs/integrations/grafana/thumbgate-revenue-evidence-dashboard.json +1930 -0
package/openapi/openapi.yaml +475 -5
package/package.json +75 -22
package/public/agent-manager.html +10 -11
package/public/agents-cost-savings.html +2 -2
package/public/assets/brand/thumbgate-logo-transparent.svg +6 -11
package/public/assets/brand/thumbgate-mark-inline-v3.svg +11 -10
package/public/assets/brand/thumbgate-mark.svg +10 -11
package/public/blog/inside-your-boundary.html +114 -0
package/public/blog/process-over-outcome-gates.html +119 -0
package/public/blog.html +296 -402
package/public/brand/thumbgate-mark.svg +5 -9
package/public/codex-enterprise.html +2 -2
package/public/compare.html +12 -3
package/public/diagnostic.html +79 -29
package/public/guide.html +4 -4
package/public/index.html +1090 -2098
package/public/install.html +3 -3
package/public/js/buyer-intent.js +33 -18
package/public/numbers.html +2 -2
package/public/pricing.html +268 -408
package/public/pro.html +4 -4
package/scripts/agent-outcome-eval.js +130 -0
package/scripts/agent-outcome-monitor.js +261 -0
package/scripts/agent-reasoning-traces.js +8 -9
package/scripts/async-job-runner.js +107 -13
package/scripts/billing.js +456 -126
package/scripts/buyer-paths.js +102 -0
package/scripts/cli-feedback.js +2 -2
package/scripts/commercial-offer.js +18 -10
package/scripts/durability/step.js +121 -12
package/scripts/external-customer-audit.js +881 -0
package/scripts/feedback-loop.js +26 -0
package/scripts/gates-engine.js +554 -19
package/scripts/grafana-revenue-evidence.js +856 -0
package/scripts/human-escalation.js +265 -0
package/scripts/hybrid-feedback-context.js +93 -50
package/scripts/jsonl-window.js +89 -0
package/scripts/judge-reward-function.js +30 -18
package/scripts/lesson-embedding-index.js +3 -7
package/scripts/meta-agent-loop.js +20 -2
package/scripts/observability-env.js +139 -0
package/scripts/observability-setup.js +55 -0
package/scripts/plausible-domain-config.js +4 -0
package/scripts/prompt-eval.js +81 -4
package/scripts/provider-live-evidence.js +1290 -0
package/scripts/provider-payment-reconciler.js +442 -0
package/scripts/provider-revenue-evidence.js +249 -0
package/scripts/rate-limiter.js +1 -5
package/scripts/revenue-action-eligibility.js +414 -0
package/scripts/revenue-evidence-remediation.js +694 -0
package/scripts/revenue-offer-system.js +709 -0
package/scripts/sales-pipeline.js +1117 -0
package/scripts/schedule-manager.js +249 -0
package/scripts/seo-gsd.js +8 -4
package/scripts/stripe-credentials.js +37 -0
package/scripts/stripe-revenue-catalog-audit.js +363 -0
package/scripts/stripe-revenue-catalog.js +164 -0
package/scripts/task-outcomes.js +425 -0
package/scripts/telemetry-analytics.js +23 -3
package/scripts/tool-contract-validator.js +287 -59
package/scripts/tool-registry.js +143 -0
package/scripts/vector-store.js +83 -7
package/scripts/workflow-intake-queue.js +483 -0
package/src/api/server.js +647 -118

package/public/blog/inside-your-boundary.html ADDED Viewed

@@ -0,0 +1,114 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>AI inside your boundary: governance without relaxing controls | ThumbGate</title>
+  <meta name="description" content="Enterprises should not trade security exceptions for agent speed. ThumbGate runs pre-action checks and reviewable lessons locally—starting with one high-stakes workflow." />
+  <meta property="og:title" content="AI inside your boundary: governance without relaxing controls" />
+  <meta property="og:description" content="Local pre-action checks, audit-ready decisions, and a $499 managed gate for one workflow." />
+  <meta property="og:type" content="article" />
+  <meta property="og:url" content="https://thumbgate.ai/blog/inside-your-boundary" />
+  <link rel="canonical" href="https://thumbgate.ai/blog/inside-your-boundary" />
+  <link rel="icon" type="image/png" href="/thumbgate-icon.png" />
+  <meta property="og:image" content="https://thumbgate.ai/og.png" />
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@type": "BlogPosting",
+    "headline": "AI inside your boundary: governance without relaxing controls",
+    "datePublished": "2026-07-23",
+    "author": { "@type": "Organization", "name": "ThumbGate" },
+    "publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate.ai" },
+    "mainEntityOfPage": "https://thumbgate.ai/blog/inside-your-boundary",
+    "description": "Local pre-action checks and one managed workflow gate so teams keep agent speed without permanent security exceptions."
+  }
+  </script>
+  <style>
+    :root { color-scheme: dark; --bg:#080b10; --panel:#111722; --text:#f5f7fb; --muted:#9ca8ba; --line:#273246; --cyan:#38d7ff; --green:#56e39f; --max:760px; }
+    * { box-sizing: border-box; }
+    body { margin:0; color:var(--text); background:var(--bg); font:16px/1.7 Inter,ui-sans-serif,system-ui,-apple-system,sans-serif; }
+    a { color:var(--cyan); }
+    .shell { width:min(calc(100% - 40px),var(--max)); margin:0 auto; }
+    header { padding:22px 0; border-bottom:1px solid var(--line); }
+    header a { color:var(--muted); text-decoration:none; font-weight:700; }
+    .brand { color:var(--text); font-weight:850; text-decoration:none; }
+    article { padding:48px 0 80px; }
+    .meta { color:var(--muted); font:700 12px/1.2 ui-monospace,Menlo,monospace; letter-spacing:.08em; text-transform:uppercase; }
+    h1 { margin:14px 0 18px; font-size:clamp(32px,5vw,46px); line-height:1.08; letter-spacing:-.04em; }
+    h2 { margin:36px 0 12px; font-size:24px; letter-spacing:-.03em; }
+    p, li { color:var(--muted); }
+    p { margin:0 0 16px; }
+    ul, ol { margin:0 0 18px; padding-left:1.2em; }
+    li { margin-bottom:8px; }
+    strong { color:var(--text); }
+    .callout { margin:24px 0; padding:16px 18px; border-left:3px solid var(--green); background:rgba(86,227,159,.07); color:var(--muted); }
+    .cta { display:inline-flex; margin-top:8px; margin-right:10px; padding:12px 18px; border-radius:10px; background:var(--green); color:#06130d; font-weight:850; text-decoration:none; }
+    code { color:var(--cyan); font-family:ui-monospace,Menlo,monospace; font-size:0.95em; }
+    footer { padding:28px 0 48px; border-top:1px solid var(--line); color:var(--muted); font-size:13px; }
+  </style>
+</head>
+<body>
+  <header>
+    <div class="shell" style="display:flex;justify-content:space-between;gap:16px;align-items:center;">
+      <a class="brand" href="/blog">ThumbGate / Blog</a>
+      <a href="/diagnostic">$499 workflow gate</a>
+    </div>
+  </header>
+  <article class="shell">
+    <div class="meta">2026-07-23 · Inside your boundary</div>
+    <h1>AI inside your boundary: governance without relaxing controls</h1>
+    <p>
+      Enterprise AI platforms now lead with a blunt line: run agents <strong>inside your security boundary</strong>, with auditability and governance, instead of permanent exceptions to “keep up.” That demand is real. ThumbGate’s answer is not another model API. It is a <strong>local pre-action control plane</strong> for the coding agents teams already run.
+    </p>
+    <h2>Who this is for</h2>
+    <p>
+      Engineering and security leads whose approved base images, network rules, and CISO policies are not optional theater. Teams that already use Claude Code, Cursor, Codex, or similar agents after a real workflow failure—and cannot accept “trust the prompt” as the only control.
+    </p>
+    <div class="callout">
+      Vendors should not require enterprises to relax well-established practice for agent speed. Local gates, reviewable lessons, and explicit ALLOW / WARN / DENY decisions are how you keep both.
+    </div>
+    <h2>What “inside your boundary” means for ThumbGate</h2>
+    <ul>
+      <li><strong>Local-first checks</strong> — PreToolUse hooks evaluate the proposed tool call on the machine or in the lane you control.</li>
+      <li><strong>Lessons stay reviewable</strong> — thumbs become local lessons; relevant lessons are re-ranked for the next action; repeated failures can promote into gates; stale auto-promoted gates expire.</li>
+      <li><strong>Honest default enforcement</strong> — detected secret exfiltration and gate-bypass attempts are denied by default; many other matches warn unless strict mode is enabled.</li>
+      <li><strong>Decision receipts</strong> — blocks and warnings name the matched rule and leave a trail reviewers can inspect.</li>
+    </ul>
+    <p>
+      We do not claim a full air-gapped multi-cloud agent OS on day one. We claim a sharp execution boundary for coding-agent tool calls—and a managed way to install the first hard gate where it hurts.
+    </p>
+    <h2>Land on one high-stakes problem</h2>
+    <p>
+      Platform vendors talk about forward-deployed motion. Our cash path is deliberately small:
+    </p>
+    <ol>
+      <li><strong>One workflow</strong> with a repeated AI-agent failure.</li>
+      <li><strong>One configured local gate</strong> with a regression test.</li>
+      <li><strong>Rollout and rollback proof</strong> within two business days after access and materials are available.</li>
+    </ol>
+    <p>
+      That is the $499 Enterprise Workflow Gate—not an org-wide hosted license. Shared hosting, SSO, compliance packaging, and multi-workflow rollout stay separate scope. If the failure cannot reduce to one supported gate, the order is refunded instead of silently upsold.
+    </p>
+    <h2>Start without a procurement cycle</h2>
+    <p>
+      Free local evaluate: <code>npx thumbgate init</code>. Prove one caught repeat. When the pain is real and shared, buy the managed gate for that workflow.
+    </p>
+    <p>
+      <a class="cta" href="/#buy">Buy the $499 enterprise gate →</a>
+      <a class="cta" href="/guide" style="background:transparent;border:1px solid var(--cyan);color:var(--cyan);">Setup guide →</a>
+    </p>
+  </article>
+  <footer>
+    <div class="shell">
+      <a href="/blog">← All posts</a> ·
+      <a href="/diagnostic">Diagnostic / offer detail</a> ·
+      <a href="/">Home</a>
+    </div>
+  </footer>
+</body>
+</html>

package/public/blog/process-over-outcome-gates.html ADDED Viewed

@@ -0,0 +1,119 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Process over outcome: gates for self-improving coding loops | ThumbGate</title>
+  <meta name="description" content="Self-improving coding agents can game metrics and skip proof. ThumbGate gates the process—holdouts, receipts, and known-bad promotions—before the claim lands." />
+  <meta property="og:title" content="Process over outcome: gates for self-improving coding loops" />
+  <meta property="og:description" content="Outcome metrics alone are not enough. Gate the process when agents optimize for done." />
+  <meta property="og:type" content="article" />
+  <meta property="og:url" content="https://thumbgate.ai/blog/process-over-outcome-gates" />
+  <link rel="canonical" href="https://thumbgate.ai/blog/process-over-outcome-gates" />
+  <link rel="icon" type="image/png" href="/thumbgate-icon.png" />
+  <meta property="og:image" content="https://thumbgate.ai/og.png" />
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@type": "BlogPosting",
+    "headline": "Process over outcome: gates for self-improving coding loops",
+    "datePublished": "2026-07-23",
+    "author": { "@type": "Organization", "name": "ThumbGate" },
+    "publisher": { "@type": "Organization", "name": "ThumbGate", "url": "https://thumbgate.ai" },
+    "mainEntityOfPage": "https://thumbgate.ai/blog/process-over-outcome-gates",
+    "description": "Self-improving coding agents can game metrics and skip proof. Gate the process before the claim lands."
+  }
+  </script>
+  <style>
+    :root { color-scheme: dark; --bg:#080b10; --panel:#111722; --text:#f5f7fb; --muted:#9ca8ba; --line:#273246; --cyan:#38d7ff; --green:#56e39f; --max:760px; }
+    * { box-sizing: border-box; }
+    body { margin:0; color:var(--text); background:var(--bg); font:16px/1.7 Inter,ui-sans-serif,system-ui,-apple-system,sans-serif; }
+    a { color:var(--cyan); }
+    .shell { width:min(calc(100% - 40px),var(--max)); margin:0 auto; }
+    header { padding:22px 0; border-bottom:1px solid var(--line); }
+    header a { color:var(--muted); text-decoration:none; font-weight:700; }
+    header a:hover { color:var(--text); }
+    .brand { color:var(--text); font-weight:850; text-decoration:none; }
+    article { padding:48px 0 80px; }
+    .meta { color:var(--muted); font:700 12px/1.2 ui-monospace,Menlo,monospace; letter-spacing:.08em; text-transform:uppercase; }
+    h1 { margin:14px 0 18px; font-size:clamp(32px,5vw,46px); line-height:1.08; letter-spacing:-.04em; }
+    h2 { margin:36px 0 12px; font-size:24px; letter-spacing:-.03em; }
+    p, li { color:var(--muted); }
+    p { margin:0 0 16px; }
+    ul { margin:0 0 18px; padding-left:1.2em; }
+    li { margin-bottom:8px; }
+    strong { color:var(--text); }
+    .callout { margin:24px 0; padding:16px 18px; border-left:3px solid var(--cyan); background:rgba(56,215,255,.06); color:var(--muted); }
+    .cta { display:inline-flex; margin-top:8px; padding:12px 18px; border-radius:10px; background:var(--green); color:#06130d; font-weight:850; text-decoration:none; }
+    code { color:var(--cyan); font-family:ui-monospace,Menlo,monospace; font-size:0.95em; }
+    footer { padding:28px 0 48px; border-top:1px solid var(--line); color:var(--muted); font-size:13px; }
+  </style>
+</head>
+<body>
+  <header>
+    <div class="shell" style="display:flex;justify-content:space-between;gap:16px;align-items:center;">
+      <a class="brand" href="/blog">ThumbGate / Blog</a>
+      <a href="/guides/autoresearch-agent-safety">Autoresearch guide</a>
+    </div>
+  </header>
+  <article class="shell">
+    <div class="meta">2026-07-23 · Process over outcome</div>
+    <h1>Process over outcome: gates for self-improving coding loops</h1>
+    <p>
+      Frontier labs are publishing the same uncomfortable finding from the training side: when agents have a large action space, <strong>outcome reward alone stops being a sufficient metric</strong>. They mine git history, scrape reference solutions, and optimize the score instead of the work. The same failure mode shows up in day-to-day coding agents—just with different costumes: skipped tests, edited metrics, force-pushed “fixes,” and “done” claims without receipts.
+    </p>
+    <p>
+      ThumbGate is not a training stack. It is a <strong>self-improving firewall</strong> for the execution boundary. This post is about why that distinction matters when agents start improving themselves.
+    </p>
+    <h2>What “process over outcome” means at the tool call</h2>
+    <p>
+      Outcome-only control asks: did the benchmark pass? Did the PR open? Did the agent say it finished?
+      Process control asks: what path did it take, what evidence is required, and is this a known-bad promotion pattern?
+    </p>
+    <div class="callout">
+      If the only signal is “it worked,” a capable agent will eventually find a cheaper path to that label—including paths you would never accept from a human engineer.
+    </div>
+    <p>Concrete process checks ThumbGate is built to support:</p>
+    <ul>
+      <li><strong>Holdout / proof gates</strong> — do not promote a claimed improvement without required verification evidence.</li>
+      <li><strong>Known-bad promotions</strong> — flag patterns like metric editing, missing holdouts, or hidden failed runs (see the Autoresearch safety pack).</li>
+      <li><strong>PreToolUse decisions</strong> — ALLOW / WARN / DENY before shell, file, git, deploy, or API actions execute.</li>
+      <li><strong>Reviewable lessons</strong> — thumbs become local memory; repeated negative patterns can promote into gates; stale auto-promoted gates expire.</li>
+    </ul>
+    <h2>Self-improving firewall ≠ self-improving weights</h2>
+    <p>
+      Poolside-style research posts on reward hacking are about training loops. Our product claim is narrower and operational:
+    </p>
+    <ul>
+      <li>We do <strong>not</strong> retrain your model from thumbs.</li>
+      <li>We <strong>do</strong> store feedback as local lessons, re-rank relevant lessons for the next action, and promote repeated failures into prevention gates.</li>
+      <li>We <strong>do</strong> hard-block detected secret exfiltration and gate-bypass attempts by default; most other matches warn unless strict enforcement is on.</li>
+    </ul>
+    <p>
+      That is how the control layer improves over time without pretending every free install is a perfect firewall—or that every agent claim is honest.
+    </p>
+    <h2>What to do this week</h2>
+    <ol>
+      <li>Install local checks: <code>npx thumbgate init</code></li>
+      <li>Pick one self-improving or “autonomous fix” workflow that already burned you.</li>
+      <li>Require process evidence (tests, holdout, screenshot, CI) before the agent can claim done.</li>
+      <li>If you want a managed boundary for that one workflow, use the $499 Enterprise Workflow Gate.</li>
+    </ol>
+    <p>
+      <a class="cta" href="/guides/autoresearch-agent-safety">Open the Autoresearch safety guide →</a>
+      &nbsp;
+      <a class="cta" href="/#buy" style="background:transparent;border:1px solid var(--green);color:var(--green);">Buy the $499 gate →</a>
+    </p>
+  </article>
+  <footer>
+    <div class="shell">
+      <a href="/blog">← All posts</a> ·
+      <a href="/learn/feedback-loop-vs-decision-layer">Feedback loop vs decision layer</a> ·
+      <a href="/">Home</a>
+    </div>
+  </footer>
+</body>
+</html>