thumbgate 1.31.0 → 1.34.1

package/public/numbers.html

@@ -10,12 +10,12 @@
 <meta property="og:title" content="ThumbGate — The Numbers">
 <meta property="og:description" content="Generated first-party operational snapshot: configured gates, recorded interventions, and explicit zero-evidence caveats.">
 <meta property="og:type" content="website">
-<meta property="og:url" content="https://thumbgate.ai/numbers">
+<meta property="og:url" content="https://thumbgate-production.up.railway.app/numbers">
 <meta name="twitter:card" content="summary_large_image">
-<link rel="canonical" href="https://thumbgate.ai/numbers">
+<link rel="canonical" href="https://thumbgate-production.up.railway.app/numbers">
 <link rel="icon" type="image/png" href="/thumbgate-icon.png">
 <link rel="apple-touch-icon" href="/apple-touch-icon.png">
-<script defer data-domain="thumbgate.ai" src="https://plausible.io/js/script.js"></script>
+<script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
 
 <script type="application/ld+json">
 {
@@ -25,9 +25,9 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.31.0",
-  "url": "https://thumbgate.ai/numbers",
-  "dateModified": "2026-05-07",
+  "softwareVersion": "1.34.1",
+  "url": "https://thumbgate-production.up.railway.app/numbers",
+  "dateModified": "2026-08-03",
   "creator": {
     "@type": "Person",
     "name": "Igor Ganapolsky",
@@ -46,7 +46,7 @@
   "@type": "Dataset",
   "name": "ThumbGate Operational Snapshot",
   "description": "First-party operational snapshot from the ThumbGate pre-action check runtime: configured checks, recorded block/warn events, estimated token savings from recorded blocks, and Bayes error rate when the sample supports it.",
-  "url": "https://thumbgate.ai/numbers",
+  "url": "https://thumbgate-production.up.railway.app/numbers",
   "license": "https://opensource.org/licenses/MIT",
   "creator": {
     "@type": "Person",
@@ -57,8 +57,8 @@
       "https://www.linkedin.com/in/igorganapolsky"
     ]
   },
-  "dateModified": "2026-05-07",
-  "datePublished": "2026-05-07",
+  "dateModified": "2026-08-03",
+  "datePublished": "2026-08-03",
   "keywords": [
     "AI agent gates",
     "LLM token savings",
@@ -70,7 +70,7 @@
     {
       "@type": "PropertyValue",
       "name": "configured_gates",
-      "value": 36
+      "value": 40
     },
     {
       "@type": "PropertyValue",
@@ -195,7 +195,6 @@
   <a href="/learn">Learn</a>
   <a href="/compare">Compare</a>
   <a href="/numbers">Numbers</a>
-  <a href="/evaluations">Evaluations</a>
   <a href="/dashboard">Dashboard</a>
   <a href="/pro">Pro</a>
 </nav>
@@ -203,15 +202,15 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-05-07 · Version 1.31.0</div>
+  <div class="freshness">Updated: 2026-08-03 · Version 1.34.1</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>
   <div class="stats-grid">
     <div class="stat-card">
       <div class="stat-label">Configured checks</div>
-      <div class="stat-value">36</div>
-      <div class="stat-sub">36 shipped defaults · 0 auto-promoted; inventory, not usage</div>
+      <div class="stat-value">40</div>
+      <div class="stat-sub">40 shipped defaults · 0 auto-promoted; inventory, not usage</div>
       <a class="stat-source" href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/scripts/gate-stats.js">source: gate-stats.js</a>
     </div>
     <div class="stat-card">
@@ -278,7 +277,7 @@
   <div class="cta">
     <a href="https://www.npmjs.com/package/thumbgate">Install ThumbGate — npx thumbgate init</a>
     <div class="footer-note">Prefer the raw feed? See <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> or run <code>npm run gate:stats</code> locally.</div>
-    <div class="footer-note">Generated at 2026-05-07T14:59:51.816Z UTC.</div>
+    <div class="footer-note">Generated at 2026-08-03T05:26:21.201Z UTC.</div>
   </div>
 </main>
 </body>

package/scripts/agent-readiness.js

@@ -165,6 +165,95 @@ function summarizePermissionTier(profileName = getActiveMcpProfile()) {
   };
 }
 
+
+function detectStopHookRegistered(projectRoot, existsSync, readFileSync) {
+  try {
+    const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
+    if (!existsSync(settingsPath)) return false;
+    const settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+    const stopHooks = settings?.hooks?.Stop || [];
+    const flat = Array.isArray(stopHooks)
+      ? stopHooks.flatMap((entry) => entry?.hooks || [entry])
+      : [];
+    return flat.some((hook) => String(hook?.command || '').includes('hook-stop-anti-claim'));
+  } catch {
+    return false;
+  }
+}
+
+function recommendationForClaimState({
+  evaluatorReady,
+  configLoadFailed,
+  verifierCount,
+  stopHookRegistered,
+  configSource,
+  loadErrorMessage,
+}) {
+  if (!evaluatorReady) {
+    return 'Universal claim evaluator module is missing from this install.';
+  }
+  if (configLoadFailed) {
+    return loadErrorMessage;
+  }
+  if (verifierCount === 0) {
+    return 'No claim verifiers configured. Copy config/gates/claim-verifiers.example.json to .thumbgate/claim-verifiers.json and point subjects at your sources of truth.';
+  }
+  if (!stopHookRegistered) {
+    return 'Claim verifiers are present, but the Claude Stop anti-claim hook is not registered in .claude/settings.json.';
+  }
+  return `Factual claim recheck is ready (${verifierCount} verifier(s) from ${configSource}).`;
+}
+
+function summarizeClaimVerification(projectRoot = PROJECT_ROOT, deps = {}) {
+  const resolveEvaluator = deps.resolveEvaluator
+    || (() => require.resolve('./universal-claim-evaluator'));
+  const loadVerifierConfig = deps.loadVerifierConfig
+    || (() => require('./universal-claim-evaluator').loadVerifierConfig);
+  const readFileSync = deps.readFileSync || fs.readFileSync;
+  const existsSync = deps.existsSync || fs.existsSync;
+
+  let evaluatorReady = false;
+  try {
+    resolveEvaluator();
+    evaluatorReady = true;
+  } catch {
+    evaluatorReady = false;
+  }
+
+  let verifierCount = 0;
+  let configSource = 'none';
+  let configLoadFailed = false;
+  let loadErrorMessage = 'Install ThumbGate and configure claim verifiers under .thumbgate/claim-verifiers.json.';
+  try {
+    const loaded = loadVerifierConfig()({ cwd: projectRoot });
+    verifierCount = Array.isArray(loaded.verifiers) ? loaded.verifiers.length : 0;
+    configSource = loaded.source || 'none';
+  } catch (error) {
+    configLoadFailed = true;
+    loadErrorMessage = `Claim verifier config failed to load: ${error?.message || 'unknown error'}`;
+  }
+
+  const stopHookRegistered = detectStopHookRegistered(projectRoot, existsSync, readFileSync);
+  const recommendation = recommendationForClaimState({
+    evaluatorReady,
+    configLoadFailed,
+    verifierCount,
+    stopHookRegistered,
+    configSource,
+    loadErrorMessage,
+  });
+
+  return {
+    ready: evaluatorReady && verifierCount > 0 && stopHookRegistered && !configLoadFailed,
+    evaluatorReady,
+    verifierCount,
+    configSource,
+    stopHookRegistered,
+    configLoadFailed,
+    recommendation,
+  };
+}
+
 function generateAgentReadinessReport({
   projectRoot = PROJECT_ROOT,
   mcpProfile = null,
@@ -172,11 +261,18 @@ function generateAgentReadinessReport({
   const runtime = detectRuntimeIsolation();
   const bootstrap = collectBootstrapFiles(projectRoot);
   const permissions = summarizePermissionTier(mcpProfile || getActiveMcpProfile());
+  const claimVerification = summarizeClaimVerification(projectRoot);
 
   const warnings = [];
   if (!runtime.isolated) warnings.push(runtime.recommendation);
   if (!bootstrap.ready) warnings.push(bootstrap.recommendation);
   if (!permissions.ready) warnings.push(permissions.recommendation);
+  // Missing operator verifiers is advisory (not every project asserts SQL row counts).
+  // A missing evaluator module or a broken claim-verifier config is not advisory —
+  // both make factual recheck fail closed at runtime and must surface here.
+  if (!claimVerification.evaluatorReady || claimVerification.configLoadFailed) {
+    warnings.push(claimVerification.recommendation);
+  }
 
   return {
     generatedAt: new Date().toISOString(),
@@ -185,10 +281,12 @@ function generateAgentReadinessReport({
     runtime,
     bootstrap,
     permissions,
+    claimVerification,
     articleAlignment: {
       runtimeIsolation: runtime.isolated,
       contextConditioning: bootstrap.ready,
       permissionEnvelope: permissions.ready,
+      factualClaimRecheck: claimVerification.ready,
     },
     warnings,
   };
@@ -208,6 +306,15 @@ function reportToText(report) {
   lines.push(`Permissions: ${report.permissions.profile} (${report.permissions.tier})`);
   lines.push(`  Write-capable tools: ${report.permissions.writeCapableTools.length}`);
   lines.push(`  Recommendation: ${report.permissions.recommendation}`);
+  if (report.claimVerification) {
+    lines.push(
+      `Claim verification: ${report.claimVerification.ready ? 'ready' : 'needs_attention'}`,
+      `  Evaluator: ${report.claimVerification.evaluatorReady ? 'present' : 'missing'}`,
+      `  Verifiers: ${report.claimVerification.verifierCount} (${report.claimVerification.configSource})`,
+      `  Stop hook: ${report.claimVerification.stopHookRegistered ? 'registered' : 'missing'}`,
+      `  Recommendation: ${report.claimVerification.recommendation}`,
+    );
+  }
 
   if (report.warnings.length > 0) {
     lines.push('');
@@ -226,6 +333,9 @@ module.exports = {
   detectRuntimeIsolation,
   collectBootstrapFiles,
   summarizePermissionTier,
+  summarizeClaimVerification,
+  recommendationForClaimState,
+  detectStopHookRegistered,
   generateAgentReadinessReport,
   reportToText,
 };

package/scripts/auto-wire-hooks.js

@@ -17,6 +17,7 @@ const fs = require('fs');
 const path = require('path');
 const {
   cacheUpdateHookCommand,
+  claimStopHookCommand,
   codexCacheUpdateHookCommand,
   codexPreToolHookCommand,
   codexSessionStartHookCommand,
@@ -36,7 +37,7 @@ function getHome() {
 // --- Hook definitions ---
 const CLAUDE_HOOKS = {
   PreToolUse: {
-    matcher: 'Bash|Edit|Write|MultiEdit',
+    matcher: '.*',
     hooks: [{ type: 'command', command: preToolHookCommand() }],
   },
   UserPromptSubmit: {
@@ -49,11 +50,14 @@ const CLAUDE_HOOKS = {
   SessionStart: {
     hooks: [{ type: 'command', command: sessionStartHookCommand() }],
   },
+  Stop: {
+    hooks: [{ type: 'command', command: claimStopHookCommand() }],
+  },
 };
 
 const CODEX_HOOKS = {
   PreToolUse: {
-    matcher: 'Bash',
+    matcher: '.*',
     hooks: [{ type: 'command', command: codexPreToolHookCommand() }],
   },
   UserPromptSubmit: {
@@ -384,6 +388,7 @@ function wireClaudeHooks(options) {
     UserPromptSubmit: /(hook-auto-capture\.sh|hook-auto-capture\b)/,
     PostToolUse: /(hook-thumbgate-cache-updater|cache-update\b)/,
     SessionStart: /(thumbgate_session_start\.sh|session-start\b)/,
+    Stop: /(hook-stop-anti-claim\.js|claim-stop-check\b)/,
   };
 
   for (const [lifecycle, hookDef] of Object.entries(CLAUDE_HOOKS)) {
@@ -456,8 +461,13 @@ function codexTomlConfigPath(configPath = codexConfigPath()) {
   return path.join(path.dirname(configPath), 'config.toml');
 }
 
+function escapeRegexLiteral(value) {
+  return String(value).replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+}
+
 function tomlSectionRegex(name) {
-  return new RegExp(`^\\[${String(name).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\$&')}\\]\\n(?:^(?!\\[).*(?:\\n|$))*`, 'm');
+  const sectionName = escapeRegexLiteral(name);
+  return new RegExp(String.raw`^\[${sectionName}\]\n(?:^(?!\[).*(?:\n|$))*`, 'm');
 }
 
 function codexUserPromptTomlBlock() {
@@ -470,10 +480,11 @@ function upsertCodexUserPromptToml(configPath, dryRun = false) {
   const current = fs.existsSync(tomlPath) ? fs.readFileSync(tomlPath, 'utf8') : '';
   const canonicalBlock = codexUserPromptTomlBlock();
   const sectionRegex = tomlSectionRegex('hooks.user_prompt_submit');
-  let next = current;
+  const existingMatch = sectionRegex.exec(current);
+  let next;
 
-  if (sectionRegex.test(current)) {
-    const existingBlock = current.match(sectionRegex)[0];
+  if (existingMatch) {
+    const existingBlock = existingMatch[0];
     if (existingBlock === canonicalBlock) {
       return { changed: false, settingsPath: tomlPath };
     }
@@ -610,7 +621,7 @@ function wireGeminiHooks(options) {
   if (!hookAlreadyPresent(settings.hooks.PreToolUse, preToolCmd)) {
     settings.hooks.PreToolUse = settings.hooks.PreToolUse || [];
     settings.hooks.PreToolUse.push({
-      matcher: 'Bash',
+      matcher: '.*',
       hooks: [{ type: 'command', command: preToolCmd }],
     });
     added.push({ lifecycle: 'PreToolUse', command: preToolCmd });
@@ -661,7 +672,7 @@ function wireForgeHooks(options) {
   if (!hookAlreadyPresent(existing.hooks.PreToolUse, preToolCmd)) {
     existing.hooks.PreToolUse = existing.hooks.PreToolUse || [];
     existing.hooks.PreToolUse.push({
-      matcher: 'Bash',
+      matcher: '.*',
       hooks: [{ type: 'command', command: preToolCmd }],
     });
     added.push({ lifecycle: 'PreToolUse', command: preToolCmd });
@@ -765,6 +776,7 @@ module.exports = {
   pruneStaleHooksInFile,
   CLAUDE_HOOKS,
   preToolHookCommand,
+  claimStopHookCommand,
   userPromptHookCommand,
   sessionStartHookCommand,
 };

package/scripts/cli-schema.js

@@ -505,6 +505,20 @@ const CLI_COMMANDS = [
     group: 'gates',
     flags: [],
   },
+  {
+    name: 'verify-claims',
+    aliases: ['verify-claim'],
+    description: 'Recheck factual claims against configured SQLite, filesystem, and JSON sources',
+    group: 'gates',
+    mcpTool: 'verify_claim',
+    flags: [
+      { name: 'claim', type: 'string', required: true, description: 'Factual claim text to verify' },
+      { name: 'config', type: 'string', description: 'Verifier config path (default .thumbgate/claim-verifiers.json)' },
+      { name: 'cwd', type: 'string', description: 'Root directory that contains configured sources' },
+      { name: 'advisory', type: 'boolean', description: 'Do not fail an otherwise parseable claim only because no verifier is configured' },
+      { name: 'json', type: 'boolean', description: 'Output a machine-readable verdict' },
+    ],
+  },
   {
     name: 'hermes-gate',
     description: 'Hermes Agent pre_tool_call hook: gate runtime tool calls (incl. skill_manage) before they run',

package/scripts/feedback-schema.js

@@ -31,6 +31,9 @@ const {
 } = require('./feedback-quality');
 
 const INFERRED_TAG_RULES = [
+  { tag: 'claw-style', keywords: ['claw', 'enterprise-claw', 'openshell', 'dynamic-tool', 'screen-interaction', 'computer-use'] },
+  { tag: 'hybrid-inference', keywords: ['hybrid', 'cloud-escalation', 'local-route', 'hybrid-route', 'perplexity-pc'] },
+  { tag: 'agent-identity', keywords: ['agent identity', 'audit trail', 'identity separation', 'agent-credential'] },
   { tag: 'thumbgate', keywords: ['thumbgate', 'feedback-loop', 'statusline', 'dashboard', 'mcp'] },
   { tag: 'testing', keywords: ['test', 'testing', 'jest', 'coverage', 'verify', 'verification'] },
   { tag: 'security', keywords: ['security', 'secret', 'credential', 'token', 'auth'] },

package/scripts/file-ledger-lock.js

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Cross-process lock for append-only local ledgers.
+ *
+ * `mkdir` is the atomic acquisition primitive. An owner record prevents a
+ * crashed process from permanently wedging the control plane, while a nonce
+ * check prevents an old owner from deleting a replacement lock.
+ */
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const DEFAULT_STALE_MS = 30 * 1000;
+
+function withFileLedgerLock(lockPath, callback, options = {}) {
+  const resolvedLockPath = path.resolve(lockPath);
+  fs.mkdirSync(path.dirname(resolvedLockPath), { recursive: true });
+  const owner = acquireLock(resolvedLockPath, options);
+  try {
+    if (typeof options.beforeCallback === 'function') options.beforeCallback();
+    return callback();
+  } finally {
+    releaseOwnedLock(resolvedLockPath, owner);
+  }
+}
+
+function acquireLock(lockPath, options) {
+  const now = options.now || new Date();
+  const staleMs = positiveNumber(options.lockStaleMs, DEFAULT_STALE_MS);
+  const owner = {
+    schemaVersion: 'thumbgate-ledger-lock-v1',
+    pid: process.pid,
+    nonce: crypto.randomUUID(),
+    acquiredAt: now.toISOString(),
+  };
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      fs.mkdirSync(lockPath);
+      writeOwner(lockPath, owner);
+      return owner;
+    } catch (error) {
+      if (error.code !== 'EEXIST') throw error;
+      if (!recoverStaleLock(lockPath, now, staleMs)) {
+        throw lockError(options, 'ledger is busy; deny and retry only after the active writer finishes');
+      }
+    }
+  }
+  throw lockError(options, 'ledger lock could not be acquired after stale-lock recovery');
+}
+
+function recoverStaleLock(lockPath, now, staleMs) {
+  const observed = readOwner(lockPath);
+  const ageMs = lockAgeMs(lockPath, observed, now);
+  if (ageMs < staleMs || processIsAlive(observed?.pid)) return false;
+
+  // Rename is atomic. If another process already recovered or replaced the
+  // lock, this attempt loses harmlessly and acquisition is retried.
+  const quarantine = `${lockPath}.stale-${process.pid}-${crypto.randomUUID()}`;
+  try {
+    fs.renameSync(lockPath, quarantine);
+  } catch (error) {
+    if (['ENOENT', 'EEXIST'].includes(error.code)) return true;
+    throw error;
+  }
+  fs.rmSync(quarantine, { recursive: true, force: true });
+  return true;
+}
+
+function writeOwner(lockPath, owner) {
+  const target = path.join(lockPath, 'owner.json');
+  const temporary = `${target}.tmp-${process.pid}-${owner.nonce}`;
+  fs.writeFileSync(temporary, `${JSON.stringify(owner)}\n`, { encoding: 'utf8', mode: 0o600 });
+  fs.renameSync(temporary, target);
+}
+
+function readOwner(lockPath) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(lockPath, 'owner.json'), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function lockAgeMs(lockPath, owner, now) {
+  const recorded = Date.parse(owner?.acquiredAt || '');
+  if (Number.isFinite(recorded)) return Math.max(0, now.getTime() - recorded);
+  try {
+    return Math.max(0, now.getTime() - fs.statSync(lockPath).mtimeMs);
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+}
+
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code !== 'ESRCH';
+  }
+}
+
+function releaseOwnedLock(lockPath, owner) {
+  const recorded = readOwner(lockPath);
+  if (!recorded || recorded.nonce !== owner.nonce) return;
+  try { fs.unlinkSync(path.join(lockPath, 'owner.json')); } catch (error) {
+    if (error.code !== 'ENOENT') return;
+  }
+  try { fs.rmdirSync(lockPath); } catch { /* a replacement owner wins */ }
+}
+
+function positiveNumber(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) && number > 0 ? number : fallback;
+}
+
+function lockError(options, message) {
+  return typeof options.errorFactory === 'function'
+    ? options.errorFactory(message)
+    : Object.assign(new Error(message), { code: 'THUMBGATE_LEDGER_BUSY' });
+}
+
+module.exports = {
+  DEFAULT_STALE_MS,
+  withFileLedgerLock,
+};