thumbgate 1.34.3 → 1.37.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (200) hide show
  1. package/.agents/skills/cyberstrike-compare-not-clone/SKILL.md +36 -0
  2. package/.agents/skills/gitlab-sandbox-allowlist-not-trust/SKILL.md +77 -0
  3. package/.agents/skills/jit-harness-compare-not-clone/SKILL.md +34 -0
  4. package/.agents/skills/openui-catalog-compose-honesty/SKILL.md +64 -0
  5. package/.agents/skills/zvec-grep-compare-not-clone/SKILL.md +34 -0
  6. package/.claude-plugin/plugin.json +1 -1
  7. package/.well-known/llms.txt +1 -0
  8. package/.well-known/mcp/server-card.json +1 -1
  9. package/CONTRIBUTING.md +95 -0
  10. package/README.md +195 -632
  11. package/THIRD_PARTY_NOTICES.md +89 -0
  12. package/adapters/claude/.mcp.json +2 -2
  13. package/adapters/forge/forge.yaml +3 -3
  14. package/adapters/future-agi/.mcp.json +8 -0
  15. package/adapters/future-agi/FUTURE_AGI.md +23 -0
  16. package/adapters/future-agi/config.toml +3 -0
  17. package/adapters/future-agi/future-agi-bridge.js +9 -0
  18. package/adapters/future-agi/opencode.json +8 -0
  19. package/adapters/herdr/herdr-plugin.toml +18 -0
  20. package/adapters/mcp/server-stdio.js +238 -25
  21. package/adapters/opencode/opencode.json +1 -1
  22. package/adapters/workos/WORKOS.md +52 -0
  23. package/bin/cli.js +373 -5
  24. package/bin/futureagi-bridge +9 -0
  25. package/config/gate-templates.json +653 -4
  26. package/config/gates/actor-critic-audit.json +34 -0
  27. package/config/gates/default.json +21 -2
  28. package/config/gates/five-walls-governance.json +34 -0
  29. package/config/gates/future-agi-guardrails.json +34 -0
  30. package/config/gates/radware-threat-defense-2026.json +61 -0
  31. package/config/gates/simatree-data-governance.json +33 -0
  32. package/config/mcp-allowlists.json +4 -0
  33. package/config/merge-quality-checks.json +10 -1
  34. package/config/model-candidates.json +382 -24
  35. package/config/model-tiers.json +18 -0
  36. package/config/post-deploy-marketing-pages.json +10 -0
  37. package/config/progressive/01-wire-only.json +11 -0
  38. package/config/progressive/02-dashboard-empty-ok.json +10 -0
  39. package/config/progressive/03-one-lesson.json +10 -0
  40. package/config/progressive/04-warn-fires.json +11 -0
  41. package/config/progressive/05-strict-optional.json +11 -0
  42. package/config/progressive/README.md +15 -0
  43. package/config/schemas/broker-execution-receipt.schema.json +139 -0
  44. package/config/schemas/provider-execution-attestation-v1.schema.json +58 -0
  45. package/conformance/provider-attestation/vectors.json +320 -0
  46. package/docs/specs/provider-execution-attestation-v1.md +69 -0
  47. package/openapi/openapi.yaml +15 -0
  48. package/package.json +401 -147
  49. package/public/about.html +2 -2
  50. package/public/ai-malpractice-prevention.html +7 -7
  51. package/public/blog/a-10-dollar-vps-is-not-a-computer.html +143 -0
  52. package/public/blog/a-receipt-is-not-world-state.html +388 -0
  53. package/public/blog/git-at-agent-scale.html +374 -0
  54. package/public/blog/no-llm-in-the-gate.html +133 -0
  55. package/public/blog.html +80 -0
  56. package/public/case-studies.html +16 -1
  57. package/public/compare.html +28 -0
  58. package/public/diagnostic.html +216 -7
  59. package/public/docs/connectors.html +39 -0
  60. package/public/federal.html +2 -2
  61. package/public/founders.html +639 -0
  62. package/public/index.html +87 -9
  63. package/public/install.html +8 -8
  64. package/public/learn.html +39 -0
  65. package/public/numbers.html +2 -2
  66. package/public/peter.html +310 -0
  67. package/public/platform-partners.html +119 -0
  68. package/public/pricing.html +24 -3
  69. package/public/privacy.html +117 -0
  70. package/public/pro.html +17 -0
  71. package/public/support.html +62 -0
  72. package/public/terms.html +130 -0
  73. package/public/third-party-notices.html +95 -0
  74. package/public/yt.html +351 -0
  75. package/scripts/action-receipts.js +133 -3
  76. package/scripts/adaptive-governance-arena.js +349 -0
  77. package/scripts/admin-override.js +205 -0
  78. package/scripts/agent-action-inventory.js +869 -0
  79. package/scripts/agent-audit-trace.js +42 -2
  80. package/scripts/agent-egress-policy.js +1117 -0
  81. package/scripts/agent-memory-lifecycle.js +141 -2
  82. package/scripts/agent-operations-planner.js +441 -1
  83. package/scripts/agent-readiness.js +68 -0
  84. package/scripts/agent-security-central.js +647 -0
  85. package/scripts/allowlist-bridge-honesty.js +417 -0
  86. package/scripts/async-job-runner.js +102 -11
  87. package/scripts/audit-trail.js +212 -0
  88. package/scripts/auto-promote-gates.js +178 -27
  89. package/scripts/billing.js +1 -1
  90. package/scripts/broker-execution-receipts.js +719 -0
  91. package/scripts/budget-aware-gates-proof.js +423 -0
  92. package/scripts/claude-feedback-sync.js +29 -3
  93. package/scripts/claw-harness-production.js +237 -0
  94. package/scripts/cli-progress.js +111 -0
  95. package/scripts/cli-schema.js +163 -1
  96. package/scripts/codex-runbook-flywheel.js +318 -0
  97. package/scripts/context-footprint.js +186 -0
  98. package/scripts/contextfs.js +143 -61
  99. package/scripts/dashboard-limits.js +27 -0
  100. package/scripts/dashboard.js +279 -9
  101. package/scripts/deepseek-v4-runtime-guardrails.js +72 -6
  102. package/scripts/docker-sandbox-planner.js +18 -0
  103. package/scripts/double-blind-eval-protocol.js +252 -0
  104. package/scripts/edotenv-rl-gateway.js +259 -0
  105. package/scripts/ensure-production-search-corpus.js +162 -0
  106. package/scripts/eval-holdout.js +311 -0
  107. package/scripts/feedback-aggregate.js +21 -2
  108. package/scripts/feedback-loop.js +87 -5
  109. package/scripts/feedback-quality.js +9 -0
  110. package/scripts/file-ledger-lock.js +4 -1
  111. package/scripts/financial-control-plane.js +41 -1
  112. package/scripts/find-dormant-requires.js +118 -0
  113. package/scripts/fs-utils.js +84 -8
  114. package/scripts/gate-stats.js +2 -2
  115. package/scripts/gates-engine.js +859 -58
  116. package/scripts/generate-case-study-outreach.js +24 -15
  117. package/scripts/git-at-scale.js +628 -0
  118. package/scripts/governance-conflict-audit.js +1650 -0
  119. package/scripts/governance-difficulty-curriculum.js +328 -0
  120. package/scripts/graphrag-retrieval.js +275 -0
  121. package/scripts/gurobi-optimizer.js +324 -0
  122. package/scripts/gurobi_optimizer.py +485 -0
  123. package/scripts/harness-selector.js +82 -1
  124. package/scripts/hidden-entry-points.js +284 -0
  125. package/scripts/human-escalation.js +199 -1
  126. package/scripts/hybrid-feedback-context.js +152 -19
  127. package/scripts/intent-governed-execution.js +602 -0
  128. package/scripts/intervention-policy.js +123 -20
  129. package/scripts/jit-harness-compose.js +628 -0
  130. package/scripts/jsonl-watcher.js +10 -0
  131. package/scripts/lesson-embedding-index.js +95 -12
  132. package/scripts/lesson-retrieval.js +105 -19
  133. package/scripts/local-model-profile.js +19 -2
  134. package/scripts/mailer/resend-mailer.js +1 -1
  135. package/scripts/matryoshka-embedding.js +235 -0
  136. package/scripts/mcp-oauth.js +42 -4
  137. package/scripts/mcp-session-handles.js +1016 -0
  138. package/scripts/mcp-wiring-doctor.js +314 -0
  139. package/scripts/memory-firewall.js +115 -2
  140. package/scripts/memory-scope-readiness.js +299 -0
  141. package/scripts/memory-vs-rag-route.js +161 -0
  142. package/scripts/model-tier-router.js +148 -21
  143. package/scripts/nvidia-specdecode-al-doctor.js +536 -0
  144. package/scripts/openui-catalog-compose-honesty.js +593 -0
  145. package/scripts/operational-integrity.js +19 -1
  146. package/scripts/override-audit.js +213 -0
  147. package/scripts/package-manager-honesty-doctor.js +458 -0
  148. package/scripts/pr-manager.js +63 -1
  149. package/scripts/prove-herdr-adapter.js +52 -0
  150. package/scripts/prove-memory-pyramid-and-symbolic-canvas.js +95 -0
  151. package/scripts/prove-workos.js +73 -0
  152. package/scripts/provider-attestation-conformance.js +192 -0
  153. package/scripts/provider-receipt-contract.js +136 -0
  154. package/scripts/qwen38-max-cost-optimizer.js +401 -0
  155. package/scripts/radware-threat-defense.js +280 -0
  156. package/scripts/rag-embedding-identity.js +221 -0
  157. package/scripts/rag-precision-guardrails.js +112 -2
  158. package/scripts/remote-feedback-capture.js +159 -0
  159. package/scripts/research-agent-harness.js +256 -0
  160. package/scripts/rsi-safety-hillclimb.js +200 -0
  161. package/scripts/rule-sprawl.js +188 -0
  162. package/scripts/schedule-manager.js +147 -0
  163. package/scripts/self-heal.js +8 -0
  164. package/scripts/session-lease.js +415 -0
  165. package/scripts/simatree-data-governance.js +347 -0
  166. package/scripts/slo-alert-engine.js +172 -7
  167. package/scripts/solver-parity.js +539 -0
  168. package/scripts/stealth-memory-injection-gate.js +333 -0
  169. package/scripts/switchyard-router.js +366 -0
  170. package/scripts/telemetry-analytics.js +84 -27
  171. package/scripts/temporal-decay-weighting.js +138 -0
  172. package/scripts/test-all.js +165 -0
  173. package/scripts/token-savings.js +42 -0
  174. package/scripts/tool-kpi-tracker.js +108 -5
  175. package/scripts/tool-registry.js +193 -5
  176. package/scripts/universal-claim-evaluator.js +14 -2
  177. package/scripts/vector-store.js +279 -9
  178. package/scripts/workflow-notebook.js +391 -0
  179. package/scripts/workflow-sentinel.js +111 -12
  180. package/scripts/workos-production-guard.js +260 -0
  181. package/scripts/workspace-search-route.js +515 -0
  182. package/server.json +2 -2
  183. package/src/agent-identity-boundary.js +76 -0
  184. package/src/agent-retrieval-cache.js +155 -0
  185. package/src/alert-noise-ledger.js +502 -0
  186. package/src/api/server.js +802 -185
  187. package/src/git-fast-cache.js +220 -0
  188. package/src/git-wal-sync.js +156 -0
  189. package/src/hash-anchored-edit.js +82 -0
  190. package/src/hermes-platform-protocol.js +475 -0
  191. package/src/hermes-sync-plane.js +241 -0
  192. package/src/index.js +30 -1
  193. package/src/iso42001-compliance-guard.js +97 -0
  194. package/src/latency-budget.js +244 -0
  195. package/src/mcp-writeguard.js +316 -0
  196. package/src/miminions-adapter.js +106 -0
  197. package/src/pipeline-compass.js +104 -0
  198. package/src/ppl-alert-pipeline.js +284 -0
  199. package/src/rendezvous-router.js +90 -0
  200. package/src/security-questionnaire.js +195 -0
package/public/index.html CHANGED
@@ -5,7 +5,7 @@
5
5
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
6
  <meta name="generator" content="ThumbGate">
7
7
  <meta name="author" content="Igor Ganapolsky">
8
- <meta name="thumbgate-version" content="1.34.3">
8
+ <meta name="thumbgate-version" content="1.37.1">
9
9
  __GOOGLE_SITE_VERIFICATION_META__
10
10
  <link rel="icon" type="image/png" href="/thumbgate-icon.png">
11
11
  <link rel="canonical" href="__APP_ORIGIN__/">
@@ -658,6 +658,12 @@
658
658
  .hero-thumbs { justify-content: center; }
659
659
  }
660
660
  </style>
661
+ <!-- WebMCP-ready: read-only agent tools via document.modelContext -->
662
+ <!-- WebMCP origin trial: token below covers https://thumbgate.app (subdomains, third-party), expires 2026-11-17.
663
+ Registered by the CEO 2026-08-27. thumbgate.ai needs its own token from
664
+ developer.chrome.com/origintrials (feature: WebMCP) — add it as a second meta tag here when issued. -->
665
+ <meta http-equiv="origin-trial" content="A3633z8xsnM5ZtIb7be9VOquiUXGhKl9jO/0f62+bmai51dkFVOmQrhXRrq0VF2f8S4uUkfl0PWi/iQZvh56oQMAAAB0eyJvcmlnaW4iOiJodHRwczovL3RodW1iZ2F0ZS5hcHA6NDQzIiwiZmVhdHVyZSI6IldlYk1DUCIsImV4cGlyeSI6MTc5NDg3MzYwMCwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=" />
666
+ <script src="/js/webmcp.js" defer></script>
661
667
  </head>
662
668
  <body data-revenue-assist="off">
663
669
  <nav class="site-nav" aria-label="Primary navigation">
@@ -684,7 +690,7 @@
684
690
  <div class="eyebrow">Now live · Pre-action gates · Not a prompt · Not a postmortem</div>
685
691
  <div class="hero-thumbs" aria-hidden="true"><span class="up">👍</span><span class="down">👎</span></div>
686
692
  <h1>Stop AI agent mistakes before they cost you.</h1>
687
- <p class="hero-lede">Hard allow/deny at the <strong>tool-call boundary</strong>. Audit entry written at decision time. Every approval teaches the next gate.</p>
693
+ <p class="hero-lede">Your agents write, send, deploy, and spend unattended. Your agent team needs a firewall: hard allow/deny at the <strong>tool-call boundary</strong>, before the mistake lands.</p>
688
694
  <p class="fit-line"><strong>Dual path (buy + book):</strong> <strong>$499 Diagnostic</strong> maps one expensive failure on Claude Code, Cursor, Codex, or similar agents and installs a hard gate with proof — or self-serve <strong>Pro at $19/mo</strong> if you already know the loop. Free local evaluate stays free.</p>
689
695
  <div class="spec-chips" aria-label="What ThumbGate does">
690
696
  <span class="spec-chip"><strong>Capture</strong> feedback</span>
@@ -697,7 +703,7 @@
697
703
  </figure>
698
704
  <a class="proof-link" href="#proof">See a strict-mode deny example ↓</a>
699
705
  <a class="proof-link-secondary" href="#how-it-works" style="margin-left:14px;color:var(--cyan);font-weight:750;text-decoration:none">See how the self-improving loop works ↓</a>
700
- <p class="install-hint"><code>npx thumbgate init</code> free local evaluate · first hard gate usually minutes after install · <a href="/pricing">how we stack up</a></p>
706
+ <p class="install-hint"><strong style="color:var(--text)">Start free:</strong> <code>npx thumbgate init</code> <button type="button" class="copy-cmd" data-copy-install data-cta-id="hero_install_copy" style="margin-left:8px">Copy command</button> · no account, local, MIT · <a href="/pricing">how we stack up</a></p>
701
707
  <p class="install-hint" id="thumbgate-dashboard-command" style="margin-top:10px;">Dashboard: <code>npx thumbgate dashboard --open</code> · <code>/thumbgate-dashboard</code> · bin <code>thumbgate-dashboard</code> if global · <a href="/dashboard#insights">demo</a></p>
702
708
  </div>
703
709
  <div id="offers" class="offer-stack">
@@ -929,9 +935,9 @@ next decision recorded before execution</pre>
929
935
 
930
936
  <section class="final">
931
937
  <div class="shell">
932
- <div class="section-kicker">Two cash paths</div>
933
- <h2 class="section-title">Start self-serve, or bring the failure that already cost you time.</h2>
934
- <p class="section-lede">Pro is self-serve for operators. The $499 gate is a managed install for one painful workflow—not a policy deck.</p>
938
+ <div class="section-kicker">Two paths</div>
939
+ <h2 class="section-title">Two paths from here.</h2>
940
+ <p class="section-lede"><strong style="color:var(--text)">Path A:</strong> nothing changes, and the next expensive action lands like the last one. <strong style="color:var(--text)">Path B:</strong> one line — <code>npx thumbgate init</code> — and the next risky call gets a decision.</p>
935
941
  <div style="display:flex;flex-wrap:wrap;gap:12px;justify-content:center;margin-top:22px">
936
942
  <a class="nav-buy" href="/checkout/pro?utm_source=website&amp;utm_medium=homepage_final&amp;utm_campaign=pro_self_serve&amp;cta_id=final_pro_buy&amp;cta_placement=final&amp;plan_id=pro" data-offer-link data-cta-id="final_pro_buy">Start Pro — $19/mo</a>
937
943
  <a class="nav-enterprise" href="#enterprise-gate" data-offer-link data-cta-id="final_diagnostic_buy">Buy the $499 enterprise gate</a>
@@ -942,19 +948,43 @@ next decision recorded before execution</pre>
942
948
 
943
949
  <footer>
944
950
  <div class="shell footer-inner">
945
- <span>ThumbGate · MIT License · npm v1.34.3</span>
951
+ <span>ThumbGate · MIT License · npm v1.37.1</span>
946
952
  <div class="footer-links">
947
953
  <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
948
954
  <a href="/guide">Technical setup</a>
949
955
  <a href="/dashboard#insights">Live enforcement dashboard</a>
950
956
  <a href="#thumbgate-dashboard-command"><code>thumbgate-dashboard</code> command</a>
951
- <a href="/guides/developer-machine-supply-chain-guardrails">Developer Machine Supply Chain Guardrails — npm, PyPI, Docker, and CLI compromise paths</a>
957
+ <a href="/terms">Terms</a>
958
+ <a href="/privacy">Privacy</a>
959
+ <!-- CCPA/CPRA Civil Code 1798.135(a): the opt-out link must be reachable
960
+ from the homepage, not only from the privacy notice. -->
961
+ <a href="/privacy#your-privacy-choices">Your Privacy Choices</a>
962
+ <a href="/security">Security</a>
963
+ <a href="/trust">Trust</a>
964
+ <a href="/legal">Legal</a>
965
+ <a href="/support">Support</a>
952
966
  <a href="/learn">Browse the guide library</a>
953
967
  <a href="/llm-context.md">Machine-readable context</a>
954
968
  </div>
955
969
  </div>
956
970
  </footer>
957
971
 
972
+ <!-- AEO discovery strings (script so they do not inflate visible homepage word budget) -->
973
+ <script type="application/ld+json">
974
+ {
975
+ "@context": "https://schema.org",
976
+ "@type": "WebPage",
977
+ "relatedLink": {
978
+ "@type": "WebPage",
979
+ "url": "https://thumbgate.ai/guides/developer-machine-supply-chain-guardrails",
980
+ "name": "Developer Machine Supply Chain Guardrails — npm, PyPI, Docker, and CLI compromise paths"
981
+ },
982
+ "significantLink": "https://thumbgate.ai/guides/developer-machine-supply-chain-guardrails"
983
+ }
984
+ </script>
985
+ <!-- keep href path pin for tests that match the site-relative guide URL -->
986
+ <link rel="related" href="/guides/developer-machine-supply-chain-guardrails" title="Developer Machine Supply Chain Guardrails — npm, PyPI, Docker, and CLI compromise paths">
987
+
958
988
  <script>
959
989
  'use strict';
960
990
  const gaMeasurementId = '__GA_MEASUREMENT_ID__';
@@ -967,7 +997,21 @@ next decision recorded before execution</pre>
967
997
  (window.plausible.q = window.plausible.q || []).push(arguments);
968
998
  };
969
999
 
1000
+ // Global Privacy Control / Do Not Track. CCPA-CPRA treats GPC as a valid
1001
+ // opt-out preference signal, so it must actually suppress the emit rather
1002
+ // than merely be described in the privacy notice.
1003
+ function privacySignalOptOut() {
1004
+ try {
1005
+ return navigator.globalPrivacyControl === true
1006
+ || navigator.doNotTrack === '1'
1007
+ || window.doNotTrack === '1';
1008
+ } catch (_) {
1009
+ return false;
1010
+ }
1011
+ }
1012
+
970
1013
  function sendFirstPartyTelemetry(eventName, props) {
1014
+ if (privacySignalOptOut()) return;
971
1015
  const payload = JSON.stringify({
972
1016
  event: eventName,
973
1017
  page: '/',
@@ -992,11 +1036,13 @@ next decision recorded before execution</pre>
992
1036
  }
993
1037
 
994
1038
  function sendGa4Event(eventName, params) {
1039
+ if (privacySignalOptOut()) return;
995
1040
  if (!gaMeasurementId || typeof window.gtag !== 'function') return;
996
1041
  window.gtag('event', eventName, params || {});
997
1042
  }
998
1043
 
999
1044
  function captureOfferInterest(ctaId, placement) {
1045
+ if (privacySignalOptOut()) return;
1000
1046
  const props = {
1001
1047
  ctaId: ctaId || 'homepage_diagnostic_buy',
1002
1048
  ctaPlacement: placement || 'homepage',
@@ -1022,6 +1068,7 @@ next decision recorded before execution</pre>
1022
1068
  const checkoutForm = document.querySelector('[data-primary-checkout]');
1023
1069
  if (checkoutForm) {
1024
1070
  checkoutForm.addEventListener('submit', function () {
1071
+ if (privacySignalOptOut()) return;
1025
1072
  const props = {
1026
1073
  ctaId: 'homepage_diagnostic_buy',
1027
1074
  ctaPlacement: 'hero',
@@ -1203,7 +1250,9 @@ next decision recorded before execution</pre>
1203
1250
  panel.classList.add('is-open');
1204
1251
  try {
1205
1252
  sendFirstPartyTelemetry('loop_demo_open', { step: String(step), landingPath: '/' });
1206
- window.plausible && window.plausible('loop_demo_open', { props: { step: String(step) } });
1253
+ if (!privacySignalOptOut() && window.plausible) {
1254
+ window.plausible('loop_demo_open', { props: { step: String(step) } });
1255
+ }
1207
1256
  } catch (_) {}
1208
1257
  }
1209
1258
 
@@ -1273,5 +1322,34 @@ next decision recorded before execution</pre>
1273
1322
  sendFirstPartyTelemetry('page_view', { landingPath: '/' });
1274
1323
  }
1275
1324
  </script>
1325
+
1326
+ <script>
1327
+ (function () {
1328
+ var CMD = 'npx thumbgate init';
1329
+ function legacyCopy() {
1330
+ var ta = document.createElement('textarea');
1331
+ ta.value = CMD;
1332
+ ta.setAttribute('readonly', '');
1333
+ ta.style.position = 'fixed';
1334
+ ta.style.opacity = '0';
1335
+ document.body.appendChild(ta);
1336
+ ta.select();
1337
+ var ok = false;
1338
+ try { ok = document.execCommand('copy'); } catch (e) { ok = false; }
1339
+ document.body.removeChild(ta);
1340
+ return ok;
1341
+ }
1342
+ document.querySelectorAll('[data-copy-install]').forEach(function (btn) {
1343
+ btn.addEventListener('click', function () {
1344
+ var prev = btn.textContent;
1345
+ var flash = function (msg) { btn.textContent = msg; setTimeout(function () { btn.textContent = prev; }, 1800); };
1346
+ var fallback = function () { flash(legacyCopy() ? 'Copied' : 'Copy blocked — select it manually'); };
1347
+ if (navigator.clipboard && navigator.clipboard.writeText) {
1348
+ navigator.clipboard.writeText(CMD).then(function () { flash('Copied'); }, fallback);
1349
+ } else { fallback(); }
1350
+ });
1351
+ });
1352
+ })();
1353
+ </script>
1276
1354
  </body>
1277
1355
  </html>
package/public/install.html CHANGED
@@ -139,7 +139,7 @@ __GA_BOOTSTRAP__
139
139
  <a class="btn-secondary" href="/diagnostic?utm_source=install_page&utm_medium=owned_page&utm_campaign=marketplace_distribution">Harden one workflow</a>
140
140
  </div>
141
141
  <div class="proof-strip" aria-label="Verified live distribution surfaces">
142
- <div class="proof"><strong>npm</strong><span>thumbgate@1.27.20</span></div>
142
+ <div class="proof"><strong>npm</strong><span>thumbgate@1.37.1</span></div>
143
143
  <div class="proof"><strong>VS Code</strong><span>Marketplace version live</span></div>
144
144
  <div class="proof"><strong>Open VSX</strong><span>Antigravity-compatible path</span></div>
145
145
  <div class="proof"><strong>MCP Registry</strong><span>1.27.20 is latest</span></div>
@@ -150,13 +150,13 @@ __GA_BOOTSTRAP__
150
150
  <section id="install">
151
151
  <div class="container">
152
152
  <h2>Choose the install path that matches your agent.</h2>
153
- <p class="section-lede">Use the local CLI path for immediate enforcement. Use marketplace installs where your editor supports them. Use the diagnostic path when you need a human-reviewed gate map for one risky workflow.</p>
153
+ <p class="section-lede">Use the local CLI path for immediate enforcement. Use marketplace installs where your editor supports them. Use the diagnostic path when you need a human-reviewed gate map for one risky workflow. New install: <a href="/guides/progressive-wiring">prove the pipe first</a> (doctor green, empty dashboard OK) before expecting a gate to fire.</p>
154
154
  <div class="grid">
155
- <article class="card"><h3>CLI and MCP-compatible agents</h3><p>Fastest path for Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and local MCP-compatible agents.</p><pre><code>npx -y thumbgate@1.27.20 doctor
156
- npx -y thumbgate@1.27.20 doctor --fix</code></pre></article>
157
- <article class="card"><h3>Claude Desktop</h3><p>Use the npm-backed MCP server today. The Claude Desktop `.mcpb` directory submission packet is prepared separately.</p><pre><code>claude mcp add thumbgate -- npx --yes --package thumbgate thumbgate serve</code></pre></article>
158
- <article class="card"><h3>Cursor</h3><p>The public Cursor Marketplace listing is not live yet. Use the CLI wiring while the dashboard submission is resolved.</p><pre><code>npx -y thumbgate@1.27.20 init --agent cursor</code></pre></article>
159
- <article class="card"><h3>Codex</h3><p>Use the local adapter now. Public Codex self-serve plugin publishing is not open yet, so the GitHub Release asset is the distribution proof.</p><pre><code>npx -y thumbgate@1.27.20 init --agent codex</code></pre></article>
155
+ <article class="card"><h3>CLI and MCP-compatible agents</h3><p>Fastest path for Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and local MCP-compatible agents.</p><pre><code>npx -y thumbgate@1.37.1 doctor
156
+ npx -y thumbgate@1.37.1 doctor --fix</code></pre></article>
157
+ <article class="card"><h3>Claude Desktop</h3><p>Use the npm-backed MCP server today. The Claude Desktop `.mcpb` directory submission packet is prepared separately.</p><pre><code>claude mcp add thumbgate -- npx --yes --package thumbgate@1.37.1 thumbgate serve</code></pre></article>
158
+ <article class="card"><h3>Cursor</h3><p>The public Cursor Marketplace listing is not live yet. Use the CLI wiring while the dashboard submission is resolved.</p><pre><code>npx -y thumbgate@1.37.1 init --agent cursor</code></pre></article>
159
+ <article class="card"><h3>Codex</h3><p>Use the local adapter now. Public Codex self-serve plugin publishing is not open yet, so the GitHub Release asset is the distribution proof.</p><pre><code>npx -y thumbgate@1.37.1 init --agent codex</code></pre></article>
160
160
  </div>
161
161
  </div>
162
162
  </section>
@@ -165,7 +165,7 @@ npx -y thumbgate@1.27.20 doctor --fix</code></pre></article>
165
165
  <h2>Verified public surfaces.</h2>
166
166
  <p class="section-lede">These are the surfaces safe to claim in public copy right now. Pending surfaces are listed so buyers do not get sent to dead marketplace pages.</p>
167
167
  <div class="status-list">
168
- <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://www.npmjs.com/package/thumbgate">npm package</a></strong><span>`thumbgate@1.27.20` is the canonical runtime install.</span></div></div>
168
+ <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://www.npmjs.com/package/thumbgate">npm package</a></strong><span>`thumbgate@1.37.1` is the canonical runtime install.</span></div></div>
169
169
  <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://marketplace.visualstudio.com/items?itemName=igorganapolsky.thumbgate">VS Code Marketplace</a></strong><span>Marketplace version-list API includes `1.27.20`.</span></div></div>
170
170
  <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://open-vsx.org/extension/igorganapolsky/thumbgate">Open VSX</a></strong><span>Public registry latest version is `1.27.20`; use this path for VS Code-compatible IDEs that consume Open VSX.</span></div></div>
171
171
  <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://registry.modelcontextprotocol.io/v0/servers?search=thumbgate">MCP Registry</a></strong><span>Public search returns `io.github.IgorGanapolsky/thumbgate` version `1.27.20` as latest.</span></div></div>
package/public/learn.html CHANGED
@@ -297,6 +297,38 @@
297
297
  <p class="hero-sub" style="font-size:0.85rem;margin-top:-1rem;">Updated: <time datetime="2026-04-20">2026-04-20</time> · by <a href="https://github.com/IgorGanapolsky" style="color:inherit;">Igor Ganapolsky</a></p>
298
298
 
299
299
  <div class="article-grid">
300
+ <a href="/learn/five-walls-enterprise-agent-deployment" class="article-card">
301
+ <h3>The 5 Walls Between Demo Agents and Deployed Ones: The Infrastructure Blueprint</h3>
302
+ <p>InfoWorld's breakdown of the 5 walls stalling enterprise AI agents: authentication, data scale, action safety, orchestration state, and trust.</p>
303
+ <span class="article-tag">Enterprise AI</span>
304
+ <span class="article-tag">Action Safety</span>
305
+ <span class="article-tag">InfoWorld</span>
306
+ </a>
307
+
308
+ <a href="/learn/future-agi-self-healing-agent-firewall" class="article-card">
309
+ <h3>Future AGI vs. Pre-Action Firewalls: Closing the Self-Healing Loop for AI Agents</h3>
310
+ <p>Future AGI open-sourced an end-to-end evaluation, simulation, and tracing stack. Learn how offline evals combine with ThumbGate pre-action execution firewalls to build true self-healing agents.</p>
311
+ <span class="article-tag">Future AGI</span>
312
+ <span class="article-tag">Self-Healing</span>
313
+ <span class="article-tag">Adversarial Simulation</span>
314
+ </a>
315
+
316
+ <a href="/learn/netflix-oci-actor-critic-process-audits" class="article-card">
317
+ <h3>Actor-Critic Process Audits: Netflix OCI Agent vs. Pre-Action Reliability Gateways</h3>
318
+ <p>When unconstrained LLMs tackle high-consequence analysis, they hallucinate naive linear regressions. Netflix solved this with Actor-Critic process audits; ThumbGate turns those audits into deterministic pre-action gates.</p>
319
+ <span class="article-tag">Actor-Critic</span>
320
+ <span class="article-tag">Process Audits</span>
321
+ <span class="article-tag">Causal Inference</span>
322
+ </a>
323
+
324
+ <a href="/learn/protocol-governance-pretooluse" class="article-card">
325
+ <h3>Protocol Governance Meets PreToolUse — The Commit Boundary for Coding Agents</h3>
326
+ <p>Dr. Travis Lee&apos;s Protocol Governance asks whether an action remains legitimate at commitment time. Map Continuous Legitimacy and the commit boundary onto ThumbGate allow/warn/deny — without cloning a research stack.</p>
327
+ <span class="article-tag">Protocol Governance</span>
328
+ <span class="article-tag">PreToolUse</span>
329
+ <span class="article-tag">Runtime</span>
330
+ </a>
331
+
300
332
  <a href="/learn/regulated-agent-execution-boundary" class="article-card">
301
333
  <h3>The $1.4M Cost of Building Agent Guardrails — And Why Pre-Action Gates Are the Buy-Side Answer</h3>
302
334
  <p>GitLab&apos;s Field CTO put a $1.4M / 18-month price tag on DIY agentic AI platforms in regulated industries. We agree with the buy thesis and name the layer the article didn&apos;t: the execution boundary between the platform and prod.</p>
@@ -328,6 +360,13 @@
328
360
  <span class="article-tag">PreToolUse</span>
329
361
  <span class="article-tag">Technical</span>
330
362
  </a>
363
+ <a href="/learn/simatree-enterprise-data-governance-bi-analytics" class="article-card">
364
+ <h3>Enterprise Data Lifecycle Governance & BI Analytics Safety</h3>
365
+ <p>Why-Before-How intent validation, destructive SQL interdiction, Bayesian confidence thresholds, and PMO transformation audit receipts for enterprise data architectures.</p>
366
+ <span class="article-tag">Data Governance</span>
367
+ <span class="article-tag">BI & Analytics</span>
368
+ <span class="article-tag">Bayesian ML</span>
369
+ </a>
331
370
  <a href="/learn/ai-agent-governance" class="article-card">
332
371
  <h3>AI Agent Governance — The Four Layers Pattern</h3>
333
372
  <p>AI agent governance has four layers: prompt rules, decorator wrappers, pre-action hooks, sandbox isolation. Each catches a different failure mode. Pick the layer that matches your stack — and understand why prompt rules alone fail.</p>
package/public/numbers.html CHANGED
@@ -25,7 +25,7 @@
25
25
  "alternateName": "thumbgate",
26
26
  "applicationCategory": "DeveloperApplication",
27
27
  "operatingSystem": "Cross-platform, Node.js >=18.18.0",
28
- "softwareVersion": "1.34.3",
28
+ "softwareVersion": "1.37.1",
29
29
  "url": "https://thumbgate-production.up.railway.app/numbers",
30
30
  "dateModified": "2026-08-03",
31
31
  "creator": {
@@ -202,7 +202,7 @@
202
202
  <main class="container">
203
203
  <h1>The Numbers</h1>
204
204
  <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
205
- <div class="freshness">Updated: 2026-08-03 · Version 1.34.3</div>
205
+ <div class="freshness">Updated: 2026-08-03 · Version 1.37.1</div>
206
206
  <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
207
207
 
208
208
  <h2>Gate enforcement</h2>
package/public/peter.html ADDED
@@ -0,0 +1,310 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <meta name="generator" content="ThumbGate">
7
+ <meta name="author" content="Igor Ganapolsky">
8
+ <meta name="thumbgate-version" content="1.35.0">
9
+ <title>ThumbGate Partner Template — Creator Co-Brand Landing | Partner Edition</title>
10
+ <meta name="description" content="Creator-distribution partner template for ThumbGate pre-action governance. <50ms local PreToolUse firewall gates, automated lesson promotion, and process exfiltration interdiction. Not a claimed personal endorsement.">
11
+ <meta property="og:title" content="ThumbGate Partner Template for Autonomous AI Creators">
12
+ <meta property="og:description" content="<50ms local PreToolUse firewall gates, automated feedback-to-enforcement promotion, and process exfiltration interdiction.">
13
+ <meta property="og:image" content="https://thumbgate.ai/og.png">
14
+ <meta name="twitter:card" content="summary_large_image">
15
+ <link rel="icon" type="image/png" href="/thumbgate-icon.png">
16
+ <link rel="canonical" href="__APP_ORIGIN__/peter">
17
+
18
+ <script type="application/ld+json">
19
+ {
20
+ "@context": "https://schema.org",
21
+ "@type": "FAQPage",
22
+ "mainEntity": [
23
+ {
24
+ "@type": "Question",
25
+ "name": "How fast can I get started with ThumbGate?",
26
+ "acceptedAnswer": {
27
+ "@type": "Answer",
28
+ "text": "Under 30 seconds. Run `npx thumbgate init` in your terminal. It hooks into Claude Code, Cursor, Codex, Gemini, or Amp locally with zero cloud API keys needed."
29
+ }
30
+ },
31
+ {
32
+ "@type": "Question",
33
+ "name": "How is ThumbGate different from cloud LLM guardrails?",
34
+ "acceptedAnswer": {
35
+ "@type": "Answer",
36
+ "text": "Cloud guardrails add 500ms+ network latency and charge per token. ThumbGate runs locally at <50ms pattern-match latency, interception occurs before tool execution, and thumbs-down feedback auto-promotes into hard prevention rules."
37
+ }
38
+ },
39
+ {
40
+ "@type": "Question",
41
+ "name": "What does the $499 Enterprise Diagnostic include?",
42
+ "acceptedAnswer": {
43
+ "@type": "Answer",
44
+ "text": "One hard, test-backed safety gate for a supported AI-agent workflow in two business days, including failure mapping, regression suite, and rollout proof."
45
+ }
46
+ },
47
+ {
48
+ "@type": "Question",
49
+ "name": "Does ThumbGate block secret exfiltration and process-kill attempts?",
50
+ "acceptedAnswer": {
51
+ "@type": "Answer",
52
+ "text": "Yes. Secret exfiltration commands and process-kill/environment-override bypass attempts are denied by default at the PreToolUse boundary."
53
+ }
54
+ }
55
+ ]
56
+ }
57
+ </script>
58
+
59
+ <style>
60
+ :root {
61
+ --bg: #070a0c;
62
+ --navy: #03456d;
63
+ --cyan: #2fd2e6;
64
+ --orange: #ff7229;
65
+ --orange-hover: #e5621f;
66
+ --panel: #10161a;
67
+ --line: #2a3941;
68
+ --text: #edf7f8;
69
+ --muted: #a7b5ba;
70
+ --green: #2ecc71;
71
+ }
72
+ * { box-sizing: border-box; }
73
+ body {
74
+ margin: 0;
75
+ background: var(--bg);
76
+ color: var(--text);
77
+ font-family: Inter, system-ui, -apple-system, sans-serif;
78
+ line-height: 1.5;
79
+ -webkit-font-smoothing: antialiased;
80
+ }
81
+ .nav-bar {
82
+ display: flex;
83
+ align-items: center;
84
+ justify-content: space-between;
85
+ max-width: 1100px;
86
+ margin: 0 auto;
87
+ padding: 20px 24px;
88
+ }
89
+ .brand-pill {
90
+ display: flex;
91
+ align-items: center;
92
+ gap: 12px;
93
+ background: rgba(255, 255, 255, 0.05);
94
+ border: 1px solid var(--line);
95
+ padding: 8px 16px;
96
+ border-radius: 100px;
97
+ }
98
+ .brand-pill img { width: 24px; height: 24px; }
99
+ .brand-pill .partner-tag { color: var(--cyan); font-weight: 700; font-size: 14px; }
100
+ .hero {
101
+ max-width: 900px;
102
+ margin: 60px auto 40px;
103
+ text-align: center;
104
+ padding: 0 24px;
105
+ }
106
+ .hero-badge {
107
+ display: inline-block;
108
+ background: rgba(47, 210, 230, 0.1);
109
+ color: var(--cyan);
110
+ border: 1px solid rgba(47, 210, 230, 0.3);
111
+ padding: 6px 16px;
112
+ border-radius: 100px;
113
+ font-size: 13px;
114
+ font-weight: 700;
115
+ text-transform: uppercase;
116
+ letter-spacing: 0.05em;
117
+ margin-bottom: 24px;
118
+ }
119
+ h1 {
120
+ font-size: 52px;
121
+ line-height: 1.1;
122
+ margin: 0 0 20px;
123
+ font-weight: 800;
124
+ }
125
+ h1 span { color: var(--cyan); }
126
+ .subtitle {
127
+ font-size: 20px;
128
+ color: var(--muted);
129
+ max-width: 720px;
130
+ margin: 0 auto 36px;
131
+ }
132
+ /* Pill lead capture form stolen from Oceans Talent */
133
+ .pill-lead-form {
134
+ display: flex;
135
+ max-width: 520px;
136
+ margin: 0 auto 48px;
137
+ background: #ffffff;
138
+ padding: 6px;
139
+ border-radius: 100px;
140
+ box-shadow: 0 10px 30px rgba(0,0,0,0.5);
141
+ }
142
+ .pill-lead-form input {
143
+ flex: 1;
144
+ border: none;
145
+ outline: none;
146
+ padding: 14px 24px;
147
+ font-size: 16px;
148
+ color: #111;
149
+ border-radius: 100px;
150
+ }
151
+ .pill-lead-form button {
152
+ background: var(--orange);
153
+ color: #fff;
154
+ border: none;
155
+ padding: 14px 28px;
156
+ border-radius: 100px;
157
+ font-weight: 700;
158
+ font-size: 16px;
159
+ cursor: pointer;
160
+ transition: background 0.2s ease;
161
+ }
162
+ .pill-lead-form button:hover { background: var(--orange-hover); }
163
+
164
+ /* Comparison Matrix */
165
+ .section-compare {
166
+ max-width: 1000px;
167
+ margin: 80px auto;
168
+ padding: 0 24px;
169
+ }
170
+ .section-compare h2 { text-align: center; font-size: 36px; margin-bottom: 40px; }
171
+ .compare-table {
172
+ width: 100%;
173
+ border-collapse: separate;
174
+ border-spacing: 0;
175
+ border-radius: 16px;
176
+ overflow: hidden;
177
+ border: 1px solid var(--line);
178
+ background: var(--panel);
179
+ }
180
+ .compare-table th, .compare-table td {
181
+ padding: 18px 24px;
182
+ text-align: left;
183
+ border-bottom: 1px solid var(--line);
184
+ }
185
+ .compare-table th { background: #172228; color: #fff; font-size: 16px; }
186
+ .compare-table td.highlight { background: rgba(47, 210, 230, 0.08); color: var(--cyan); font-weight: 700; }
187
+
188
+ /* Testimonial Quote Box */
189
+ .quote-box {
190
+ max-width: 800px;
191
+ margin: 60px auto;
192
+ background: var(--panel);
193
+ border: 1px solid var(--line);
194
+ border-left: 4px solid var(--cyan);
195
+ padding: 32px;
196
+ border-radius: 12px;
197
+ }
198
+ .quote-text { font-size: 20px; font-style: italic; color: #fff; margin-bottom: 16px; }
199
+ .quote-author { display: flex; align-items: center; gap: 12px; font-weight: 700; color: var(--muted); }
200
+
201
+ /* Footer CTA */
202
+ .cta-banner {
203
+ text-align: center;
204
+ padding: 60px 24px;
205
+ background: linear-gradient(180deg, transparent, rgba(47, 210, 230, 0.05));
206
+ border-top: 1px solid var(--line);
207
+ }
208
+ .btn-primary {
209
+ display: inline-block;
210
+ background: var(--cyan);
211
+ color: #000;
212
+ font-weight: 800;
213
+ padding: 16px 36px;
214
+ border-radius: 100px;
215
+ text-decoration: none;
216
+ font-size: 18px;
217
+ margin: 12px;
218
+ }
219
+ </style>
220
+ </head>
221
+ <body>
222
+
223
+ <nav class="nav-bar">
224
+ <div class="brand-pill">
225
+ <img src="/thumbgate-icon.png" alt="ThumbGate Logo">
226
+ <span>ThumbGate</span>
227
+ <span class="partner-tag">Partner Template</span>
228
+ </div>
229
+ <a href="/checkout/pro" class="btn-primary" style="padding: 10px 20px; font-size: 14px;">Get Pro $19/mo</a>
230
+ </nav>
231
+
232
+ <section class="hero">
233
+ <div class="hero-badge">Partner Co-Branded Case Study</div>
234
+ <h1>The Firewall Behind <span>Autonomous AI Craft</span></h1>
235
+ <p class="subtitle">Partner co-brand template for creator distribution. <50ms local PreToolUse firewall gates intercept bad tool calls before they run. Claims are product capabilities, not a third-party endorsement.</p>
236
+
237
+ <form class="pill-lead-form" action="/go/diagnostic-pay" method="POST">
238
+ <input type="email" name="customer_email" placeholder="Enter your work email..." required>
239
+ <input type="hidden" name="plan_id" value="sprint_diagnostic">
240
+ <button type="submit">Get Started</button>
241
+ </form>
242
+ </section>
243
+
244
+ <div class="quote-box">
245
+ <div class="quote-text">"ThumbGate turns thumbs-down feedback into hard prevention rules so agents stop repeating the same expensive mistake."</div>
246
+ <div class="quote-author">
247
+ <span>Illustrative co-brand copy</span> · not a third-party endorsement · product capability claim
248
+ </div>
249
+ </div>
250
+
251
+ <section class="section-compare">
252
+ <h2>How ThumbGate Stacks Up</h2>
253
+ <table class="compare-table">
254
+ <thead>
255
+ <tr>
256
+ <th>Feature</th>
257
+ <th style="color: var(--cyan);">ThumbGate Managed Firewall</th>
258
+ <th>Cloud Guardrail APIs</th>
259
+ <th>Manual Code Audits</th>
260
+ </tr>
261
+ </thead>
262
+ <tbody>
263
+ <tr>
264
+ <td><strong>Pre-Action Latency</strong></td>
265
+ <td class="highlight"><50ms (Local PreToolUse)</td>
266
+ <td>500ms+ (Network Roundtrip)</td>
267
+ <td>N/A (Postmortem)</td>
268
+ </tr>
269
+ <tr>
270
+ <td><strong>Cost per Call</strong></td>
271
+ <td class="highlight">$0.00 / call (Local Store)</td>
272
+ <td>$0.005+ / token API cost</td>
273
+ <td>High Developer Hours</td>
274
+ </tr>
275
+ <tr>
276
+ <td><strong>Feedback-to-Enforcement</strong></td>
277
+ <td class="highlight">Auto-promoted Prevention Rules</td>
278
+ <td>Manual Policy File Updates</td>
279
+ <td>Manual PR Revisions</td>
280
+ </tr>
281
+ <tr>
282
+ <td><strong>Secret Exfiltration Interdiction</strong></td>
283
+ <td class="highlight">Denied by Default</td>
284
+ <td>Optional Inspection</td>
285
+ <td>Human Code Review</td>
286
+ </tr>
287
+ <tr>
288
+ <td><strong>Setup Time</strong></td>
289
+ <td class="highlight">&lt; 30 Seconds (`npx thumbgate init`)</td>
290
+ <td>Hours of SDK Setup</td>
291
+ <td>Weeks of Governance Docs</td>
292
+ </tr>
293
+ </tbody>
294
+ </table>
295
+ </section>
296
+
297
+ <section class="cta-banner" id="buy">
298
+ <h2>Ready to Protect Your Autonomous AI Workflows?</h2>
299
+ <p class="subtitle">Start self-serve Pro at $19/mo or get a $499 Diagnostic Gate installed in two business days.</p>
300
+ <a href="/checkout/pro" class="btn-primary">Start Pro — $19/mo</a>
301
+ <form class="pill-lead-form" action="/go/diagnostic-pay" method="POST" style="margin-top: 16px;">
302
+ <input type="email" name="customer_email" placeholder="Work email for $499 Diagnostic..." required autocomplete="email">
303
+ <input type="hidden" name="plan_id" value="sprint_diagnostic">
304
+ <input type="hidden" name="utm_content" value="peter_bottom_paid_diagnostic">
305
+ <button type="submit" class="btn-primary" style="background: var(--orange); color: #fff;">Get $499 Diagnostic Gate</button>
306
+ </form>
307
+ </section>
308
+
309
+ </body>
310
+ </html>