thumbgate 1.35.0 → 1.37.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (196) hide show
  1. package/.agents/skills/cyberstrike-compare-not-clone/SKILL.md +36 -0
  2. package/.agents/skills/gitlab-sandbox-allowlist-not-trust/SKILL.md +77 -0
  3. package/.agents/skills/jit-harness-compare-not-clone/SKILL.md +34 -0
  4. package/.agents/skills/openui-catalog-compose-honesty/SKILL.md +64 -0
  5. package/.agents/skills/zvec-grep-compare-not-clone/SKILL.md +34 -0
  6. package/.claude-plugin/plugin.json +1 -1
  7. package/.well-known/llms.txt +1 -0
  8. package/.well-known/mcp/server-card.json +1 -1
  9. package/CONTRIBUTING.md +95 -0
  10. package/README.md +195 -632
  11. package/THIRD_PARTY_NOTICES.md +89 -0
  12. package/adapters/claude/.mcp.json +2 -2
  13. package/adapters/forge/forge.yaml +3 -3
  14. package/adapters/future-agi/.mcp.json +8 -0
  15. package/adapters/future-agi/FUTURE_AGI.md +23 -0
  16. package/adapters/future-agi/config.toml +3 -0
  17. package/adapters/future-agi/future-agi-bridge.js +9 -0
  18. package/adapters/future-agi/opencode.json +8 -0
  19. package/adapters/herdr/herdr-plugin.toml +18 -0
  20. package/adapters/mcp/server-stdio.js +238 -25
  21. package/adapters/opencode/opencode.json +1 -1
  22. package/adapters/workos/WORKOS.md +52 -0
  23. package/bin/cli.js +336 -3
  24. package/bin/futureagi-bridge +9 -0
  25. package/config/gate-templates.json +581 -4
  26. package/config/gates/actor-critic-audit.json +34 -0
  27. package/config/gates/default.json +9 -3
  28. package/config/gates/five-walls-governance.json +34 -0
  29. package/config/gates/future-agi-guardrails.json +34 -0
  30. package/config/gates/radware-threat-defense-2026.json +61 -0
  31. package/config/gates/simatree-data-governance.json +33 -0
  32. package/config/mcp-allowlists.json +4 -0
  33. package/config/merge-quality-checks.json +6 -0
  34. package/config/model-candidates.json +312 -29
  35. package/config/model-tiers.json +18 -0
  36. package/config/post-deploy-marketing-pages.json +10 -0
  37. package/config/progressive/01-wire-only.json +11 -0
  38. package/config/progressive/02-dashboard-empty-ok.json +10 -0
  39. package/config/progressive/03-one-lesson.json +10 -0
  40. package/config/progressive/04-warn-fires.json +11 -0
  41. package/config/progressive/05-strict-optional.json +11 -0
  42. package/config/progressive/README.md +15 -0
  43. package/config/schemas/broker-execution-receipt.schema.json +139 -0
  44. package/config/schemas/provider-execution-attestation-v1.schema.json +58 -0
  45. package/conformance/provider-attestation/vectors.json +320 -0
  46. package/docs/specs/provider-execution-attestation-v1.md +69 -0
  47. package/openapi/openapi.yaml +15 -0
  48. package/package.json +390 -148
  49. package/public/about.html +2 -2
  50. package/public/ai-malpractice-prevention.html +7 -7
  51. package/public/blog/a-10-dollar-vps-is-not-a-computer.html +143 -0
  52. package/public/blog/a-receipt-is-not-world-state.html +388 -0
  53. package/public/blog/git-at-agent-scale.html +374 -0
  54. package/public/blog/no-llm-in-the-gate.html +133 -0
  55. package/public/blog.html +80 -0
  56. package/public/case-studies.html +16 -1
  57. package/public/compare.html +28 -0
  58. package/public/diagnostic.html +216 -7
  59. package/public/docs/connectors.html +39 -0
  60. package/public/federal.html +2 -2
  61. package/public/founders.html +639 -0
  62. package/public/index.html +87 -9
  63. package/public/install.html +8 -8
  64. package/public/learn.html +39 -0
  65. package/public/numbers.html +2 -2
  66. package/public/peter.html +310 -0
  67. package/public/platform-partners.html +119 -0
  68. package/public/pricing.html +24 -3
  69. package/public/privacy.html +117 -0
  70. package/public/pro.html +17 -0
  71. package/public/support.html +62 -0
  72. package/public/terms.html +130 -0
  73. package/public/third-party-notices.html +95 -0
  74. package/public/yt.html +351 -0
  75. package/scripts/action-receipts.js +133 -3
  76. package/scripts/adaptive-governance-arena.js +349 -0
  77. package/scripts/admin-override.js +205 -0
  78. package/scripts/agent-action-inventory.js +869 -0
  79. package/scripts/agent-audit-trace.js +42 -2
  80. package/scripts/agent-egress-policy.js +1117 -0
  81. package/scripts/agent-memory-lifecycle.js +141 -2
  82. package/scripts/agent-operations-planner.js +441 -1
  83. package/scripts/agent-readiness.js +68 -0
  84. package/scripts/agent-security-central.js +647 -0
  85. package/scripts/allowlist-bridge-honesty.js +417 -0
  86. package/scripts/async-job-runner.js +102 -11
  87. package/scripts/audit-trail.js +212 -0
  88. package/scripts/billing.js +1 -1
  89. package/scripts/broker-execution-receipts.js +719 -0
  90. package/scripts/budget-aware-gates-proof.js +423 -0
  91. package/scripts/claude-feedback-sync.js +29 -3
  92. package/scripts/claw-harness-production.js +237 -0
  93. package/scripts/cli-schema.js +163 -1
  94. package/scripts/codex-runbook-flywheel.js +318 -0
  95. package/scripts/context-footprint.js +186 -0
  96. package/scripts/contextfs.js +143 -61
  97. package/scripts/dashboard.js +251 -32
  98. package/scripts/deepseek-v4-runtime-guardrails.js +72 -6
  99. package/scripts/docker-sandbox-planner.js +18 -0
  100. package/scripts/double-blind-eval-protocol.js +252 -0
  101. package/scripts/edotenv-rl-gateway.js +259 -0
  102. package/scripts/ensure-production-search-corpus.js +162 -0
  103. package/scripts/eval-holdout.js +311 -0
  104. package/scripts/feedback-aggregate.js +21 -2
  105. package/scripts/feedback-loop.js +87 -5
  106. package/scripts/feedback-quality.js +9 -0
  107. package/scripts/file-ledger-lock.js +4 -1
  108. package/scripts/financial-control-plane.js +41 -1
  109. package/scripts/find-dormant-requires.js +118 -0
  110. package/scripts/fs-utils.js +84 -8
  111. package/scripts/gates-engine.js +810 -63
  112. package/scripts/generate-case-study-outreach.js +24 -15
  113. package/scripts/git-at-scale.js +628 -0
  114. package/scripts/governance-conflict-audit.js +1650 -0
  115. package/scripts/governance-difficulty-curriculum.js +328 -0
  116. package/scripts/graphrag-retrieval.js +275 -0
  117. package/scripts/gurobi-optimizer.js +324 -0
  118. package/scripts/gurobi_optimizer.py +485 -0
  119. package/scripts/harness-selector.js +82 -1
  120. package/scripts/hidden-entry-points.js +284 -0
  121. package/scripts/human-escalation.js +199 -1
  122. package/scripts/hybrid-feedback-context.js +152 -19
  123. package/scripts/intent-governed-execution.js +602 -0
  124. package/scripts/intervention-policy.js +123 -20
  125. package/scripts/jit-harness-compose.js +628 -0
  126. package/scripts/jsonl-watcher.js +10 -0
  127. package/scripts/lesson-embedding-index.js +95 -12
  128. package/scripts/lesson-retrieval.js +105 -19
  129. package/scripts/local-model-profile.js +19 -2
  130. package/scripts/mailer/resend-mailer.js +1 -1
  131. package/scripts/matryoshka-embedding.js +235 -0
  132. package/scripts/mcp-oauth.js +42 -4
  133. package/scripts/mcp-session-handles.js +1016 -0
  134. package/scripts/mcp-wiring-doctor.js +314 -0
  135. package/scripts/memory-firewall.js +115 -2
  136. package/scripts/memory-scope-readiness.js +299 -0
  137. package/scripts/memory-vs-rag-route.js +161 -0
  138. package/scripts/model-tier-router.js +148 -21
  139. package/scripts/nvidia-specdecode-al-doctor.js +536 -0
  140. package/scripts/openui-catalog-compose-honesty.js +593 -0
  141. package/scripts/operational-integrity.js +19 -1
  142. package/scripts/override-audit.js +213 -0
  143. package/scripts/package-manager-honesty-doctor.js +458 -0
  144. package/scripts/pr-manager.js +63 -1
  145. package/scripts/prove-herdr-adapter.js +52 -0
  146. package/scripts/prove-memory-pyramid-and-symbolic-canvas.js +95 -0
  147. package/scripts/prove-workos.js +73 -0
  148. package/scripts/provider-attestation-conformance.js +192 -0
  149. package/scripts/provider-receipt-contract.js +136 -0
  150. package/scripts/qwen38-max-cost-optimizer.js +401 -0
  151. package/scripts/radware-threat-defense.js +280 -0
  152. package/scripts/rag-embedding-identity.js +221 -0
  153. package/scripts/rag-precision-guardrails.js +112 -2
  154. package/scripts/remote-feedback-capture.js +159 -0
  155. package/scripts/research-agent-harness.js +256 -0
  156. package/scripts/rsi-safety-hillclimb.js +200 -0
  157. package/scripts/rule-sprawl.js +188 -0
  158. package/scripts/schedule-manager.js +147 -0
  159. package/scripts/self-heal.js +8 -0
  160. package/scripts/session-lease.js +415 -0
  161. package/scripts/simatree-data-governance.js +347 -0
  162. package/scripts/slo-alert-engine.js +172 -7
  163. package/scripts/solver-parity.js +539 -0
  164. package/scripts/stealth-memory-injection-gate.js +333 -0
  165. package/scripts/switchyard-router.js +366 -0
  166. package/scripts/telemetry-analytics.js +84 -27
  167. package/scripts/temporal-decay-weighting.js +138 -0
  168. package/scripts/test-all.js +165 -0
  169. package/scripts/token-savings.js +42 -0
  170. package/scripts/tool-kpi-tracker.js +108 -5
  171. package/scripts/tool-registry.js +193 -5
  172. package/scripts/universal-claim-evaluator.js +14 -2
  173. package/scripts/vector-store.js +279 -9
  174. package/scripts/workflow-notebook.js +391 -0
  175. package/scripts/workflow-sentinel.js +111 -12
  176. package/scripts/workos-production-guard.js +260 -0
  177. package/scripts/workspace-search-route.js +515 -0
  178. package/server.json +2 -2
  179. package/src/agent-identity-boundary.js +76 -0
  180. package/src/agent-retrieval-cache.js +155 -0
  181. package/src/alert-noise-ledger.js +502 -0
  182. package/src/api/server.js +724 -153
  183. package/src/git-fast-cache.js +220 -0
  184. package/src/git-wal-sync.js +156 -0
  185. package/src/hash-anchored-edit.js +82 -0
  186. package/src/hermes-platform-protocol.js +475 -0
  187. package/src/hermes-sync-plane.js +241 -0
  188. package/src/index.js +30 -1
  189. package/src/iso42001-compliance-guard.js +97 -0
  190. package/src/latency-budget.js +244 -0
  191. package/src/mcp-writeguard.js +316 -0
  192. package/src/miminions-adapter.js +106 -0
  193. package/src/pipeline-compass.js +104 -0
  194. package/src/ppl-alert-pipeline.js +284 -0
  195. package/src/rendezvous-router.js +90 -0
  196. package/src/security-questionnaire.js +195 -0
@@ -181,6 +181,29 @@ function detectStopHookRegistered(projectRoot, existsSync, readFileSync) {
181
181
  }
182
182
  }
183
183
 
184
+ function detectPreToolUseHookRegistered(projectRoot, existsSync = fs.existsSync, readFileSync = fs.readFileSync) {
185
+ try {
186
+ const settingsPath = path.join(projectRoot, '.claude', 'settings.json');
187
+ if (!existsSync(settingsPath)) return false;
188
+ const settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
189
+ const preToolUse = settings?.hooks?.PreToolUse || [];
190
+ const flat = Array.isArray(preToolUse)
191
+ ? preToolUse.flatMap((entry) => entry?.hooks || [entry])
192
+ : [];
193
+ return flat.some((hook) => {
194
+ const command = String(hook?.command || '');
195
+ return (
196
+ command.includes('thumbgate') ||
197
+ command.includes('gate-check') ||
198
+ command.includes('hook-runtime') ||
199
+ command.includes('hook-pre-tool-use')
200
+ );
201
+ });
202
+ } catch {
203
+ return false;
204
+ }
205
+ }
206
+
184
207
  function recommendationForClaimState({
185
208
  evaluatorReady,
186
209
  configLoadFailed,
@@ -254,6 +277,31 @@ function summarizeClaimVerification(projectRoot = PROJECT_ROOT, deps = {}) {
254
277
  };
255
278
  }
256
279
 
280
+ function summarizeGitScale(projectRoot) {
281
+ try {
282
+ const { getRepoRoot, evaluateGitScaleHealth } = require('./git-at-scale');
283
+ getRepoRoot(projectRoot);
284
+ const health = evaluateGitScaleHealth(projectRoot);
285
+ const card = health;
286
+ const isBlocking = health.blocking === true;
287
+ return {
288
+ ready: !isBlocking,
289
+ skipped: false,
290
+ scorecard: card,
291
+ recommendation: card.healthy
292
+ ? 'Git scale indexes are present; origin is the source of truth and the local tree is a warm cache.'
293
+ : `Git scale hygiene: ${card.unhealthyReasons.join(', ')}. Run npm run git:scale:tune && npm run git:scale:maintenance.`,
294
+ };
295
+ } catch {
296
+ return {
297
+ ready: true,
298
+ skipped: true,
299
+ scorecard: null,
300
+ recommendation: 'Not a git repository; Git scale scorecard skipped.',
301
+ };
302
+ }
303
+ }
304
+
257
305
  function generateAgentReadinessReport({
258
306
  projectRoot = PROJECT_ROOT,
259
307
  mcpProfile = null,
@@ -263,6 +311,9 @@ function generateAgentReadinessReport({
263
311
  const permissions = summarizePermissionTier(mcpProfile || getActiveMcpProfile());
264
312
  const claimVerification = summarizeClaimVerification(projectRoot);
265
313
 
314
+ const preToolUseHookRegistered = detectPreToolUseHookRegistered(projectRoot);
315
+ const gitScale = summarizeGitScale(projectRoot);
316
+
266
317
  const warnings = [];
267
318
  if (!runtime.isolated) warnings.push(runtime.recommendation);
268
319
  if (!bootstrap.ready) warnings.push(bootstrap.recommendation);
@@ -273,6 +324,14 @@ function generateAgentReadinessReport({
273
324
  if (!claimVerification.evaluatorReady || claimVerification.configLoadFailed) {
274
325
  warnings.push(claimVerification.recommendation);
275
326
  }
327
+ if (!preToolUseHookRegistered) {
328
+ warnings.push(
329
+ 'No ThumbGate PreToolUse hook found in .claude/settings.json. Run `npx thumbgate init --wire-hooks` before expecting gates to fire.'
330
+ );
331
+ }
332
+ if (!gitScale.skipped && !gitScale.ready) {
333
+ warnings.push(gitScale.recommendation);
334
+ }
276
335
 
277
336
  return {
278
337
  generatedAt: new Date().toISOString(),
@@ -282,11 +341,14 @@ function generateAgentReadinessReport({
282
341
  bootstrap,
283
342
  permissions,
284
343
  claimVerification,
344
+ preToolUseHookRegistered,
345
+ gitScale,
285
346
  articleAlignment: {
286
347
  runtimeIsolation: runtime.isolated,
287
348
  contextConditioning: bootstrap.ready,
288
349
  permissionEnvelope: permissions.ready,
289
350
  factualClaimRecheck: claimVerification.ready,
351
+ preToolUseHook: preToolUseHookRegistered,
290
352
  },
291
353
  warnings,
292
354
  };
@@ -303,6 +365,10 @@ function reportToText(report) {
303
365
  if (report.bootstrap.missingRequired.length > 0) {
304
366
  lines.push(` Missing: ${report.bootstrap.missingRequired.join(', ')}`);
305
367
  }
368
+ if (report.gitScale && !report.gitScale.skipped) {
369
+ lines.push(`Git scale: ${report.gitScale.ready ? 'healthy' : 'needs_attention'}`);
370
+ lines.push(` Recommendation: ${report.gitScale.recommendation}`);
371
+ }
306
372
  lines.push(`Permissions: ${report.permissions.profile} (${report.permissions.tier})`);
307
373
  lines.push(` Write-capable tools: ${report.permissions.writeCapableTools.length}`);
308
374
  lines.push(` Recommendation: ${report.permissions.recommendation}`);
@@ -336,7 +402,9 @@ module.exports = {
336
402
  summarizeClaimVerification,
337
403
  recommendationForClaimState,
338
404
  detectStopHookRegistered,
405
+ detectPreToolUseHookRegistered,
339
406
  generateAgentReadinessReport,
407
+ summarizeGitScale,
340
408
  reportToText,
341
409
  };
342
410