thumbgate 1.37.1 → 1.37.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.37.1",
+  "version": "1.37.2",
   "description": "ThumbGate Pre-Action Checks self-improve from ranked lessons and repeated failures, hard-block detected secret leaks, and block matches in strict mode.",
   "homepage": "https://thumbgate.ai",
   "repository": {
@@ -445,7 +445,15 @@
     ".agents/skills/jit-harness-compare-not-clone/",
     "scripts/jit-harness-compose.js",
     ".agents/skills/gitlab-sandbox-allowlist-not-trust/",
-    ".agents/skills/openui-catalog-compose-honesty/"
+    ".agents/skills/openui-catalog-compose-honesty/",
+    "scripts/cobble-hot-store-split.js",
+    ".agents/skills/cobble-hot-store-compare-not-clone/",
+    "scripts/token-shunt-honesty.js",
+    ".agents/skills/token-shunt-honesty-not-clone/",
+    "scripts/typesafe-typed-questions.js",
+    ".agents/skills/typesafe-typed-questions-not-clone/",
+    "scripts/colab-compute-honesty.js",
+    ".agents/skills/colab-compute-honesty-not-clone/"
   ],
   "scripts": {
     "canary:snapshot": "node scripts/gate-decision-canary.js --snapshot",
@@ -733,7 +741,7 @@
     "test:quality": "node --test tests/validate-feedback.test.js tests/feedback-quality-eval-python.test.js tests/eval-gate-classifier.test.js",
     "test:intelligence": "node --test tests/intelligence.test.js",
     "test:training-export": "node --test tests/training-export.test.js tests/databricks-export.test.js",
-    "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/codeql-workflow-lockstep.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js tests/packed-feedback-retrieval-e2e.test.js tests/packed-provider-payment-reconciler-e2e.test.js tests/packed-revenue-remediation-e2e.test.js tests/ensure-production-search-corpus.test.js tests/prove-production-authenticated.test.js tests/verify-npm-githead.test.js",
+    "test:deployment": "node --test tests/deployment.test.js tests/deploy-policy.test.js tests/publish-decision.test.js tests/changeset-check.test.js tests/release-notes.test.js tests/sonarcloud-workflow.test.js tests/codeql-workflow-lockstep.test.js tests/package-boundary.test.js tests/public-package-boundary.test.js tests/packed-feedback-retrieval-e2e.test.js tests/packed-provider-payment-reconciler-e2e.test.js tests/packed-revenue-remediation-e2e.test.js tests/ensure-production-search-corpus.test.js tests/prove-production-authenticated.test.js tests/verify-npm-githead.test.js tests/npm-oidc-sept2026-publish.test.js",
     "test:operational-integrity": "node --test tests/operational-integrity.test.js tests/sync-branch-protection.test.js tests/sync-repository-rulesets.test.js",
     "test:workflow": "node --test tests/parallel-workflow.test.js tests/parallel-workflow-public.test.js tests/workflow-contract.test.js tests/positioning-contract.test.js tests/docs-claim-hygiene.test.js tests/thumbgate-scope.test.js tests/workflow-runs.test.js tests/workflow-sprint-intake.test.js tests/workflow-intake-queue.test.js tests/workflow-notebook.test.js tests/revenue-pack-utils.test.js tests/apollo-acquisition.test.js tests/sales-pipeline.test.js tests/provider-payment-reconciler.test.js tests/reddit-dm-outreach-evidence.test.js tests/gtm-sales-evidence-commands.test.js tests/revenue-action-eligibility.test.js tests/revenue-evidence-remediation.test.js tests/gtm-revenue-action-eligibility.test.js tests/revenue-offer-ladder.test.js tests/revenue-offer-system.test.js tests/buyer-paths.test.js tests/github-outreach.test.js tests/enterprise-story.test.js tests/guide-conversion-path.test.js tests/buyer-intent-revenue-assist.test.js && node --test tests/eval-proof-pack-pages.test.js && npm run test:proof-pack-cadence",
     "test:revenue-evidence-remediation": "node --test tests/revenue-evidence-remediation.test.js",
@@ -969,7 +977,7 @@
     "openui-catalog-compose-honesty": "node scripts/openui-catalog-compose-honesty.js",
     "test:budget-aware-gates-proof": "node --test tests/budget-aware-gates-proof.test.js",
     "test:business-function-agents": "node --test tests/business-function-agent-team.test.js",
-    "test:high-roi": "node --test tests/high-roi.test.js tests/gurobi-optimizer.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/business-function-agent-team.test.js tests/radware-threat-defense.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/nvidia-specdecode-al-doctor.test.js tests/package-manager-honesty-doctor.test.js tests/openui-catalog-compose-honesty.test.js tests/gist-prompt-budget.test.js tests/workload-identity-honesty.test.js tests/config-strict-parse.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/rag-embedding-identity.test.js tests/openclaw-agent-governance-kit.test.js tests/agent-operations-planner.test.js tests/aws-blocks-guardrails.test.js tests/vlt-proof.test.js tests/hf-context-course.test.js tests/proof-common.test.js tests/mcp-session-handles.test.js tests/agent-egress-policy.test.js tests/allowlist-bridge-honesty.test.js tests/budget-aware-gates-proof.test.js tests/edotenv-rl-gateway.test.js tests/rsi-safety-hillclimb.test.js tests/research-agent-harness.test.js tests/rule-sprawl.test.js tests/solver-parity.test.js tests/six-function-agent-team.test.js && npm run test:jit-harness-compose && npm run test:workspace-search-route && npm run test:intent-governed-execution",
+    "test:high-roi": "node --test tests/high-roi.test.js tests/gurobi-optimizer.test.js tests/model-candidates.test.js tests/autonomous-workflow.test.js tests/high-roi-agent-workflows.test.js tests/business-function-agent-team.test.js tests/radware-threat-defense.test.js tests/interaction-model.test.js tests/interaction-model-e2e.test.js tests/code-graph-guardrails.test.js tests/proxy-pointer-rag-guardrails.test.js tests/rag-precision-guardrails.test.js tests/ai-engineering-stack-guardrails.test.js tests/long-running-agent-context-guardrails.test.js tests/reasoning-efficiency-guardrails.test.js tests/deepseek-v4-runtime-guardrails.test.js tests/nvidia-specdecode-al-doctor.test.js tests/package-manager-honesty-doctor.test.js tests/openui-catalog-compose-honesty.test.js tests/gist-prompt-budget.test.js tests/workload-identity-honesty.test.js tests/config-strict-parse.test.js tests/upstream-contribution-engine.test.js tests/proactive-agent-eval-guardrails.test.js tests/reward-hacking-guardrails.test.js tests/chatgpt-ads-readiness-pack.test.js tests/oss-pr-opportunity-scout.test.js tests/agent-design-governance.test.js tests/gemini-embedding-policy.test.js tests/rag-embedding-identity.test.js tests/openclaw-agent-governance-kit.test.js tests/agent-operations-planner.test.js tests/aws-blocks-guardrails.test.js tests/vlt-proof.test.js tests/hf-context-course.test.js tests/proof-common.test.js tests/mcp-session-handles.test.js tests/agent-egress-policy.test.js tests/allowlist-bridge-honesty.test.js tests/budget-aware-gates-proof.test.js tests/edotenv-rl-gateway.test.js tests/rsi-safety-hillclimb.test.js tests/research-agent-harness.test.js tests/rule-sprawl.test.js tests/solver-parity.test.js tests/six-function-agent-team.test.js && npm run test:jit-harness-compose && npm run test:workspace-search-route && npm run test:intent-governed-execution && npm run test:cobble-hot-store-split && npm run test:token-shunt-honesty && npm run test:typesafe-typed-questions && npm run test:colab-compute-honesty",
     "test:public-static-assets": "node --test tests/public-static-assets.test.js tests/public-checkout-intent-gate.test.js tests/public-enterprise-capability-boundary.test.js tests/founders-conversion-page.test.js",
     "test:token-savings": "node --test tests/token-savings.test.js",
     "test:cost-cli": "node --test tests/cost-cli.test.js tests/conversion-receipt.test.js",
@@ -1173,6 +1181,14 @@
     "graphify:stale": "node scripts/graphify-staleness-check.js",
     "test:graphify": "node --test tests/graphify-readiness.test.js",
     "test:jit-harness-compose": "node --test tests/jit-harness-compose.test.js",
+    "test:cobble-hot-store-split": "node --test tests/cobble-hot-store-split.test.js",
+    "cobble-hot-store-split": "node scripts/cobble-hot-store-split.js",
+    "test:token-shunt-honesty": "node --test tests/token-shunt-honesty.test.js",
+    "token-shunt-honesty": "node scripts/token-shunt-honesty.js",
+    "test:typesafe-typed-questions": "node --test tests/typesafe-typed-questions.test.js",
+    "typesafe-typed-questions": "node scripts/typesafe-typed-questions.js",
+    "test:colab-compute-honesty": "node --test tests/colab-compute-honesty.test.js",
+    "colab-compute-honesty": "node scripts/colab-compute-honesty.js",
     "test:workspace-search-route": "node --test tests/workspace-search-route.test.js",
     "test:intent-governed-execution": "node --test tests/intent-governed-execution.test.js",
     "memory:vs-rag": "node scripts/memory-vs-rag-route.js",
@@ -1237,7 +1253,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.122.0",
-    "@google/genai": "2.19.0",
+    "@google/genai": "2.21.0",
     "@lancedb/lancedb": "^0.38.0",
     "apache-arrow": "^18.1.0",
     "better-sqlite3": "^12.9.0",
@@ -1261,7 +1277,7 @@
     },
     "js-yaml": "5.4.1",
     "sharp": "0.35.4",
-    "undici": "8.10.0"
+    "undici": "8.10.2"
   },
   "mcpName": "io.github.IgorGanapolsky/thumbgate",
   "devDependencies": {
@@ -1269,7 +1285,7 @@
     "@changesets/cli": "^3.0.0",
     "@playwright/test": "^1.62.1",
     "c8": "^12.0.0",
-    "undici": "8.10.0"
+    "undici": "8.10.2"
   },
   "hotfix": "gate-check-bypass-2026-06-03"
 }

package/public/index.html

@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <meta name="generator" content="ThumbGate">
   <meta name="author" content="Igor Ganapolsky">
-  <meta name="thumbgate-version" content="1.37.1">
+  <meta name="thumbgate-version" content="1.37.2">
   __GOOGLE_SITE_VERIFICATION_META__
   <link rel="icon" type="image/png" href="/thumbgate-icon.png">
   <link rel="canonical" href="__APP_ORIGIN__/">
@@ -948,7 +948,7 @@ next      decision recorded before execution</pre>
 
   <footer>
     <div class="shell footer-inner">
-      <span>ThumbGate · MIT License · npm v1.37.1</span>
+      <span>ThumbGate · MIT License · npm v1.37.2</span>
       <div class="footer-links">
         <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
         <a href="/guide">Technical setup</a>

package/public/install.html

@@ -139,7 +139,7 @@ __GA_BOOTSTRAP__
       <a class="btn-secondary" href="/diagnostic?utm_source=install_page&utm_medium=owned_page&utm_campaign=marketplace_distribution">Harden one workflow</a>
     </div>
     <div class="proof-strip" aria-label="Verified live distribution surfaces">
-      <div class="proof"><strong>npm</strong><span>thumbgate@1.37.1</span></div>
+      <div class="proof"><strong>npm</strong><span>thumbgate@1.37.2</span></div>
       <div class="proof"><strong>VS Code</strong><span>Marketplace version live</span></div>
       <div class="proof"><strong>Open VSX</strong><span>Antigravity-compatible path</span></div>
       <div class="proof"><strong>MCP Registry</strong><span>1.27.20 is latest</span></div>
@@ -152,11 +152,11 @@ __GA_BOOTSTRAP__
     <h2>Choose the install path that matches your agent.</h2>
     <p class="section-lede">Use the local CLI path for immediate enforcement. Use marketplace installs where your editor supports them. Use the diagnostic path when you need a human-reviewed gate map for one risky workflow. New install: <a href="/guides/progressive-wiring">prove the pipe first</a> (doctor green, empty dashboard OK) before expecting a gate to fire.</p>
     <div class="grid">
-      <article class="card"><h3>CLI and MCP-compatible agents</h3><p>Fastest path for Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and local MCP-compatible agents.</p><pre><code>npx -y thumbgate@1.37.1 doctor
-npx -y thumbgate@1.37.1 doctor --fix</code></pre></article>
-      <article class="card"><h3>Claude Desktop</h3><p>Use the npm-backed MCP server today. The Claude Desktop `.mcpb` directory submission packet is prepared separately.</p><pre><code>claude mcp add thumbgate -- npx --yes --package thumbgate@1.37.1 thumbgate serve</code></pre></article>
-      <article class="card"><h3>Cursor</h3><p>The public Cursor Marketplace listing is not live yet. Use the CLI wiring while the dashboard submission is resolved.</p><pre><code>npx -y thumbgate@1.37.1 init --agent cursor</code></pre></article>
-      <article class="card"><h3>Codex</h3><p>Use the local adapter now. Public Codex self-serve plugin publishing is not open yet, so the GitHub Release asset is the distribution proof.</p><pre><code>npx -y thumbgate@1.37.1 init --agent codex</code></pre></article>
+      <article class="card"><h3>CLI and MCP-compatible agents</h3><p>Fastest path for Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode, and local MCP-compatible agents.</p><pre><code>npx -y thumbgate@1.37.2 doctor
+npx -y thumbgate@1.37.2 doctor --fix</code></pre></article>
+      <article class="card"><h3>Claude Desktop</h3><p>Use the npm-backed MCP server today. The Claude Desktop `.mcpb` directory submission packet is prepared separately.</p><pre><code>claude mcp add thumbgate -- npx --yes --package thumbgate@1.37.2 thumbgate serve</code></pre></article>
+      <article class="card"><h3>Cursor</h3><p>The public Cursor Marketplace listing is not live yet. Use the CLI wiring while the dashboard submission is resolved.</p><pre><code>npx -y thumbgate@1.37.2 init --agent cursor</code></pre></article>
+      <article class="card"><h3>Codex</h3><p>Use the local adapter now. Public Codex self-serve plugin publishing is not open yet, so the GitHub Release asset is the distribution proof.</p><pre><code>npx -y thumbgate@1.37.2 init --agent codex</code></pre></article>
     </div>
   </div>
 </section>
@@ -165,7 +165,7 @@ npx -y thumbgate@1.37.1 doctor --fix</code></pre></article>
     <h2>Verified public surfaces.</h2>
     <p class="section-lede">These are the surfaces safe to claim in public copy right now. Pending surfaces are listed so buyers do not get sent to dead marketplace pages.</p>
     <div class="status-list">
-      <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://www.npmjs.com/package/thumbgate">npm package</a></strong><span>`thumbgate@1.37.1` is the canonical runtime install.</span></div></div>
+      <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://www.npmjs.com/package/thumbgate">npm package</a></strong><span>`thumbgate@1.37.2` is the canonical runtime install.</span></div></div>
       <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://marketplace.visualstudio.com/items?itemName=igorganapolsky.thumbgate">VS Code Marketplace</a></strong><span>Marketplace version-list API includes `1.27.20`.</span></div></div>
       <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://open-vsx.org/extension/igorganapolsky/thumbgate">Open VSX</a></strong><span>Public registry latest version is `1.27.20`; use this path for VS Code-compatible IDEs that consume Open VSX.</span></div></div>
       <div class="status"><span class="badge live">LIVE</span><div><strong><a href="https://registry.modelcontextprotocol.io/v0/servers?search=thumbgate">MCP Registry</a></strong><span>Public search returns `io.github.IgorGanapolsky/thumbgate` version `1.27.20` as latest.</span></div></div>

package/public/numbers.html

@@ -25,7 +25,7 @@
   "alternateName": "thumbgate",
   "applicationCategory": "DeveloperApplication",
   "operatingSystem": "Cross-platform, Node.js >=18.18.0",
-  "softwareVersion": "1.37.1",
+  "softwareVersion": "1.37.2",
   "url": "https://thumbgate-production.up.railway.app/numbers",
   "dateModified": "2026-08-03",
   "creator": {
@@ -202,7 +202,7 @@
 <main class="container">
   <h1>The Numbers</h1>
   <p class="subtitle">Generated first-party operational snapshot from the ThumbGate runtime. This is not customer traction, install volume, revenue, or proof that a configured gate has fired.</p>
-  <div class="freshness">Updated: 2026-08-03 · Version 1.37.1</div>
+  <div class="freshness">Updated: 2026-08-03 · Version 1.37.2</div>
   <div class="truth-note"><strong>Read this first:</strong> configured checks are inventory. Recorded blocks and warnings are usage evidence. This snapshot currently reports 0 recorded hard-block event(s) and 0 recorded warning event(s).</div>
 
   <h2>Gate enforcement</h2>

package/scripts/cli-schema.js

@@ -475,6 +475,46 @@ const CLI_COMMANDS = [
     ],
   }),
 
+  discoveryCommand({
+    name: 'colab-compute-honesty',
+    aliases: ['colab-honesty', 'compute-unit-honesty'],
+    description: 'Colab /signup FORMAT steal: Compute Units ≠ dedicated GPU; Subscribe ≠ receipt (does not buy Pro/Pro+ or clone colab-cli)',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero on fail' },
+      { name: 'claim', type: 'string', description: 'Claim to audit' },
+      { name: 'plan', type: 'string', description: 'free|payg|pro|proplus|unknown' },
+      { name: 'plan-proof', type: 'string', description: 'Live Current-plan receipt, not a Subscribe button' },
+      { name: 'snapshot', type: 'string', description: 'Live /signup snapshot JSON' },
+      { name: 'map-only', type: 'boolean', description: 'Print Colab → ThumbGate rail map' },
+      { name: 'claim-ready', type: 'boolean', description: 'Fail unless compute proof is clean' },
+      { name: 'clone-colab', type: 'boolean', description: 'Refuse Colab-runner SKU clone' },
+      { name: 'buy-pro', type: 'boolean', description: 'Refuse buying Colab Pro/Pro+/CU' },
+    ],
+  }),
+
+  discoveryCommand({
+    name: 'typesafe-typed-questions',
+    aliases: ['typesafe-hook', 'typed-questions', 'jev-typed-questions'],
+    description: 'TypeSafe FORMAT steal: typed noul/choice/score over PreToolUse state, code-owned pass/review/block (does not install typesafe-sdk or clone Jev)',
+    flags: [
+      jsonFlag(),
+      { name: 'strict', type: 'boolean', description: 'Exit non-zero on fail or actionable findings' },
+      { name: 'root', type: 'string', description: 'Repo root for relative paths (default cwd)' },
+      { name: 'payload', type: 'string', description: 'Path to PreToolUse JSON payload' },
+      { name: 'battery', type: 'string', description: 'Path to typed questions JSON' },
+      { name: 'tool-name', type: 'string', description: 'Shortcut tool_name' },
+      { name: 'command', type: 'string', description: 'Shortcut tool_input.command' },
+      { name: 'policy', type: 'string', description: 'strict|permissive route policy' },
+      { name: 'map-only', type: 'boolean', description: 'Print TypeSafe → ThumbGate rail map' },
+      { name: 'claim-ready', type: 'boolean', description: 'Fail unless code owns the route' },
+      { name: 'clone-jev', type: 'boolean', description: 'Refuse TypeSafe/Jev SKU clone' },
+      { name: 'use-typesafe-api', type: 'boolean', description: 'Refuse live api.typesafe.ai as the gate' },
+      { name: 'llm-adjudicate', type: 'boolean', description: 'Refuse LLM adjudicator (#3690/#3687 parked)' },
+      { name: 'model-emitted-verdict', type: 'string', description: 'Refuse a model-emitted pass/review/block' },
+    ],
+  }),
+
   discoveryCommand({
     name: 'openui-catalog-compose-honesty',
     aliases: ['openui-honesty-doctor', 'catalog-compose-honesty', 'repair-before-compose-claim'],