thumbgate 1.37.2 → 1.37.3

package/.agents/skills/article-syndication-pipeline/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: article-syndication-pipeline
+description: Technical article syndication pipeline for cross-posting Dev.to articles to CoderLegion and other developer platforms with canonical URL preservation, UTM parameter attribution, and contributor onboarding compliance.
+---
+
+# ✍️ Article Syndication & Contributor Pipeline
+
+This skill guides the autonomous syndication of ThumbGate technical discoveries, security postmortems, and engineering deep dives across developer platforms (Dev.to, CoderLegion, Hashnode, Medium).
+
+---
+
+## 🎯 Architecture & Operating Directives
+
+1. **Canonical SEO Integrity:**
+   - Always preserve the primary origin as the canonical URL (e.g. `https://dev.to/igorganapolsky/...`).
+   - Syndicated copies on CoderLegion or elsewhere must link back to avoid search engine duplicate-content penalties.
+2. **First-Party Revenue Attribution:**
+   - All inbound links to `thumbgate.ai` must include UTM campaign tags (`utm_source=coderlegion`, `utm_medium=community`, `utm_campaign=guest-post`).
+   - Conversion links (Pro license checkout) must route through `/go/pro` (`https://thumbgate.ai/go/pro?utm_source=...`) to ensure server-side redirect logging.
+3. **CoderLegion Contributor Compliance:**
+   - URL import endpoint: `https://coderlegion.com/import-post`.
+   - Supports 2 imported Dev.to articles with full attribution.
+   - Contributor checklist: `https://coderlegion.com/guest-blog-checklists`.
+   - All imported posts undergo editorial review before appearing on the main feed.
+
+---
+
+## 🛠️ Step-by-Step Workflow
+
+1. **Verify Original Article:**
+   Verify original URL exists, returns HTTP 200, and has correct canonical tags.
+2. **Fetch via Platform Parser:**
+   Submit `import_url` to `https://coderlegion.com/import-post`.
+3. **Review & Confirm Metadata:**
+   Confirm title, tags (`ai`, `security`, `architecture`, `opensource`), and backlink to canonical source.
+4. **Publish & Track:**
+   Submit publication step and record post URL in session log and Comet browser tab.

package/.agents/skills/ci-gha-buildkite-patterns-not-clone/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: ci-gha-buildkite-patterns-not-clone
+description: >
+  Buildkite pipeline architecture is FORMAT, not a ThumbGate CI vendor.
+  Steal first-fail step identity, PR fail-fast, needs:/wait honesty, skip
+  conditions, and GITHUB_STEP_SUMMARY annotations onto existing GitHub
+  Actions. Never add Buildkite Pipelines, agents, Test Engine, or a second
+  required check. Slash: /ci-gha-buildkite-patterns-not-clone.
+---
+
+# CI GHA Buildkite patterns — compare, do not clone
+
+## Goal
+
+Fail-closed GitHub Actions diagnosis for whom: ThumbGate public CI — so a
+red PR names the **first failed step**, cancels leftover PR runs, and never
+grows a Buildkite bill.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Migrate this public repo to Buildkite | Keep the required GHA contexts on `ubuntu-latest` |
+| Dump `--log-failed` first | `npx thumbgate ci-gha-buildkite-patterns --jobs-json=…` |
+| `gh run rerun` a queued job | Wait for Actions to drain |
+| Test Engine auto-quarantine | First fail is a regression until proven otherwise |
+| `cancel-in-progress: true` on `main` | Cancel PR reruns only |
+
+HARD fail closed. REFUSE SKU clones. This is **not a Buildkite clone**.
+Never migrate this public repo to Buildkite.
+
+## Reference
+
+- https://buildkite.com/docs/pipelines/best-practices/pipeline-design-and-structure
+- https://buildkite.com/docs/pipelines/configure/annotations
+- `scripts/ci-gha-buildkite-patterns.js`
+- Complements `/ci-first-fail` (same FORMAT, global copy)
+
+## Examples (show, don't tell)
+
+Weak: "Buildkite is faster, add it as a required check."
+
+Gold:
+
+```bash
+$ npx thumbgate ci-gha-buildkite-patterns --json --map-only
+ok: true
+$ npx thumbgate ci-gha-buildkite-patterns --json --migrate
+ok: false  # migrate_vendor
+```
+
+## Procedures
+
+```bash
+npx thumbgate ci-gha-buildkite-patterns --json --map-only
+npx thumbgate ci-gha-buildkite-patterns --json --workflow=.github/workflows/ci.yml
+npx thumbgate ci-gha-buildkite-patterns --json --jobs-json=jobs.json
+npm run test:ci-gha-buildkite-patterns
+```
+
+1. Name `first_fail.step` before opening logs.
+2. Absent required contexts → githubstatus.com, not a code blame.
+3. E2E shards stay `fail-fast: false` so merge-reports can still annotate (Buildkite `wait` + `continue_on_failure`).
+4. Do not vendor `buildkite-agent`.
+
+## Rubric
+
+- `--map-only` → `ok=true`
+- `--clone-buildkite` / `--migrate` / `--quarantine` / `--rerun-queued` → fail
+- live `ci.yml` concurrency excludes `main`
+- doctor tests PASS
+- evidence: `--json` in the same turn

package/.agents/skills/comet-session-logger/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: comet-session-logger
+description: Live session logger and observability dashboard driver for Comet browser. Ensures every PR, deployment status check, CoderLegion/Dev.to publication, and Railway production health metric is actively logged and visualized in Comet tabs.
+---
+
+# ☄️ Comet Session Logger & Visual HUD
+
+This skill governs the automated logging, tab orchestration, and visual tracking of all ThumbGate agentic tasks inside the **Comet** browser on macOS.
+
+---
+
+## 🎯 Purpose & Directives
+
+1. **CEO Visual Observability:** The CEO monitors agent progress via open tabs in Comet. Every major milestone must be reflected in Comet tabs without disrupting existing work.
+2. **Deterministic Tab Management:** Uses macOS AppleScript (`osascript`) to inspect, activate, create, or update Comet tabs.
+3. **Fail-Safe & Non-Destructive:** Never closes existing tabs; always reuses matching URLs or opens clean dedicated monitoring tabs.
+
+---
+
+## 🧭 Standard Tab Targets
+
+| Surface | Target URL | Trigger Milestone |
+|---------|------------|-------------------|
+| **Pull Requests** | `https://github.com/IgorGanapolsky/ThumbGate/pull/<NUM>` | After creating or advancing a PR |
+| **CI / Checks** | `https://github.com/IgorGanapolsky/ThumbGate/actions` | During workflow verification |
+| **Production Health** | `https://thumbgate-production.up.railway.app/health` | After deployment gate verification |
+| **Railway Console** | `https://railway.com/project/thumbgate-production` | When inspecting infrastructure |
+| **CoderLegion** | `https://coderlegion.com/import-post` | When onboarding or syndicating articles |
+| **Dev.to Dashboard** | `https://dev.to/dashboard` | When tracking article reach & analytics |
+
+---
+
+## 🛠️ AppleScript Orchestration Helpers
+
+```bash
+# Check existing Comet tabs
+osascript -e '
+tell application "Comet"
+    set outList to ""
+    repeat with w in windows
+        repeat with t in tabs of w
+            set outList to outList & (URL of t) & " | " & (title of t) & linefeed
+        end repeat
+    end repeat
+    return outList
+end tell'
+
+# Open or focus a specific URL in Comet
+open_comet_url() {
+  local target_url="$1"
+  osascript -e "
+  tell application \"Comet\"
+      activate
+      tell front window
+          make new tab with properties {URL:\"${target_url}\"}
+      end tell
+  end tell"
+}
+```

package/.agents/skills/datadog-llm-obs-compare-not-clone/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: datadog-llm-obs-compare-not-clone
+description: >
+  Datadog LLM Observability eBook is FORMAT, not a ThumbGate clone. Steal four
+  practices (operational metrics, injection+PII scrub, quality evals, e2e
+  parented spans) onto existing receipts/redaction/feedback/audit-trace.
+  Never vendor dd-trace, DatadogAgentObservability, or OTLP. Never dual-edit
+  PR #3881. Slash: /datadog-llm-obs-compare-not-clone.
+---
+
+# Datadog LLM-obs — compare, do not clone
+
+## Goal
+
+Produce fail-closed honesty for whom: ThumbGate agents claiming an LLM/agent
+run is observed — so errors, latency, tokens, injection/PII, quality, and
+parented spans exist on **existing** rails before any "we have observability" claim.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Clone Datadog Agent Observability / SDS / Clusters | Map 4 practices onto existing rails |
+| `npm install dd-trace` / `DD_API_KEY` LLM obs | `scripts/secret-redaction.js` + `agent-audit-trace.js` |
+| Dual-edit PR #3881 Datadog-style engine | Complement; orchestrator overlap is board-loop #3883 |
+| Dual-edit PR #3883 board-loop | Leave PR drain there |
+| OTLP-export prompt traces | Local receipts + redaction |
+| Quote Datadog MTTR as ours | Measure ThumbGate latency-budget / task-outcomes |
+| Hero Continuity / net-new obs SKU | ECI: maintenance of existing surfaces |
+
+HARD fail closed. REFUSE SKU clones.
+
+## Reference
+
+- https://lp.datadoghq.com/rs/875-UVY-685/images/eBook-LLMObservabilityBestPractices.pdf
+- `scripts/llm-obs-honesty.js`
+- `scripts/latency-budget.js` · `action-receipts.js` · `secret-redaction.js` · `agent-audit-trace.js` · `task-outcomes.js`
+- `/high-roi-steal-and-finish` · `/eci-thumbgate-ip-wall`
+
+## Examples (show, don't tell)
+
+Weak: Summarize the eBook and add a DatadogAgentObservability class.
+
+Gold:
+
+```bash
+$ npx thumbgate llm-obs-honesty --json
+ok: true
+status: ready
+$ npx thumbgate llm-obs-honesty --clone-datadog --json
+datadog_clone_refused
+```
+
+## Procedures
+
+```bash
+npx thumbgate llm-obs-honesty --json
+npx thumbgate llm-obs-honesty --map-only
+npx thumbgate llm-obs-honesty --trace=tests/fixtures/llm-obs-honesty-blind.json --json
+npm run test:llm-obs-honesty
+```
+
+1. Require operational counts + latency + tokens + budget alert.
+2. Require prompt-injection check + `secret-redaction.js` scrub.
+3. Require failure-to-answer, topic relevancy, toxicity (+ thumbs).
+4. Require parented retrieve/llm/tool spans with evidenceIds.
+5. Refuse `--clone-datadog`.
+
+## Rubric
+
+- gold default → `ok=true`
+- empty `{}` or blind fixture → `ok=false`
+- `--clone-datadog` → `datadog_clone_refused`
+- doctor: `npm run test:llm-obs-honesty` PASS
+- evidence: command output in the same turn

package/.agents/skills/deeppattern-discipline-honesty-not-clone/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: deeppattern-discipline-honesty-not-clone
+description: >
+  DeepPattern Agent Quality Gates + Decision Engine are neighbors, not a
+  ThumbGate clone. Steal layer-check (same-layer substitutes only) and
+  evidence-closeout (six required items before "done") onto existing rails.
+  Never install AQG/DE/dp-install or unpark a cross-vendor audit SKU.
+  Slash: /deeppattern-discipline-honesty-not-clone.
+---
+
+# DeepPattern discipline honesty — compare, do not clone
+
+## Goal
+
+Fail-closed comparative analysis and completion claims for whom: ThumbGate
+FORMAT steals and Completion Claim Contract — so L4 API gateways / hosted
+multi-model panels cannot be treated as PreToolUse substitutes, and "done"
+cannot pass without six evidence items.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Install AQG, Decision Engine, `dp-install` | `npx thumbgate deeppattern-discipline-honesty --json` |
+| Treat OpenRouter / LiteLLM / token pools as ThumbGate competitors | Tag L1–L8; same job-to-be-done only |
+| Claim done without evidence heading + six items | `--closeout=path.md --strict` |
+| Unpark LLM adjudicator / cross-vendor panel SKU | Deterministic local gates; hosted panel stays external |
+
+HARD fail closed. REFUSE SKU clones.
+
+## Reference
+
+- https://github.com/deeppatternai/agent-quality-gates (evidence-closeout)
+- https://github.com/deeppatternai/decision-engine (`/layer-check`)
+- ThumbGate Completion Claim Contract in `AGENTS.md` / `CLAUDE.md`
+- `scripts/deeppattern-discipline-honesty.js`
+
+## Examples (show, don't tell)
+
+Weak: "LiteLLM commoditizes ThumbGate because both route models."
+
+Gold:
+
+```bash
+$ npx thumbgate deeppattern-discipline-honesty --json --map-only
+ok: true
+$ npx thumbgate deeppattern-discipline-honesty --json \
+    --claim='LiteLLM replaces ThumbGate PreToolUse'
+ok: false  # cross_layer_substitute
+```
+
+## Procedures
+
+```bash
+npx thumbgate deeppattern-discipline-honesty --json --map-only
+npx thumbgate deeppattern-discipline-honesty --json --claim='DE replaces ThumbGate'
+npx thumbgate deeppattern-discipline-honesty --json --closeout=pr-body.md --strict
+npm run test:deeppattern-discipline-honesty
+```
+
+1. Tag subject + every cited product L1–L8 before competitive claims.
+2. Drop cross-layer substitutes; keep dependency language when honest.
+3. Before saying done/fixed/shipped: Evidence/Closeout heading + six items.
+4. Do not vendor AQG/DE.
+
+## Rubric
+
+- `--map-only` → `ok=true`
+- substitute claim naming L4/L2/L5 vs ThumbGate → `cross_layer_substitute`
+- `--clone-deeppattern` / `dp-install` → fail
+- closeout missing heading or item / placeholder → fail
+- doctor tests PASS
+- evidence: `--json` in the same turn

package/.agents/skills/thumbgate-board-loop/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: thumbgate-board-loop
+description: >
+  Autonomous ThumbGate Issues+PR wall loop. Classifies every open Issue and PR,
+  update-branches BEHIND green Dependabot, submits READY via pr:manage/Trunk,
+  comments DIRTY and ECI/umbrella issues. Never approve. Never --admin.
+  Auto-invoke on holdup screenshots, 18 open PRs, 4 open issues, 4/4 green
+  Dependabot wall, "what's the holdup". Slash: /thumbgate-board-loop.
+---
+
+# ThumbGate board loop
+
+## Goal
+
+Drain the GitHub Issues + PR wall without a CEO screenshot. The list-view
+**4/4** badge is not mergeable — those Dependabot PRs are usually `SUCCESS` +
+`BEHIND` after a Trunk land.
+
+## Constraints
+
+| NEVER | ALWAYS |
+| --- | --- |
+| Approve a PR / `--admin` / `gh pr merge --auto` | `npx thumbgate board-loop --apply --json` |
+| Treat 4/4 as READY | Classify `mss` + required checks (`test`, CodeQL, changeset, Socket, GitGuardian) |
+| Re-`pr:manage` a live `trunk-merge/pr-N` | Skip; that PR is already queued |
+| Close DIRTY <30d | Comment needs-rebase once (marker `<!-- thumbgate-board-loop -->`) |
+| Implement #3690/#3687 LLM adjudicator | ECI pause |
+| Dual-edit DIRTY #3650 graph layer | Leave it DIRTY |
+| GHA `schedule:` | Event-driven `workflow_run` + local LaunchAgent (CodeQL-only schedule policy) |
+
+## Reference
+
+- `scripts/thumbgate-board-loop.js`
+- `scripts/pr-manager.js`
+- `.github/workflows/agent-automerge.yml` (must resolve `workflow_run.head_sha` + `dependabot/*`)
+- `/thumbgate-pr-queue-autopilot` · `/thumbgate-issues-board-hygiene` · `/eci-thumbgate-ip-wall`
+
+## Examples (show, don't tell)
+
+Weak: Paste the 18-open screenshot and ask which PR to merge.
+
+Gold:
+
+```bash
+$ npx thumbgate board-loop --json
+counts.behind=8 counts.dirty=8 trunkQueued=[3874]
+$ npx thumbgate board-loop --apply --max-update-branch=1 --json
+# gh pr update-branch 3873
+```
+
+## Procedures
+
+```bash
+npx thumbgate board-loop --json
+npx thumbgate board-loop --apply --json
+npm run test:board-loop
+```
+
+1. Inventory open PRs + Issues.
+2. Skip trunk-merge drafts.
+3. One BEHIND green `update-branch` per tick (serial — each land re-BEHINDs siblings).
+4. One READY `pr-manager` / Trunk submit per tick.
+5. Comment Issues: ECI pause vs IMPLEMENT residual vs umbrella.
+6. Never approve.
+
+## Rubric
+
+- gold classify: SUCCESS+BEHIND → `update_branch`
+- trunk-merge draft → `skip`
+- `--apply` never emits `APPROVE` / `--admin` / `--auto`
+- doctor: `npm run test:board-loop` PASS
+- evidence: command output in the same turn

package/.agents/skills/thumbgate-daily-discoveries/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: thumbgate-daily-discoveries
+description: Autonomous daily publishing engine and monitoring skill for ThumbGate news and technical discoveries. Generates high-density engineering posts with full UTM attribution, synchronizes to Obsidian, schedules dual cron/launchd runs at 9:00 AM EST, and tracks publication ledgers.
+---
+
+# 📰 ThumbGate Daily Technical Discoveries & News Engine
+
+This skill automates the daily harvesting, synthesis, UTM attribution, and multi-channel publication of ThumbGate engineering discoveries and release news.
+
+---
+
+## 🎯 Architecture & Operating Principles
+
+1. **Daily Cadence (9:00 AM EST):** Runs once per calendar day. Avoids spam while establishing consistent technical authority.
+2. **Dual Scheduling Redundancy:**
+   - Primary: macOS crontab (`0 9 * * * /bin/bash scripts/thumbgate-daily-discoveries-publish.sh ...`)
+   - Fallback: macOS LaunchAgent (`~/Library/LaunchAgents/com.thumbgate.daily-publish.plist`)
+   - Note: GitHub Actions `schedule:` is strictly limited to `codeql.yml` per repo hygiene tests.
+3. **Full UTM Attribution & Tracked Redirects:**
+   - All outbound links to `thumbgate.ai` must use `buildUTMLink` from `scripts/social-analytics/utm.js`.
+   - Outbound pro/checkout links must route through `/go/pro` (`serveTrackedLinkRedirect` in `src/api/server.js`) to capture first-party funnel telemetry.
+4. **Multi-Surface Staging & Sync:**
+   - Staged locally at `docs/marketing/daily-discoveries/YYYY-MM-DD-<slug>.md`.
+   - Synchronized to the CEO's Obsidian Vault at `~/Documents/Igor/Research/Daily-Discoveries/`.
+   - Logged idempotently to `.thumbgate/daily-discoveries-ledger.jsonl`.
+   - Dispatches to Dev.to / Zernio if API keys are configured.
+
+---
+
+## 🛠️ CLI Commands & Usage
+
+```bash
+# Preview today's technical discovery without making mutations or network calls
+node scripts/thumbgate-daily-discoveries-publish.js --dry-run
+
+# Output structured JSON report
+node scripts/thumbgate-daily-discoveries-publish.js --json
+
+# Force publish/restage today's discovery even if already logged in ledger
+node scripts/thumbgate-daily-discoveries-publish.js --force
+
+# Shell wrapper (used by crontab / launchd)
+./scripts/thumbgate-daily-discoveries-publish.sh
+
+# Run test suite
+node --test tests/thumbgate-daily-discoveries-publish.test.js
+```
+
+---
+
+## 📋 Pre-Flight Verification Checklist
+
+- [ ] Verify `node --test tests/thumbgate-daily-discoveries-publish.test.js` passes.
+- [ ] Verify outbound links contain valid UTM parameters (`utm_source=daily_discoveries`, `utm_campaign=daily_technical_discoveries`).
+- [ ] Verify `launchctl list | grep thumbgate` reports exit code 0.
+- [ ] Verify `crontab -l | grep thumbgate` contains the 9:00 AM daily trigger.
+- [ ] Check `.thumbgate/daily-discoveries-ledger.jsonl` for recent execution receipts.

package/.agents/skills/typesafe-typed-questions-not-clone/SKILL.md

@@ -21,14 +21,16 @@ not a SKU, not an LLM adjudicator.
 
 | NEVER | ALWAYS |
 | --- | --- |
-| Install `typesafe-sdk` / call `api.typesafe.ai` | `npx thumbgate typesafe-typed-questions --json` |
+| Install `typesafe-sdk` / wire Jev as the PreToolUse gate | `npx thumbgate typesafe-typed-questions --json` |
+| `--use-typesafe-api` (gate) | `--live` shadow vs `POST /v1/systemone`; code still owns `route()` |
 | Clone Jev / System One as the gate | Deterministic matchers answer the battery |
 | Unpark LLM adjudicator (#3690/#3687) | Code owns `route()`; model does not emit the verdict |
 | One free-form "should we allow this?" judge | Atomic noul per hazard + score for severity |
 | Dual-edit untracked `llm-adjudicator` theater | Map onto existing `gate-check` rails |
+| N HTTP calls (one question each) | One POST with the whole battery (`parallel_questions`) |
 
 HARD fail closed. REFUSE SKU clones. ECI: no net-new governance product.
-Do NOT install `typesafe-sdk`. Do NOT call `api.typesafe.ai` from PreToolUse.
+Do NOT install `typesafe-sdk`. Do NOT let Jev emit `permissionDecision`. `--live` is a shadow scorer (grok-fleet key), not the gate.
 
 Complementary to trading `/typesafe-system-one-not-clone` (AGENT-651 claim gate). Do **not** dual-edit `IgorGanapolsky/trading` `scripts/typesafe_claim_gate.py`. This skill is ThumbGate PreToolUse only.
 
@@ -36,6 +38,7 @@ Complementary to trading `/typesafe-system-one-not-clone` (AGENT-651 claim gate)
 
 - https://console.typesafe.ai/hook (signed-in intro / Replay intro)
 - https://docs.typesafe.ai/cookbooks/llm_guardrails.md
+- https://docs.typesafe.ai/cookbooks/parallel_questions
 - https://docs.typesafe.ai/patterns/confidence-routing.md
 - Playground "Support agent audit" (noul battery + choice + score over one state)
 - `scripts/typesafe-typed-questions.js`
@@ -69,7 +72,8 @@ npm run test:typesafe-typed-questions
 2. Ask independent typed questions (noul per hazard, choice for family, score for severity).
 3. Answer them with deterministic matchers — never Jev.
 4. `route()` in code: action threshold → block, review threshold → review, severity ≥ 2 promotes review to block.
-5. Refuse `--clone-jev`, `--use-typesafe-api`, `--llm-adjudicate`, and model-emitted verdicts.
+5. Refuse `--clone-jev`, `--use-typesafe-api` (gate), `--llm-adjudicate`, and model-emitted verdicts.
+6. Optional `--live` shadows the same battery against Jev in **one** POST. `--fan-out-questions` fails. Receipt is estimated N× input tokens, not the cookbook's 12.2×.
 
 ## Rubric
 

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
   "description": "One 👎 becomes a hard rule the agent cannot bypass. Captures thumbs-down feedback, distills it into PreToolUse Pre-Action Checks, enforced across every future Claude Code session.",
-  "version": "1.37.2",
+  "version": "1.37.3",
   "author": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com",

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.37.2",
+  "version": "1.37.3",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://thumbgate.ai",
   "transport": "stdio",

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.37.2", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.37.2", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/forge/forge.yaml

@@ -9,12 +9,12 @@ version: "1"
 skills:
   thumbgate-gate-check:
     description: "ThumbGate PreToolUse gate — blocks known-bad tool calls"
-    command: "npx --yes --package thumbgate@1.37.2 thumbgate gate-check"
+    command: "npx --yes --package thumbgate@1.37.3 thumbgate gate-check"
     trigger: pre_tool_use
 
   thumbgate-feedback:
     description: "ThumbGate feedback capture — logs user prompt context"
-    command: "npx --yes --package thumbgate@1.37.2 thumbgate hook-auto-capture"
+    command: "npx --yes --package thumbgate@1.37.3 thumbgate hook-auto-capture"
     trigger: user_prompt
 
 mcp:
@@ -23,6 +23,6 @@ mcp:
     args:
       - "--yes"
       - "--package"
-      - "thumbgate@1.37.2"
+      - "thumbgate@1.37.3"
       - "thumbgate"
       - "serve"

package/adapters/future-agi/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.37.2", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]
     }
   }
 }

package/adapters/future-agi/config.toml

@@ -1,3 +1,3 @@
 [mcp.servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@1.37.2", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]

package/adapters/future-agi/opencode.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.37.2", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]
     }
   }
 }

package/adapters/herdr/herdr-plugin.toml

@@ -1,7 +1,7 @@
 [plugin]
 id = "thumbgate-approvals"
 name = "ThumbGate Approvals"
-version = "1.37.2"
+version = "1.37.3"
 minHerdrVersion = "0.7.0"
 description = "Pre-action governance, spend guard, and safety approval gates for multi-agent terminal sessions in Herdr."
 platforms = ["linux", "macos", "windows"]
@@ -12,7 +12,7 @@ category = "Security & Governance"
 
 [mcp_server]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@1.37.2", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@1.37.3", "thumbgate", "serve"]
 
 [mcp_server.env]
 THUMBGATE_ENFORCE_ENTITLEMENTS = "1"

package/adapters/mcp/server-stdio.js

@@ -334,7 +334,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.37.2' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.37.3' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.37.2",
+        "thumbgate@1.37.3",
         "thumbgate",
         "serve"
       ],