thumbgate 1.4.2 → 1.4.4

package/.claude-plugin/README.md

@@ -1,18 +1,27 @@
 # ThumbGate for Claude Desktop
 
-`thumbgate` gives Claude Desktop a local-first **Reliability Gateway** and **Pre-Action Gates** for workflow hardening.
+**Give thumbs up 👍 or thumbs down 👎 on any agent action. ThumbGate captures it, runs History-aware lesson distillation across up to 8 prior recorded entries, and blocks the pattern from repeating. Just type "thumbs up" or "thumbs down" in the chat.**
 
-The extension path is useful when a team wants Claude Desktop to keep one workflow sharper over time without adding another orchestration layer. The MCP server captures explicit feedback, recalls past failures, distills lessons from up to 8 prior recorded entries when the current Claude hook only gets a vague thumbs-down, promotes reusable prevention rules, and produces proof-backed rollout artifacts.
+## Try it now
 
-## Features
+1. Install ThumbGate
+2. Start a Claude Desktop session
+3. When the agent does something wrong, type: **thumbs down**
+4. ThumbGate captures the mistake, distills a lesson, and creates a prevention rule
+5. Next session: the agent physically cannot repeat that mistake
 
-- Workflow hardening for Claude-first engineering and ops workflows
-- Pre-Action Gates that block repeated mistakes before tool use
-- History-aware lesson distillation from up to 8 prior recorded entries and failed tool calls in the current Claude auto-capture path
-- Reliability memory and recall across long sessions
-- Bounded context packs, provenance, and diagnostics
-- DPO export and analytics bundle generation after runtime reliability lands
-- Submission-ready MCPB packaging for Claude Desktop review and local installs
+That's it. One thumbs-down, never again.
+
+## What it does
+
+- **👎 Thumbs down** → captures the mistake → distills a lesson → auto-promotes to a prevention rule → PreToolUse hook blocks the pattern before execution
+- **👍 Thumbs up** → reinforces good patterns → agent starts preferring your approved flows without re-explaining them each session
+- **33 pre-action gates** → block destructive actions (force-push, mass delete, destructive SQL) before they execute
+- **Budget enforcement** → action count + time limits prevent runaway sessions
+- **Self-protection** → agent cannot disable its own governance
+- **Compliance tags** → NIST, SOC2, OWASP, CWE on gate rules for enterprise teams
+- **Shared team enforcement** → one engineer's thumbs-down protects the whole team
+- **60-second follow-up** → feedback can link to a prior mistake with `relatedFeedbackId` so delayed corrections still become useful gates
 
 ## Installation
 
@@ -101,37 +110,39 @@ Optional hosted path:
 
 ## Examples
 
-### Example 1: PR review hardening
+### Example 1: Block force-push
 
-**User prompt:** "Review this PR and tell me if any blocker would stop merge."
-**Expected behavior:**
-- Claude Desktop inspects the workflow context instead of relying on one-shot memory
-- The extension recalls prior blocker patterns when they exist
-- The Pre-Action Gates can promote the missed blocker into a reusable gate
+```
+You: "Push my changes to main"
+Claude: [tries git push --force]
+ThumbGate: ⛔ Blocked — "no-force-push" (confidence: 0.94)
+You: Never had to correct it again.
+```
 
-### Example 2: Code modernization workflow
+### Example 2: Thumbs-down on bad action
 
-**User prompt:** "Help me modernize this service, but keep the migration constraints and verification steps across sessions."
-**Expected behavior:**
-- Claude Desktop recalls prior migration notes and architecture constraints
-- The extension keeps the context pack bounded instead of replaying full history
-- Verification steps stay attached to the workflow across sessions
+```
+You: "thumbs down"
+ThumbGate: 👎 Captured. History-aware lesson distillation from up to 8 prior recorded entries...
+           Lesson: "Agent edited production config without approval"
+           Follow-up window: 60-second follow-up can attach relatedFeedbackId
+           Rule auto-promoted. Will block matching actions in future sessions.
+```
 
-### Example 3: Internal ops or release workflow
+### Example 3: Thumbs-up reinforces good patterns
 
-**User prompt:** "Run the release checklist, capture what went wrong, and stop the same mistake next time."
-**Expected behavior:**
-- Claude Desktop records explicit operator feedback and proof artifacts
-- The extension keeps the workflow history local-first and searchable
-- Repeated release failures can be turned into prevention rules before the next run
+```
+You: "thumbs up"
+ThumbGate: 👍 Recorded. Reinforcing: "Agent used feature branch + PR workflow"
+           Agent will prefer this pattern in future sessions.
+```
 
-### Example 4: Bare thumbs-down with automatic lesson proposal
+### Example 4: Budget enforcement
 
-**User prompt:** "👎 That was wrong."
-**Expected behavior:**
-- Claude Desktop can pass up to 8 prior recorded entries and the failed tool call into `capture_feedback`
-- ThumbGate distills a proposed `whatWentWrong` and `whatToChange` from recent history
-- A linked 60-second follow-up session can refine the same feedback record with `relatedFeedbackId`
+```
+[Agent hits 500 actions in strict mode]
+ThumbGate: ⛔ Budget exceeded: 501/500 actions used. Session budget exhausted.
+```
 
 ## Privacy Policy
 

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate-marketplace",
-  "version": "1.4.0",
+  "version": "1.4.4",
   "owner": {
     "name": "Igor Ganapolsky",
     "email": "ig5973700@gmail.com"
@@ -8,12 +8,12 @@
   "plugins": [
     {
       "name": "thumbgate",
-      "description": "Pre-action gates that block AI coding agents from repeating known mistakes. Captures feedback, auto-promotes failures into prevention rules, and enforces them via PreToolUse hooks.",
+      "description": "Type 👍 or 👎 on any agent action. ThumbGate captures it, distills a lesson, and blocks the pattern from repeating. One thumbs-down = the agent physically cannot make that mistake again. 33 pre-action gates, budget enforcement, self-protection, and NIST/SOC2 compliance tags.",
       "source": {
         "source": "npm",
         "package": "thumbgate"
       },
-      "version": "1.4.0",
+      "version": "1.4.4",
       "author": {
         "name": "Igor Ganapolsky"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "thumbgate",
-  "description": "Pre-action gates that block AI coding agents from repeating known mistakes. Captures feedback, auto-promotes failures into prevention rules, and enforces them via PreToolUse hooks.",
-  "version": "1.4.0",
+  "description": "Type 👍 or 👎 on any agent action. ThumbGate captures it, distills a lesson, and blocks the pattern from repeating. One thumbs-down = the agent physically cannot make that mistake again. 33 pre-action gates, budget enforcement, self-protection, and NIST/SOC2 compliance tags.",
+  "version": "1.4.4",
   "author": {
     "name": "Igor Ganapolsky"
   },
@@ -18,7 +18,7 @@
     "guardrails",
     "workflow-hardening"
   ],
-  "skills": "skills",
+  "skills": "./skills/",
   "mcpServers": {
     "thumbgate": {
       "command": "npx",

package/.well-known/llms.txt

@@ -1,4 +1,4 @@
-# ThumbGate — Pre-action gates for AI coding agents
+# ThumbGate — Type 👍 or 👎 on any AI agent action. Blocks the pattern from repeating. One thumbs-down, never again.
 # https://thumbgate-production.up.railway.app
 # https://github.com/IgorGanapolsky/ThumbGate
 # https://www.npmjs.com/package/thumbgate

package/.well-known/mcp/server-card.json

@@ -1,6 +1,6 @@
 {
   "name": "thumbgate",
-  "version": "1.4.0",
+  "version": "1.4.4",
   "description": "ThumbGate — 👍👎 feedback that teaches your AI agent. Thumbs down a mistake, it never happens again.",
   "homepage": "https://github.com/IgorGanapolsky/thumbgate",
   "transport": "stdio",

package/README.md

@@ -6,8 +6,9 @@
 [![npm](https://img.shields.io/npm/v/thumbgate)](https://www.npmjs.com/package/thumbgate)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 [![Start Sprint](https://img.shields.io/badge/Workflow%20Hardening%20Sprint-Start%20Intake%20→-16a34a?style=for-the-badge)](https://thumbgate-production.up.railway.app/?utm_source=github&utm_medium=readme&utm_campaign=badge_cta#workflow-sprint-intake)
+[![Open ThumbGate GPT](https://img.shields.io/badge/ChatGPT-Open%20ThumbGate%20GPT-10a37f?style=for-the-badge&logo=openai&logoColor=white)](https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate)
 
-**[Workflow Hardening Sprint](https://thumbgate-production.up.railway.app/?utm_source=github&utm_medium=readme&utm_campaign=top_cta#workflow-sprint-intake)** · **[Use in ChatGPT](adapters/chatgpt/INSTALL.md)** · **[Install Claude Desktop Extension](https://github.com/IgorGanapolsky/ThumbGate/releases/latest/download/thumbgate-claude-desktop.mcpb)** · **[Claude Plugin Guide](docs/CLAUDE_DESKTOP_EXTENSION.md)** · **[Install Codex Plugin](https://github.com/IgorGanapolsky/ThumbGate/releases/latest/download/thumbgate-codex-plugin.zip)** · **[Live Dashboard](https://thumbgate-production.up.railway.app/dashboard?utm_source=github&utm_medium=readme&utm_campaign=top_cta)** · **[Pro Page](https://thumbgate-production.up.railway.app/pro?utm_source=github&utm_medium=readme&utm_campaign=pro_page)**
+**[Workflow Hardening Sprint](https://thumbgate-production.up.railway.app/?utm_source=github&utm_medium=readme&utm_campaign=top_cta#workflow-sprint-intake)** · **[Open ThumbGate GPT](https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate)** · **[ChatGPT Actions setup](adapters/chatgpt/INSTALL.md)** · **[Install Claude Desktop Extension](https://github.com/IgorGanapolsky/ThumbGate/releases/latest/download/thumbgate-claude-desktop.mcpb)** · **[Claude Plugin Guide](docs/CLAUDE_DESKTOP_EXTENSION.md)** · **[Install Codex Plugin](https://github.com/IgorGanapolsky/ThumbGate/releases/latest/download/thumbgate-codex-plugin.zip)** · **[ThumbGate Bench](docs/THUMBGATE_BENCH.md)** · **[Perplexity Command Center](docs/PERPLEXITY_MAX_COMMAND_CENTER.md)** · **[Live Dashboard](https://thumbgate-production.up.railway.app/dashboard?utm_source=github&utm_medium=readme&utm_campaign=top_cta)** · **[Pro Page](https://thumbgate-production.up.railway.app/pro?utm_source=github&utm_medium=readme&utm_campaign=pro_page)**
 
 **Popular buyer questions:** **[Stop repeated AI agent mistakes](https://thumbgate-production.up.railway.app/guides/stop-repeated-ai-agent-mistakes?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Cursor guardrails](https://thumbgate-production.up.railway.app/guides/cursor-agent-guardrails?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Codex CLI guardrails](https://thumbgate-production.up.railway.app/guides/codex-cli-guardrails?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)** · **[Gemini CLI memory + enforcement](https://thumbgate-production.up.railway.app/guides/gemini-cli-feedback-memory?utm_source=github&utm_medium=readme&utm_campaign=buyer_questions)**
 
@@ -15,10 +16,32 @@
 
 **Running Codex?** **[Download the standalone Codex plugin bundle](https://github.com/IgorGanapolsky/ThumbGate/releases/latest/download/thumbgate-codex-plugin.zip)** · **[Codex install guide](plugins/codex-profile/INSTALL.md)**
 
-**Running ChatGPT?** Search GPT Store for `ThumbGate` by Igor Ganapolsky. Regular users reply with 👍/👎 or "thumbs up/down" on answers, save the lesson, prevent repeated bad answers, and reinforce the answers that worked. Developers can import the prepared **[GPT Actions OpenAPI spec](adapters/chatgpt/openapi.yaml)** with the **[ChatGPT install guide](adapters/chatgpt/INSTALL.md)**.
+## ThumbGate GPT: start here
+
+**Use ThumbGate in ChatGPT now:** **[Open the live ThumbGate GPT](https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate)**, paste the action your AI agent wants to run, and ask whether to allow, block, or checkpoint it.
+
+Try this first prompt:
+
+```text
+Check this agent action before it runs: git push --force --tags
+```
+
+**No, users do not have to keep chatting inside the ThumbGate GPT to use ThumbGate.** The GPT is the fast demo, guided setup path, and thumbs-up/down memory surface for ChatGPT users. The hard enforcement layer still runs where the work happens: your local coding agent, CI workflow, or MCP-compatible runtime after `npx thumbgate init`.
+
+Developers can import the prepared **[GPT Actions OpenAPI spec](adapters/chatgpt/openapi.yaml)** with the **[ChatGPT Actions setup guide](adapters/chatgpt/INSTALL.md)**. Regular ChatGPT users should just open the GPT and type what happened.
 
 **Official directory pending review?** Claude Code users can install today with `/plugin marketplace add IgorGanapolsky/ThumbGate` then `/plugin install thumbgate@thumbgate-marketplace`.
 
+**Using Perplexity Max?** ThumbGate ships a **[Perplexity Command Center](docs/PERPLEXITY_MAX_COMMAND_CENTER.md)** that runs AI-search visibility checks, Search API lead discovery, Agent API strategy briefs, and official Perplexity MCP config generation. It is scheduled in GitHub Actions and uploads artifacts without committing runtime `.thumbgate` state.
+
+**Need proof that gates improve safety without killing capability?** Run **[ThumbGate Bench](docs/THUMBGATE_BENCH.md)**:
+
+```bash
+npm run thumbgate:bench
+```
+
+It scores deterministic GitHub, npm, database, Railway, shell, and filesystem scenarios with `unsafeActionRate`, `capabilityRate`, `positivePromotionRate`, and `replayStability` so teams can inspect the Reliability Gateway before a Workflow Hardening Sprint.
+
 ---
 
 ## What problem does this solve?
@@ -115,6 +138,7 @@ Session 3:                     │  Session 3+:
 npx thumbgate init    # detects your agent and wires everything up
 npx thumbgate doctor  # health check
 npx thumbgate lessons # see what's been learned
+npx thumbgate explore # terminal explorer for lessons, gates, and stats
 npx thumbgate dashboard # open local dashboard
 ```
 

package/adapters/README.md

@@ -3,7 +3,10 @@
 - `chatgpt/openapi.yaml`: import into GPT Actions.
 - `gemini/function-declarations.json`: Gemini function-calling definitions.
 - `mcp/server-stdio.js`: underlying local MCP stdio server implementation.
-- `claude/.mcp.json`: example Claude Code MCP config using `npx --yes --package thumbgate@1.4.0 thumbgate serve`.
+- `claude/.mcp.json`: example Claude Code MCP config using `npx --yes --package thumbgate@1.4.4 thumbgate serve`.
 - `codex/config.toml`: example Codex MCP profile section using the same version-pinned portable launcher.
 - `amp/skills/thumbgate-feedback/SKILL.md`: Amp skill template.
 - `opencode/opencode.json`: portable OpenCode MCP profile using the same version-pinned portable launcher.
+- `perplexity/.mcp.json`: Claude Code config with ThumbGate + Perplexity MCP servers side-by-side.
+- `perplexity/config.toml`: Codex config with ThumbGate + Perplexity MCP servers.
+- `perplexity/opencode.json`: OpenCode config with ThumbGate + Perplexity MCP servers.

package/adapters/claude/.mcp.json

@@ -2,13 +2,13 @@
   "mcpServers": {
     "thumbgate": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.4.0", "thumbgate", "serve"]
+      "args": ["--yes", "--package", "thumbgate@1.4.4", "thumbgate", "serve"]
     }
   },
   "hooks": {
     "preToolUse": {
       "command": "npx",
-      "args": ["--yes", "--package", "thumbgate@1.4.0", "thumbgate", "gate-check"]
+      "args": ["--yes", "--package", "thumbgate@1.4.4", "thumbgate", "gate-check"]
     }
   }
 }

package/adapters/codex/config.toml

@@ -1,9 +1,9 @@
 # Codex MCP profile (copy into ~/.codex/config.toml or merge section)
 [mcp_servers.thumbgate]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@1.4.0", "thumbgate", "serve"]
+args = ["--yes", "--package", "thumbgate@1.4.4", "thumbgate", "serve"]
 
 # Hard PreToolUse hook for Codex
 [hooks.pre_tool_use]
 command = "npx"
-args = ["--yes", "--package", "thumbgate@1.4.0", "thumbgate", "gate-check"]
+args = ["--yes", "--package", "thumbgate@1.4.4", "thumbgate", "gate-check"]

package/adapters/mcp/server-stdio.js

@@ -124,7 +124,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.4.0' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.4.4' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',
@@ -434,12 +434,18 @@ async function callToolInner(name, args) {
         category: args.category,
         tags: Array.isArray(args.tags) ? args.tags : [],
       }));
-    case 'retrieve_lessons':
-      return toTextResult(retrieveRelevantLessons(
+    case 'retrieve_lessons': {
+      // Cross-encoder reranking: retrieve more candidates, then rerank for precision
+      const { retrieveWithRerankingSync } = require('../../scripts/cross-encoder-reranker');
+      return toTextResult(retrieveWithRerankingSync(
         args.toolName,
         args.actionContext || '',
-        { maxResults: Number(args.maxResults || 5) },
+        {
+          candidateCount: 20,
+          maxResults: Number(args.maxResults || 5),
+        },
       ));
+    }
     case 'search_thumbgate':
       enforceLimit('search_thumbgate');
       return toTextResult(searchThumbgate({

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.4.0",
+        "thumbgate@1.4.4",
         "thumbgate",
         "serve"
       ],