thumbgate 1.4.3 → 1.4.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (266) hide show
  1. package/.claude-plugin/marketplace.json +2 -2
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/.well-known/mcp/server-card.json +1 -1
  4. package/adapters/README.md +1 -1
  5. package/adapters/claude/.mcp.json +2 -2
  6. package/adapters/codex/config.toml +2 -2
  7. package/adapters/mcp/server-stdio.js +1 -1
  8. package/adapters/opencode/opencode.json +1 -1
  9. package/package.json +157 -9
  10. package/scripts/statusline.sh +1 -0
  11. package/src/api/server.js +113 -16
  12. package/src/index.js +3 -0
  13. package/.claude-plugin/bundle/icon.png +0 -0
  14. package/.claude-plugin/bundle/icon.svg +0 -18
  15. package/.claude-plugin/bundle/server/index.js +0 -24
  16. package/adapters/chatgpt/INSTALL.md +0 -158
  17. package/adapters/perplexity/.mcp.json +0 -36
  18. package/adapters/perplexity/config.toml +0 -16
  19. package/adapters/perplexity/opencode.json +0 -29
  20. package/bin/memory.sh +0 -64
  21. package/bin/obsidian-sync.sh +0 -20
  22. package/plugins/amp-skill/INSTALL.md +0 -52
  23. package/plugins/amp-skill/SKILL.md +0 -64
  24. package/plugins/claude-codex-bridge/.claude-plugin/plugin.json +0 -22
  25. package/plugins/claude-codex-bridge/.mcp.json +0 -14
  26. package/plugins/claude-codex-bridge/INSTALL.md +0 -43
  27. package/plugins/claude-codex-bridge/README.md +0 -46
  28. package/plugins/claude-codex-bridge/scripts/codex-bridge.js +0 -286
  29. package/plugins/claude-codex-bridge/skills/adversarial-review/SKILL.md +0 -24
  30. package/plugins/claude-codex-bridge/skills/result/SKILL.md +0 -22
  31. package/plugins/claude-codex-bridge/skills/review/SKILL.md +0 -28
  32. package/plugins/claude-codex-bridge/skills/second-pass/SKILL.md +0 -27
  33. package/plugins/claude-codex-bridge/skills/setup/SKILL.md +0 -21
  34. package/plugins/claude-codex-bridge/skills/status/SKILL.md +0 -19
  35. package/plugins/claude-skill/INSTALL.md +0 -55
  36. package/plugins/claude-skill/SKILL.md +0 -46
  37. package/plugins/codex-profile/.codex-plugin/plugin.json +0 -43
  38. package/plugins/codex-profile/.mcp.json +0 -14
  39. package/plugins/codex-profile/AGENTS.md +0 -20
  40. package/plugins/codex-profile/INSTALL.md +0 -89
  41. package/plugins/codex-profile/README.md +0 -61
  42. package/plugins/cursor-marketplace/.cursor-plugin/plugin.json +0 -23
  43. package/plugins/cursor-marketplace/CHANGELOG.md +0 -30
  44. package/plugins/cursor-marketplace/LICENSE +0 -21
  45. package/plugins/cursor-marketplace/README.md +0 -124
  46. package/plugins/cursor-marketplace/agents/reliability-reviewer.md +0 -31
  47. package/plugins/cursor-marketplace/assets/logo-400x400.png +0 -0
  48. package/plugins/cursor-marketplace/commands/capture-feedback.md +0 -33
  49. package/plugins/cursor-marketplace/commands/check-gates.md +0 -25
  50. package/plugins/cursor-marketplace/commands/show-lessons.md +0 -27
  51. package/plugins/cursor-marketplace/hooks/hooks.json +0 -10
  52. package/plugins/cursor-marketplace/mcp.json +0 -14
  53. package/plugins/cursor-marketplace/rules/feedback-capture.mdc +0 -34
  54. package/plugins/cursor-marketplace/rules/pre-action-gates.mdc +0 -30
  55. package/plugins/cursor-marketplace/rules/session-continuity.mdc +0 -28
  56. package/plugins/cursor-marketplace/scripts/gate-check.sh +0 -21
  57. package/plugins/cursor-marketplace/skills/capture-feedback/SKILL.md +0 -48
  58. package/plugins/cursor-marketplace/skills/prevention-rules/SKILL.md +0 -31
  59. package/plugins/cursor-marketplace/skills/recall-context/SKILL.md +0 -30
  60. package/plugins/cursor-marketplace/skills/search-lessons/SKILL.md +0 -33
  61. package/plugins/gemini-extension/INSTALL.md +0 -92
  62. package/plugins/gemini-extension/gemini_prompt.txt +0 -14
  63. package/plugins/gemini-extension/tool_contract.json +0 -45
  64. package/plugins/opencode-profile/INSTALL.md +0 -57
  65. package/public/assets/instagram-card.png +0 -0
  66. package/public/assets/tiktok-agent-memory.mp4 +0 -0
  67. package/public/blog.html +0 -474
  68. package/public/compare/mem0.html +0 -189
  69. package/public/compare/speclock.html +0 -180
  70. package/public/compare.html +0 -310
  71. package/public/dashboard.html +0 -1100
  72. package/public/guide.html +0 -317
  73. package/public/guides/claude-code-prevent-repeated-mistakes.html +0 -161
  74. package/public/guides/codex-cli-guardrails.html +0 -158
  75. package/public/guides/cursor-prevent-repeated-mistakes.html +0 -161
  76. package/public/guides/pre-action-gates.html +0 -162
  77. package/public/guides/stop-repeated-ai-agent-mistakes.html +0 -159
  78. package/public/index.html +0 -1225
  79. package/public/js/buyer-intent.js +0 -252
  80. package/public/learn/agent-harness-pattern.html +0 -180
  81. package/public/learn/ai-agent-persistent-memory.html +0 -203
  82. package/public/learn/learn.css +0 -45
  83. package/public/learn/mcp-pre-action-gates-explained.html +0 -172
  84. package/public/learn/stop-ai-agent-force-push.html +0 -134
  85. package/public/learn/vibe-coding-safety-net.html +0 -142
  86. package/public/learn.html +0 -274
  87. package/public/lessons.html +0 -967
  88. package/public/llm-context.md +0 -156
  89. package/public/pro.html +0 -1087
  90. package/public/vercel.json +0 -8
  91. package/scripts/a2ui-engine.js +0 -73
  92. package/scripts/adk-consolidator.js +0 -274
  93. package/scripts/agent-security-hardening.js +0 -225
  94. package/scripts/ai-search-visibility.js +0 -116
  95. package/scripts/autonomous-sales-agent.js +0 -39
  96. package/scripts/autoresearch-runner.js +0 -216
  97. package/scripts/background-agent-governance.js +0 -229
  98. package/scripts/behavioral-extraction.js +0 -93
  99. package/scripts/budget-enforcer.js +0 -173
  100. package/scripts/budget-guard.js +0 -173
  101. package/scripts/build-claude-mcpb.js +0 -255
  102. package/scripts/build-codex-plugin.js +0 -152
  103. package/scripts/capture-railway-diagnostics.sh +0 -97
  104. package/scripts/changeset-check.js +0 -372
  105. package/scripts/check-congruence.js +0 -443
  106. package/scripts/computer-use-firewall.js +0 -280
  107. package/scripts/content-engine/linkedin-content-generator.js +0 -154
  108. package/scripts/content-engine/output/linkedin-memento-validation.md +0 -17
  109. package/scripts/content-engine/output/linkedin-posts-2026-04-09.md +0 -175
  110. package/scripts/content-engine/reddit-thread-finder.js +0 -154
  111. package/scripts/context-engine.js +0 -710
  112. package/scripts/daily-digest.js +0 -11
  113. package/scripts/data-governance.js +0 -173
  114. package/scripts/deploy-gcp.sh +0 -44
  115. package/scripts/deploy-policy.js +0 -249
  116. package/scripts/disagreement-mining.js +0 -315
  117. package/scripts/dpo-optimizer.js +0 -206
  118. package/scripts/ensure-repo-bootstrap.js +0 -130
  119. package/scripts/ephemeral-agent-store.js +0 -212
  120. package/scripts/eval-harness.js +0 -56
  121. package/scripts/export-kto-pairs.js +0 -309
  122. package/scripts/export-training.js +0 -446
  123. package/scripts/feedback-fallback.js +0 -111
  124. package/scripts/feedback-inbox-read.js +0 -162
  125. package/scripts/feedback-root-consolidator.js +0 -233
  126. package/scripts/feedback-to-memory.js +0 -185
  127. package/scripts/gate-satisfy.js +0 -42
  128. package/scripts/generate-paperbanana-diagrams.sh +0 -99
  129. package/scripts/generate-pretool-hook.sh +0 -40
  130. package/scripts/github-about.js +0 -430
  131. package/scripts/github-outreach.js +0 -65
  132. package/scripts/gtm-revenue-loop.js +0 -535
  133. package/scripts/hallucination-detector.js +0 -226
  134. package/scripts/hf-papers.js +0 -317
  135. package/scripts/hook-auto-capture.sh +0 -100
  136. package/scripts/hook-stop-pr-thread-check.sh +0 -68
  137. package/scripts/hook-stop-self-score.sh +0 -51
  138. package/scripts/hook-stop-verify-deploy.sh +0 -31
  139. package/scripts/hook-verify-before-done.sh +0 -20
  140. package/scripts/managed-dpo-export.js +0 -91
  141. package/scripts/markdown-escape.js +0 -12
  142. package/scripts/marketing-experiment.js +0 -657
  143. package/scripts/memalign-recall.js +0 -111
  144. package/scripts/memory-migration.js +0 -296
  145. package/scripts/meta-policy.js +0 -190
  146. package/scripts/metered-billing.js +0 -16
  147. package/scripts/model-tier-router.js +0 -310
  148. package/scripts/money-watcher.js +0 -218
  149. package/scripts/multi-hop-recall.js +0 -240
  150. package/scripts/per-step-scoring.js +0 -163
  151. package/scripts/perplexity-command-center.js +0 -644
  152. package/scripts/perplexity-marketing.js +0 -454
  153. package/scripts/pii-scanner.js +0 -153
  154. package/scripts/plan-gate.js +0 -154
  155. package/scripts/post-everywhere.js +0 -341
  156. package/scripts/post-to-x-retry.sh +0 -22
  157. package/scripts/post-to-x.js +0 -369
  158. package/scripts/pr-manager.js +0 -421
  159. package/scripts/principle-extractor.js +0 -162
  160. package/scripts/pro-features.js +0 -41
  161. package/scripts/prompt-dlp.js +0 -222
  162. package/scripts/prove-adapters.js +0 -860
  163. package/scripts/prove-attribution.js +0 -361
  164. package/scripts/prove-automation.js +0 -651
  165. package/scripts/prove-autoresearch.js +0 -304
  166. package/scripts/prove-claim-verification.js +0 -277
  167. package/scripts/prove-cloudflare-sandbox.js +0 -161
  168. package/scripts/prove-data-pipeline.js +0 -408
  169. package/scripts/prove-data-quality.js +0 -227
  170. package/scripts/prove-evolution.js +0 -352
  171. package/scripts/prove-harnesses.js +0 -287
  172. package/scripts/prove-intelligence.js +0 -257
  173. package/scripts/prove-lancedb.js +0 -425
  174. package/scripts/prove-local-intelligence.js +0 -340
  175. package/scripts/prove-loop-closure.js +0 -263
  176. package/scripts/prove-packaged-runtime.js +0 -327
  177. package/scripts/prove-predictive-insights.js +0 -355
  178. package/scripts/prove-runtime.js +0 -363
  179. package/scripts/prove-seo-gsd.js +0 -234
  180. package/scripts/prove-settings.js +0 -279
  181. package/scripts/prove-subway-upgrades.js +0 -277
  182. package/scripts/prove-tessl.js +0 -229
  183. package/scripts/prove-training-export.js +0 -325
  184. package/scripts/prove-workflow-contract.js +0 -112
  185. package/scripts/prove-xmemory.js +0 -332
  186. package/scripts/publish-decision.js +0 -159
  187. package/scripts/ralph-loop.js +0 -376
  188. package/scripts/ralph-mode-ci.js +0 -434
  189. package/scripts/reddit-dm-outreach.js +0 -192
  190. package/scripts/reddit-monitor-cron.sh +0 -26
  191. package/scripts/reminder-engine.js +0 -132
  192. package/scripts/revenue-status.js +0 -472
  193. package/scripts/rotate-stripe-webhook-secret.js +0 -314
  194. package/scripts/schedule-manager.js +0 -249
  195. package/scripts/self-healing-check.js +0 -193
  196. package/scripts/session-analyzer.js +0 -533
  197. package/scripts/shieldcortex-memory-firewall-runner.mjs +0 -53
  198. package/scripts/skill-exporter.js +0 -260
  199. package/scripts/skill-materializer.js +0 -134
  200. package/scripts/skill-packs.js +0 -136
  201. package/scripts/skill-proposer.js +0 -99
  202. package/scripts/skill-quality-tracker.js +0 -282
  203. package/scripts/slow-loop.js +0 -72
  204. package/scripts/social-analytics/db/marketing-db.js +0 -179
  205. package/scripts/social-analytics/db/schema.sql +0 -55
  206. package/scripts/social-analytics/digest.js +0 -256
  207. package/scripts/social-analytics/engagement-audit.js +0 -185
  208. package/scripts/social-analytics/generate-instagram-card.js +0 -123
  209. package/scripts/social-analytics/generate-slides.js +0 -268
  210. package/scripts/social-analytics/instagram-thumbgate-post.js +0 -111
  211. package/scripts/social-analytics/install-growth-automation.js +0 -114
  212. package/scripts/social-analytics/load-env.js +0 -77
  213. package/scripts/social-analytics/mcp-server.js +0 -289
  214. package/scripts/social-analytics/normalizer.js +0 -580
  215. package/scripts/social-analytics/notify.js +0 -162
  216. package/scripts/social-analytics/poll-all.js +0 -107
  217. package/scripts/social-analytics/pollers/github.js +0 -195
  218. package/scripts/social-analytics/pollers/instagram.js +0 -253
  219. package/scripts/social-analytics/pollers/linkedin.js +0 -340
  220. package/scripts/social-analytics/pollers/plausible.js +0 -245
  221. package/scripts/social-analytics/pollers/reddit.js +0 -306
  222. package/scripts/social-analytics/pollers/threads.js +0 -233
  223. package/scripts/social-analytics/pollers/tiktok.js +0 -203
  224. package/scripts/social-analytics/pollers/x.js +0 -227
  225. package/scripts/social-analytics/pollers/youtube.js +0 -304
  226. package/scripts/social-analytics/pollers/zernio.js +0 -183
  227. package/scripts/social-analytics/post-video.js +0 -316
  228. package/scripts/social-analytics/publish-instagram-thumbgate.js +0 -104
  229. package/scripts/social-analytics/publish-thumbgate-launch.js +0 -322
  230. package/scripts/social-analytics/publishers/devto.js +0 -122
  231. package/scripts/social-analytics/publishers/instagram.js +0 -317
  232. package/scripts/social-analytics/publishers/linkedin.js +0 -294
  233. package/scripts/social-analytics/publishers/reddit.js +0 -385
  234. package/scripts/social-analytics/publishers/threads.js +0 -275
  235. package/scripts/social-analytics/publishers/tiktok.js +0 -217
  236. package/scripts/social-analytics/publishers/x.js +0 -259
  237. package/scripts/social-analytics/publishers/youtube.js +0 -223
  238. package/scripts/social-analytics/publishers/zernio.js +0 -568
  239. package/scripts/social-analytics/reconcile-thumbgate-campaign.js +0 -165
  240. package/scripts/social-analytics/run-digest.js +0 -34
  241. package/scripts/social-analytics/schedule-thumbgate-campaign.js +0 -275
  242. package/scripts/social-analytics/store.js +0 -455
  243. package/scripts/social-analytics/sync-launch-assets.js +0 -185
  244. package/scripts/social-analytics/utm.js +0 -143
  245. package/scripts/social-pipeline.js +0 -2626
  246. package/scripts/social-post-hourly.js +0 -228
  247. package/scripts/social-quality-gate.js +0 -134
  248. package/scripts/social-reply-monitor.js +0 -592
  249. package/scripts/status-dashboard.js +0 -155
  250. package/scripts/stripe-live-status.js +0 -115
  251. package/scripts/subagent-profiles.js +0 -79
  252. package/scripts/sync-branch-protection.js +0 -340
  253. package/scripts/sync-gh-secrets-from-env.sh +0 -70
  254. package/scripts/sync-github-about.js +0 -55
  255. package/scripts/sync-version.js +0 -479
  256. package/scripts/synthetic-dpo.js +0 -234
  257. package/scripts/tessl-export.js +0 -369
  258. package/scripts/test-coverage.js +0 -128
  259. package/scripts/thumbgate-bench.js +0 -494
  260. package/scripts/thumbgate_session_start.sh +0 -32
  261. package/scripts/train_from_feedback.py +0 -929
  262. package/scripts/validate-feedback.js +0 -581
  263. package/scripts/verify-obsidian-setup.sh +0 -269
  264. package/scripts/verify-run.js +0 -269
  265. package/scripts/weekly-auto-post.js +0 -124
  266. package/scripts/x-autonomous-marketing.js +0 -139
package/public/learn/learn.css DELETED
@@ -1,45 +0,0 @@
1
- /* ThumbGate Learn Hub — shared styles for /learn pages */
2
- *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
3
- :root {
4
- --bg: #0a0a0b; --bg-card: #161618; --bg-raised: #111113;
5
- --border: #222225; --text: #e8e8ec; --muted: #8b8b94;
6
- --cyan: #22d3ee; --green: #34d399; --red: #f87171;
7
- }
8
- body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.7; }
9
- .container { max-width: 700px; margin: 0 auto; padding: 2rem 1.5rem 4rem; }
10
- nav { padding: 1rem 2rem; border-bottom: 1px solid var(--border); display: flex; gap: 1.5rem; align-items: center; }
11
- nav a { color: var(--muted); text-decoration: none; font-size: 0.9rem; }
12
- nav a:hover { color: var(--cyan); }
13
- nav .brand { color: var(--text); font-weight: 700; font-size: 1.1rem; }
14
- h1 { font-size: 2rem; line-height: 1.2; margin: 2rem 0 1rem; }
15
- h2 { font-size: 1.4rem; margin: 2.5rem 0 0.75rem; color: var(--cyan); }
16
- h3 { font-size: 1.1rem; margin: 1.5rem 0 0.5rem; }
17
- p, li { margin-bottom: 0.75rem; }
18
- ul, ol { padding-left: 1.5rem; }
19
- code { background: #1a1a1e; padding: 0.15em 0.4em; border-radius: 4px; font-size: 0.9em; color: var(--cyan); font-family: 'SF Mono', 'Cascadia Code', 'JetBrains Mono', Consolas, monospace; }
20
- pre { background: var(--bg-raised); border: 1px solid var(--border); border-radius: 8px; padding: 1rem; overflow-x: auto; margin: 1rem 0; }
21
- pre code { background: none; padding: 0; color: var(--text); }
22
- .breadcrumb { font-size: 0.85rem; color: var(--muted); margin-bottom: 0.5rem; }
23
- .breadcrumb a { color: var(--cyan); text-decoration: none; }
24
- .breadcrumb a:hover { text-decoration: underline; }
25
- .callout { background: var(--bg-card); border-left: 3px solid var(--cyan); padding: 1rem 1.25rem; border-radius: 0 8px 8px 0; margin: 1.5rem 0; }
26
- .callout-red { border-left-color: var(--red); }
27
- .callout-green { border-left-color: var(--green); }
28
- .cta-box { margin-top: 3rem; padding: 2rem; background: var(--bg-raised); border: 1px solid var(--border); border-radius: 12px; text-align: center; }
29
- .cta-box p { color: var(--muted); }
30
- .cta-install { display: inline-block; background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 10px 20px; font-family: 'SF Mono', Consolas, monospace; font-size: 0.95rem; color: var(--cyan); margin-top: 1rem; }
31
- .related { margin-top: 2rem; }
32
- .related a { color: var(--cyan); text-decoration: none; display: block; margin-bottom: 0.5rem; }
33
- .related a:hover { text-decoration: underline; }
34
- @media (max-width: 700px) { h1 { font-size: 1.5rem; } .container { padding: 1.5rem 1rem 3rem; } }
35
-
36
- /* TL;DR box — appears right after h1 to hook skimmers */
37
- .tldr { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 1rem 1.25rem; margin: 1rem 0 2rem; font-size: 0.95rem; }
38
- .tldr strong { color: var(--cyan); }
39
- /* Sticky bottom CTA bar */
40
- .sticky-cta { position: fixed; bottom: 0; left: 0; right: 0; background: var(--bg-raised); border-top: 1px solid var(--border); padding: 10px 0; text-align: center; z-index: 100; display: flex; align-items: center; justify-content: center; gap: 16px; font-size: 0.9rem; }
41
- .sticky-cta code { background: var(--bg-card); padding: 4px 12px; border-radius: 6px; color: var(--cyan); font-family: 'SF Mono', Consolas, monospace; font-size: 0.85rem; border: 1px solid var(--border); }
42
- .sticky-cta a { color: var(--cyan); text-decoration: none; font-weight: 600; }
43
- .sticky-cta a:hover { text-decoration: underline; }
44
- /* Add padding-bottom to body so sticky bar doesn't cover content */
45
- body { padding-bottom: 52px; }
package/public/learn/mcp-pre-action-gates-explained.html DELETED
@@ -1,172 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8">
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
- <title>MCP Pre-Action Gates Explained — ThumbGate</title>
7
- <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
8
- <meta name="description" content="What pre-action gates are, how they work in the Model Context Protocol, and why enforcement beats prompt rules for AI coding agent safety.">
9
- <meta name="keywords" content="MCP pre-action gates, PreToolUse hooks, Model Context Protocol, AI agent enforcement, Claude Code hooks, MCP server guardrails, tool call interception, ThumbGate">
10
- <meta property="og:title" content="MCP Pre-Action Gates Explained">
11
- <meta property="og:description" content="Technical deep-dive: how pre-action gates intercept tool calls and enforce safety rules for AI coding agents.">
12
- <meta property="og:type" content="article">
13
- <meta property="og:url" content="https://thumbgate-production.up.railway.app/learn/mcp-pre-action-gates-explained">
14
- <link rel="canonical" href="https://thumbgate-production.up.railway.app/learn/mcp-pre-action-gates-explained">
15
-
16
- <script type="application/ld+json">
17
- {
18
- "@context": "https://schema.org",
19
- "@type": "TechArticle",
20
- "headline": "MCP Pre-Action Gates Explained",
21
- "description": "Technical deep-dive into pre-action gates: how they intercept tool calls and enforce safety rules at the MCP hook layer.",
22
- "author": {
23
- "@type": "Person",
24
- "name": "Igor Ganapolsky",
25
- "url": "https://github.com/IgorGanapolsky"
26
- },
27
- "publisher": {
28
- "@type": "Organization",
29
- "name": "ThumbGate",
30
- "url": "https://thumbgate-production.up.railway.app"
31
- },
32
- "datePublished": "2026-04-01",
33
- "dateModified": "2026-04-01",
34
- "mainEntityOfPage": "https://thumbgate-production.up.railway.app/learn/mcp-pre-action-gates-explained",
35
- "about": [
36
- {"@type": "Thing", "name": "Model Context Protocol"},
37
- {"@type": "Thing", "name": "PreToolUse hooks"},
38
- {"@type": "Thing", "name": "AI agent enforcement"}
39
- ]
40
- }
41
- </script>
42
-
43
- <link rel="stylesheet" href="/learn/learn.css">
44
- <style>
45
- .flow-diagram { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 1.5rem; margin: 1.5rem 0; font-family: 'SF Mono', Consolas, monospace; font-size: 0.85rem; color: var(--text); line-height: 2; text-align: center; }
46
- .flow-diagram .arrow { color: var(--cyan); }
47
- .flow-diagram .block { color: var(--green); }
48
- .flow-diagram .deny { color: var(--red); }
49
- table { width: 100%; border-collapse: collapse; margin: 1rem 0; }
50
- th, td { text-align: left; padding: 0.6rem 0.8rem; border-bottom: 1px solid var(--border); font-size: 0.9rem; }
51
- th { color: var(--cyan); font-weight: 600; }
52
- </style>
53
- </head>
54
- <body>
55
-
56
- <nav>
57
- <a href="/" class="brand">👍👎 ThumbGate</a>
58
- <a href="/guide">Setup Guide</a>
59
- <a href="/learn">Learn</a>
60
- <a href="/dashboard">Dashboard</a>
61
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
62
- </nav>
63
-
64
- <div class="container">
65
- <div class="breadcrumb"><a href="/learn">Learn</a> / MCP Pre-Action Gates</div>
66
- <h1>MCP Pre-Action Gates Explained</h1>
67
- <p style="color:var(--muted);">4 min read &middot; Technical deep-dive for developers building on MCP</p>
68
-
69
- <div class="tldr"><strong>TL;DR:</strong> Pre-action gates intercept tool calls before they execute. Unlike prompt rules, they cannot be ignored. This is how enforcement actually works in MCP.</div>
70
-
71
- <h2>What is a pre-action gate?</h2>
72
- <p>A pre-action gate is an enforcement rule that intercepts an AI agent's tool call <em>before</em> it executes. If the tool call matches a known-bad pattern, the gate blocks it and returns a rejection to the agent. The agent then adapts its approach without ever having run the dangerous action.</p>
73
- <p>Gates run at the hook layer of the Model Context Protocol (MCP). They are external to the agent's reasoning chain, which means they cannot be overridden by prompt injection, context overflow, or chain-of-thought reasoning.</p>
74
-
75
- <h2>How it works: the tool call lifecycle</h2>
76
- <div class="flow-diagram">
77
- <span class="block">Agent decides to call tool</span><br>
78
- <span class="arrow">&darr;</span><br>
79
- <span class="block">PreToolUse hook fires</span><br>
80
- <span class="arrow">&darr;</span><br>
81
- <span class="block">ThumbGate checks tool call against gates</span><br>
82
- <span class="arrow">&darr;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&darr;</span><br>
83
- <span class="block">No match &rarr; ALLOW</span>&nbsp;&nbsp;&nbsp;&nbsp;<span class="deny">Match &rarr; BLOCK + reason</span><br>
84
- <span class="arrow">&darr;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&darr;</span><br>
85
- <span class="block">Tool executes</span>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<span class="deny">Agent receives rejection</span>
86
- </div>
87
-
88
- <h2>Prompt rules vs. pre-action gates</h2>
89
- <table>
90
- <thead>
91
- <tr><th>Property</th><th>Prompt Rules</th><th>Pre-Action Gates</th></tr>
92
- </thead>
93
- <tbody>
94
- <tr><td>Where they live</td><td>Inside agent context</td><td>External hook layer</td></tr>
95
- <tr><td>Can be overridden</td><td>Yes (context overflow, reasoning)</td><td>No (runs outside agent)</td></tr>
96
- <tr><td>Enforcement</td><td>Advisory</td><td>Physical block</td></tr>
97
- <tr><td>Persistence</td><td>Per-session (context-dependent)</td><td>Permanent (database-backed)</td></tr>
98
- <tr><td>Adapts over time</td><td>No</td><td>Yes (Thompson Sampling)</td></tr>
99
- <tr><td>Explains why</td><td>No</td><td>Yes (reason chain per block)</td></tr>
100
- </tbody>
101
- </table>
102
-
103
- <h2>The three layers of a gate</h2>
104
-
105
- <h3>1. Pattern matcher</h3>
106
- <p>Gates match against the tool name and its arguments. For a <code>Bash</code> tool call, the pattern might match <code>git push --force</code> targeting <code>main</code>. For a <code>Write</code> tool call, it might match writes to <code>.env</code> or <code>production.config</code>.</p>
107
- <pre><code>{
108
- "tool": "Bash",
109
- "pattern": "git push.*(--force|-f).*main",
110
- "action": "BLOCK"
111
- }</code></pre>
112
-
113
- <h3>2. Evidence and reasoning</h3>
114
- <p>Every gate decision includes a reasoning chain: why this pattern exists, how many times it has fired, what the original failure was. This transparency lets you audit the system and tune it.</p>
115
- <pre><code>{
116
- "gate": "no-force-push-main",
117
- "decision": "BLOCK",
118
- "reason": "Force-push to main blocked",
119
- "evidence": "User reported loss of 14 commits (2026-03-15)",
120
- "fire_count": 7,
121
- "confidence": 0.94
122
- }</code></pre>
123
-
124
- <h3>3. Thompson Sampling adaptation</h3>
125
- <p>Not all patterns deserve the same enforcement level. Thompson Sampling uses a beta distribution to model each gate's risk profile. High-risk patterns (many failures, few successes) get strict enforcement. Low-risk patterns (rarely triggered, occasionally overridden) stay relaxed.</p>
126
-
127
- <div class="callout">
128
- <strong>Why Thompson Sampling?</strong> It balances exploration vs. exploitation. New gates start with wide confidence intervals and tighten as evidence accumulates. This prevents over-blocking on sparse data while ensuring genuinely dangerous patterns get strict enforcement fast.
129
- </div>
130
-
131
- <h2>How gates are created</h2>
132
- <ol>
133
- <li><strong>Feedback capture:</strong> Developer gives thumbs-down with context about what went wrong</li>
134
- <li><strong>Lesson storage:</strong> Feedback is stored in SQLite with FTS5 indexing for fast retrieval</li>
135
- <li><strong>Corrective inference:</strong> ThumbGate matches the failure against similar past failures and infers what should be prevented</li>
136
- <li><strong>Rule promotion:</strong> After configurable repeated failures, the lesson promotes to a prevention rule</li>
137
- <li><strong>Gate activation:</strong> The prevention rule becomes an active gate in the PreToolUse hook</li>
138
- </ol>
139
-
140
- <h2>Supported agents</h2>
141
- <p>Pre-action gates work with any agent that supports MCP hooks:</p>
142
- <ul>
143
- <li><strong>Claude Code</strong> &mdash; PreToolUse hooks in <code>.claude/settings.json</code></li>
144
- <li><strong>Cursor</strong> &mdash; MCP server configuration in <code>.cursor/mcp.json</code></li>
145
- <li><strong>Codex</strong> &mdash; MCP tool interception via server config</li>
146
- <li><strong>Gemini CLI</strong> &mdash; MCP server hooks</li>
147
- <li><strong>Amp, OpenCode</strong> &mdash; any MCP-compatible agent</li>
148
- </ul>
149
- <p>Run <code>npx thumbgate init</code> to auto-detect your agent and configure the correct hook format.</p>
150
-
151
- <div class="cta-box">
152
- <h2 style="color:var(--text);font-size:1.3rem;margin:0 0 8px;">Build your first gate</h2>
153
- <p>Install, give your first thumbs-down, and watch the gate auto-generate.</p>
154
- <div class="cta-install">$ npx thumbgate init</div>
155
- </div>
156
-
157
- <div class="related">
158
- <h3>Related guides</h3>
159
- <a href="/learn/stop-ai-agent-force-push">How to Stop AI Agents From Force-Pushing to Main &rarr;</a>
160
- <a href="/learn/vibe-coding-safety-net">The Vibe Coding Safety Net You Are Missing &rarr;</a>
161
- <a href="/guide">Full Setup Guide &rarr;</a>
162
- </div>
163
- </div>
164
-
165
-
166
- <div class="sticky-cta">
167
- <span style="color:var(--muted)">Try it now:</span>
168
- <code>npx thumbgate init</code>
169
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub &rarr;</a>
170
- </div>
171
- </body>
172
- </html>
package/public/learn/stop-ai-agent-force-push.html DELETED
@@ -1,134 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8">
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
- <title>How to Stop AI Agents From Force-Pushing to Main — ThumbGate</title>
7
- <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
8
- <meta name="description" content="Your AI coding agent just force-pushed to main. Again. Here is how to make that physically impossible with a pre-action gate in two minutes.">
9
- <meta name="keywords" content="AI agent force push, Claude Code force push prevention, git push force main, AI coding agent git safety, pre-action gates, ThumbGate">
10
- <meta property="og:title" content="How to Stop AI Agents From Force-Pushing to Main">
11
- <meta property="og:description" content="Make force-push to main physically impossible for your AI coding agent with a pre-action gate.">
12
- <meta property="og:type" content="article">
13
- <meta property="og:url" content="https://thumbgate-production.up.railway.app/learn/stop-ai-agent-force-push">
14
- <link rel="canonical" href="https://thumbgate-production.up.railway.app/learn/stop-ai-agent-force-push">
15
-
16
- <script type="application/ld+json">
17
- {
18
- "@context": "https://schema.org",
19
- "@type": "TechArticle",
20
- "headline": "How to Stop AI Agents From Force-Pushing to Main",
21
- "description": "Make force-push to main physically impossible for your AI coding agent with a pre-action gate.",
22
- "author": {
23
- "@type": "Person",
24
- "name": "Igor Ganapolsky",
25
- "url": "https://github.com/IgorGanapolsky"
26
- },
27
- "publisher": {
28
- "@type": "Organization",
29
- "name": "ThumbGate",
30
- "url": "https://thumbgate-production.up.railway.app"
31
- },
32
- "datePublished": "2026-04-01",
33
- "dateModified": "2026-04-01",
34
- "mainEntityOfPage": "https://thumbgate-production.up.railway.app/learn/stop-ai-agent-force-push",
35
- "about": [
36
- {"@type": "Thing", "name": "git force push prevention"},
37
- {"@type": "Thing", "name": "AI coding agent safety"},
38
- {"@type": "Thing", "name": "pre-action gates"}
39
- ]
40
- }
41
- </script>
42
-
43
- <link rel="stylesheet" href="/learn/learn.css">
44
- </head>
45
- <body>
46
-
47
- <nav>
48
- <a href="/" class="brand">👍👎 ThumbGate</a>
49
- <a href="/guide">Setup Guide</a>
50
- <a href="/learn">Learn</a>
51
- <a href="/dashboard">Dashboard</a>
52
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
53
- </nav>
54
-
55
- <div class="container">
56
- <div class="breadcrumb"><a href="/learn">Learn</a> / Stop AI Agent Force-Push</div>
57
- <h1>How to Stop AI Agents From Force-Pushing to Main</h1>
58
- <p style="color:var(--muted);">2 min read &middot; Works with Claude Code, Cursor, Codex, and any MCP agent</p>
59
-
60
- <div class="tldr"><strong>TL;DR:</strong> Your AI agent will force-push to main unless you physically prevent it. One PreToolUse hook + two minutes = impossible.</div>
61
-
62
- <h2>The problem</h2>
63
- <p>You write <code>never force-push to main</code> in your CLAUDE.md. Your agent reads it. Then it force-pushes to main anyway. Prompt rules are suggestions. Agents can and do ignore them when the context window fills up or when a chain of reasoning overrides the instruction.</p>
64
-
65
- <div class="callout callout-red">
66
- <strong>Real example:</strong> A developer lost 14 commits when their Claude Code agent ran <code>git push --force origin main</code> during a rebase. The CLAUDE.md said "never force-push." The agent did it anyway.
67
- </div>
68
-
69
- <h2>Why prompt rules fail</h2>
70
- <ul>
71
- <li><strong>Context overflow</strong> &mdash; as the conversation grows, early instructions get compressed or dropped</li>
72
- <li><strong>Reasoning override</strong> &mdash; the agent decides force-push is the "correct" solution to a merge conflict</li>
73
- <li><strong>No enforcement layer</strong> &mdash; nothing physically stops the tool call from executing</li>
74
- </ul>
75
-
76
- <h2>The fix: a pre-action gate</h2>
77
- <p>A pre-action gate intercepts the tool call <em>before</em> it executes. It pattern-matches the command against known-bad actions and blocks them. The agent cannot bypass it because the gate runs outside the agent's control, at the MCP hook layer.</p>
78
-
79
- <h3>Step 1: Install ThumbGate</h3>
80
- <pre><code>npx thumbgate init</code></pre>
81
- <p>This auto-detects your agent (Claude Code, Cursor, etc.) and configures the PreToolUse hook.</p>
82
-
83
- <h3>Step 2: Give feedback</h3>
84
- <p>The next time your agent tries a force-push (or anything dangerous), give it a thumbs-down with context:</p>
85
- <pre><code>👎 "Never force-push to main. This destroyed 14 commits last time."</code></pre>
86
-
87
- <h3>Step 3: Gate auto-generates</h3>
88
- <p>ThumbGate captures the feedback, matches it against the tool call pattern, and auto-generates a prevention rule. After repeated failures (configurable), it promotes to a hard gate:</p>
89
- <pre><code># Auto-generated prevention rule
90
- pattern: "git push --force"
91
- target_branch: "main"
92
- action: BLOCK
93
- reason: "Force-push to main blocked — destroyed 14 commits (2026-03-15)"</code></pre>
94
-
95
- <h3>Step 4: Gate fires on every future attempt</h3>
96
- <p>The PreToolUse hook checks every <code>Bash</code> tool call. If it matches <code>git push --force</code> targeting <code>main</code>, the action is blocked before execution. The agent receives a rejection with the reason and adapts.</p>
97
-
98
- <div class="callout">
99
- <strong>Key difference:</strong> Prompt rules ask nicely. Pre-action gates physically block. The gate runs at the hook layer, outside the agent's reasoning chain, so it cannot be overridden by context or chain-of-thought.
100
- </div>
101
-
102
- <h2>What about other dangerous actions?</h2>
103
- <p>The same pattern works for any tool call you want to prevent:</p>
104
- <ul>
105
- <li><code>DROP TABLE</code> on production databases</li>
106
- <li><code>rm -rf</code> on project directories</li>
107
- <li>Committing <code>.env</code> files with secrets</li>
108
- <li>Running untested migrations on prod</li>
109
- <li>Skipping test suites before deploy</li>
110
- </ul>
111
- <p>Every thumbs-down teaches the system. Thompson Sampling adapts gate sensitivity: high-risk patterns get strict enforcement, low-risk ones stay relaxed.</p>
112
-
113
- <div class="cta-box">
114
- <h2 style="color:var(--text);font-size:1.3rem;margin:0 0 8px;">Try it now</h2>
115
- <p>One command. Your agent stops repeating mistakes today.</p>
116
- <div class="cta-install">$ npx thumbgate init</div>
117
- </div>
118
-
119
- <div class="related">
120
- <h3>Related guides</h3>
121
- <a href="/learn/vibe-coding-safety-net">The Vibe Coding Safety Net You Are Missing &rarr;</a>
122
- <a href="/learn/mcp-pre-action-gates-explained">MCP Pre-Action Gates Explained &rarr;</a>
123
- <a href="/guide">Full Setup Guide &rarr;</a>
124
- </div>
125
- </div>
126
-
127
-
128
- <div class="sticky-cta">
129
- <span style="color:var(--muted)">Try it now:</span>
130
- <code>npx thumbgate init</code>
131
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub &rarr;</a>
132
- </div>
133
- </body>
134
- </html>
package/public/learn/vibe-coding-safety-net.html DELETED
@@ -1,142 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="UTF-8">
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
- <title>The Vibe Coding Safety Net You Are Missing — ThumbGate</title>
7
- <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
8
- <meta name="description" content="Vibe coding is fast until your AI agent deletes a production table or rewrites a file you did not ask it to touch. Add guardrails without slowing down.">
9
- <meta name="keywords" content="vibe coding safety, vibe coding guardrails, AI coding mistakes, Claude Code safety net, Cursor agent guardrails, AI agent enforcement, ThumbGate">
10
- <meta property="og:title" content="The Vibe Coding Safety Net You Are Missing">
11
- <meta property="og:description" content="Vibe coding is fast until your AI agent breaks something. Add guardrails without slowing down.">
12
- <meta property="og:type" content="article">
13
- <meta property="og:url" content="https://thumbgate-production.up.railway.app/learn/vibe-coding-safety-net">
14
- <link rel="canonical" href="https://thumbgate-production.up.railway.app/learn/vibe-coding-safety-net">
15
-
16
- <script type="application/ld+json">
17
- {
18
- "@context": "https://schema.org",
19
- "@type": "TechArticle",
20
- "headline": "The Vibe Coding Safety Net You Are Missing",
21
- "description": "Vibe coding is fast until your AI agent breaks something. Here is how to add guardrails that learn from your corrections.",
22
- "author": {
23
- "@type": "Person",
24
- "name": "Igor Ganapolsky",
25
- "url": "https://github.com/IgorGanapolsky"
26
- },
27
- "publisher": {
28
- "@type": "Organization",
29
- "name": "ThumbGate",
30
- "url": "https://thumbgate-production.up.railway.app"
31
- },
32
- "datePublished": "2026-04-01",
33
- "dateModified": "2026-04-01",
34
- "mainEntityOfPage": "https://thumbgate-production.up.railway.app/learn/vibe-coding-safety-net"
35
- }
36
- </script>
37
-
38
- <link rel="stylesheet" href="/learn/learn.css">
39
- <style>
40
- .comparison { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin: 1.5rem 0; }
41
- .comparison > div { background: var(--bg-card); border: 1px solid var(--border); border-radius: 8px; padding: 1rem; }
42
- .comparison h4 { font-size: 0.95rem; margin-bottom: 0.5rem; }
43
- .comparison .bad h4 { color: var(--red); }
44
- .comparison .good h4 { color: var(--green); }
45
- @media (max-width: 700px) { .comparison { grid-template-columns: 1fr; } }
46
- </style>
47
- </head>
48
- <body>
49
-
50
- <nav>
51
- <a href="/" class="brand">👍👎 ThumbGate</a>
52
- <a href="/guide">Setup Guide</a>
53
- <a href="/learn">Learn</a>
54
- <a href="/dashboard">Dashboard</a>
55
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub</a>
56
- </nav>
57
-
58
- <div class="container">
59
- <div class="breadcrumb"><a href="/learn">Learn</a> / Vibe Coding Safety Net</div>
60
- <h1>The Vibe Coding Safety Net You Are Missing</h1>
61
- <p style="color:var(--muted);">3 min read &middot; For developers who vibe-code with Claude Code, Cursor, Codex, or Gemini</p>
62
-
63
- <div class="tldr"><strong>TL;DR:</strong> Vibe coding is 10x faster until your agent breaks something. Add a feedback-driven safety net that learns from your corrections — without slowing you down.</div>
64
-
65
- <h2>Vibe coding is a superpower with a blindspot</h2>
66
- <p>You describe what you want. The agent builds it. You ship in hours what used to take days. But every vibe-coder has hit this wall: the agent does something catastrophically wrong, and you realize there was nothing stopping it.</p>
67
-
68
- <div class="comparison">
69
- <div class="bad">
70
- <h4>Without guardrails</h4>
71
- <ul>
72
- <li>Agent rewrites a file you did not mention</li>
73
- <li>Agent runs <code>DROP TABLE</code> in prod</li>
74
- <li>Agent force-pushes over teammate's commits</li>
75
- <li>Agent installs a dependency you rejected yesterday</li>
76
- <li>Same mistake repeats every session</li>
77
- </ul>
78
- </div>
79
- <div class="good">
80
- <h4>With ThumbGate</h4>
81
- <ul>
82
- <li>Gate blocks file writes outside scope</li>
83
- <li>Gate blocks destructive SQL before execution</li>
84
- <li>Gate blocks force-push to protected branches</li>
85
- <li>Gate remembers your rejection across sessions</li>
86
- <li>Mistakes are blocked permanently after feedback</li>
87
- </ul>
88
- </div>
89
- </div>
90
-
91
- <h2>Why CLAUDE.md and .cursorrules are not enough</h2>
92
- <p>Prompt rules live inside the agent's context. They compete with your conversation, the codebase, and the agent's own reasoning. When the context window fills up, prompt rules are the first thing to get compressed or ignored.</p>
93
- <p>Pre-action gates live <em>outside</em> the agent. They intercept tool calls at the hook layer (PreToolUse in MCP) before execution. The agent cannot override them because the gate runs in a separate process.</p>
94
-
95
- <div class="callout callout-green">
96
- <strong>Mental model:</strong> Prompt rules are speed limit signs. Pre-action gates are physical barriers. Signs can be ignored. Barriers cannot.
97
- </div>
98
-
99
- <h2>How to add guardrails in two minutes</h2>
100
- <ol>
101
- <li><strong>Install:</strong> <code>npx thumbgate init</code> — auto-detects your agent and configures hooks</li>
102
- <li><strong>Code normally:</strong> vibe-code as you always do, no workflow changes</li>
103
- <li><strong>Correct when needed:</strong> when the agent does something wrong, give it a thumbs-down with context</li>
104
- <li><strong>Gates build themselves:</strong> repeated failures auto-promote into prevention rules that block the action next time</li>
105
- </ol>
106
-
107
- <h2>It gets smarter over time</h2>
108
- <p>ThumbGate uses Thompson Sampling to adapt enforcement. Patterns that cause real damage get strict gates. Low-risk patterns stay relaxed. The system tunes itself based on your feedback — no manual rule-writing required.</p>
109
- <p>Every correction you make improves the model. Every thumbs-up reinforces good behavior. Over weeks, your agent develops an immune system tailored to your codebase and workflow.</p>
110
-
111
- <h2>What vibe-coders actually gate</h2>
112
- <p>Based on real usage patterns from ThumbGate users:</p>
113
- <ul>
114
- <li><strong>Git operations:</strong> force-push, branch deletion, rebase on shared branches</li>
115
- <li><strong>File mutations:</strong> writes to config files, package.json changes, lock file modifications</li>
116
- <li><strong>Database operations:</strong> destructive SQL, schema migrations without backup</li>
117
- <li><strong>Dependency management:</strong> installing packages the developer already rejected</li>
118
- <li><strong>Deployment:</strong> pushing to production without test suite passing</li>
119
- </ul>
120
-
121
- <div class="cta-box">
122
- <h2 style="color:var(--text);font-size:1.3rem;margin:0 0 8px;">Start with one gate</h2>
123
- <p>Install, vibe-code, and give your first thumbs-down. The safety net builds itself.</p>
124
- <div class="cta-install">$ npx thumbgate init</div>
125
- </div>
126
-
127
- <div class="related">
128
- <h3>Related guides</h3>
129
- <a href="/learn/stop-ai-agent-force-push">How to Stop AI Agents From Force-Pushing to Main &rarr;</a>
130
- <a href="/learn/mcp-pre-action-gates-explained">MCP Pre-Action Gates Explained &rarr;</a>
131
- <a href="/guide">Full Setup Guide &rarr;</a>
132
- </div>
133
- </div>
134
-
135
-
136
- <div class="sticky-cta">
137
- <span style="color:var(--muted)">Try it now:</span>
138
- <code>npx thumbgate init</code>
139
- <a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub &rarr;</a>
140
- </div>
141
- </body>
142
- </html>