thumbgate 1.4.3 → 1.4.5

package/.claude-plugin/bundle/server/index.js

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-const path = require('path');
-const { spawn } = require('child_process');
-
-const cliPath = path.join(__dirname, '..', '..', 'bin', 'cli.js');
-const child = spawn(process.execPath, [cliPath, 'serve'], {
-  stdio: 'inherit',
-  env: process.env,
-});
-
-child.on('exit', (code, signal) => {
-  if (signal) {
-    process.kill(process.pid, signal);
-    return;
-  }
-  process.exit(code ?? 1);
-});
-
-child.on('error', (error) => {
-  console.error(`[thumbgate] Failed to launch Claude Desktop bundle runtime: ${error.message}`);
-  process.exit(1);
-});

package/adapters/chatgpt/INSTALL.md

@@ -1,158 +0,0 @@
-# ChatGPT GPT Actions: ThumbGate Install
-
-Open the published ThumbGate GPT directly:
-
-https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate
-
-Use the GPT as the public front door: paste an AI action to check, save a thumbs-up/down lesson, write a Pre-Action Gate, install ThumbGate for an agent, or export proof.
-
-Users do **not** have to keep chatting inside the ThumbGate GPT for enforcement. The GPT is the fast demo, guided setup path, and ChatGPT memory surface. Real enforcement for coding agents still runs locally through ThumbGate hooks after `npx thumbgate init`.
-
-Marketing rule: every landing page, README, social post, and plugin listing should point to the live GPT before asking a cold user to read OpenAPI docs.
-
-## GPT Store path
-
-1. Open the direct GPT URL: https://chatgpt.com/g/g-69dcfd1cd5f881918ae31874631d6f08-thumbgate
-2. If ChatGPT does not open it for your account, open **Explore GPTs**.
-3. Search for `ThumbGate`.
-4. Choose the GPT by **Igor Ganapolsky** in the **Programming** category.
-
-## 30-second user flow
-
-1. Paste a proposed AI action, command, merge, deploy, file edit, email, payment, or API call.
-2. ThumbGate evaluates whether to allow, block, or require a checkpoint before the action runs.
-3. After any answer or agent run, reply with `thumbs up:` or `thumbs down:` plus one concrete sentence.
-4. ThumbGate saves the lesson, refreshes prevention rules when patterns repeat, and can show what it remembers.
-5. When the user is ready to enforce outside ChatGPT, send them to `npx thumbgate init` for Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, or another MCP-compatible agent.
-
-Regular users should never need to know MCP, OpenAPI, Actions, DPO, Thompson Sampling, or schema validation. The GPT should explain the loop as: "One signal becomes one remembered rule."
-
-## GPT profile card
-
-Use this copy in GPT Builder instead of the generic "AI safety gate" framing:
-
-Short description:
-
-```text
-Turn thumbs-down into prevention gates
-```
-
-Full description:
-
-```text
-Paste a proposed AI action or reply thumbs up/down after an answer. ThumbGate captures the lesson, searches prior mistakes, writes Pre-Action Gates, and tells you when to allow, block, or checkpoint. Built for developers using AI agents and proof-backed Reliability Gateway workflows.
-```
-
-Conversation starters:
-
-1. `Check this agent action before it runs: git push --force --tags`
-2. `Turn this mistake into a ThumbGate rule: the agent edited generated files again.`
-3. `Install ThumbGate for Claude Code or Codex in this repo.`
-4. `Search my saved lessons before you answer.`
-
-Use typed chat replies. ChatGPT's native feedback buttons may send feedback to OpenAI, but they should not be described as the ThumbGate capture path unless OpenAI exposes them to GPT Actions.
-
-## Pre-action gate flow
-
-Use this when the user asks whether an AI agent should run a proposed action, command, file edit, deployment, merge, or publish step:
-
-1. The GPT calls `evaluateDecision` (`POST /v1/decisions/evaluate`) before answering.
-2. If the response has `decisionControl.executionMode: "blocked"`, the GPT says the action is blocked and explains the returned reason.
-3. If the response has `decisionControl.executionMode: "checkpoint_required"`, the GPT asks for explicit confirmation before proceeding.
-4. If the response has `decisionControl.executionMode: "auto_execute"`, the GPT can say the action is allowed and summarize why.
-
-Plain thumbs-up/down feedback is the memory loop. The decision endpoint is the gate loop. Do not claim hard blocking unless the decision endpoint, a saved lesson, or a prevention rule was actually applied.
-
-## Best first GPT message
-
-Use this as the first response:
-
-```text
-Paste an AI action to check, or tell me what went right/wrong. I can block risky actions, save the lesson, write a prevention gate, or show what ThumbGate already remembers.
-```
-
-## Prerequisites
-
-- A ChatGPT Plus or Team account (Custom GPTs require a paid plan)
-- ThumbGate API running at `https://thumbgate-production.up.railway.app`
-- Privacy policy URL: `https://thumbgate-production.up.railway.app/privacy`
-- Owner-managed `THUMBGATE_API_KEY` for one-time GPT Builder Actions auth
-
-Regular GPT users should not need an API key, JSON payload, OpenAPI knowledge, or developer setup. They should only see the thumbs-up/down memory loop.
-
-## Step 1 — Open GPT Builder
-
-1. Go to [https://chat.openai.com/gpts/editor](https://chat.openai.com/gpts/editor)
-2. Click **Create a GPT**
-3. Switch to the **Configure** tab
-
-## Step 2 — Add Actions
-
-1. Scroll to the **Actions** section
-2. Click **Create new action**
-3. Click **Import from URL** — paste your hosted spec URL:
-   ```
-   https://thumbgate-production.up.railway.app/openapi.yaml
-   ```
-   Or click **Upload file** and select:
-   ```
-   adapters/chatgpt/openapi.yaml
-   ```
-
-## Step 3 — Set Authentication
-
-In the Actions panel:
-
-1. Select **Authentication type: API Key**
-2. **Auth type**: Bearer
-3. **API Key**: paste your `THUMBGATE_API_KEY` value
-
-This is an owner setup field. Do not ask regular GPT users to provide an API key.
-
-## Step 4 — Update the Server URL
-
-In the imported spec, confirm the `servers.url` points to your deployed API:
-
-```yaml
-servers:
-  - url: https://thumbgate-production.up.railway.app
-```
-
-If you uploaded the file, edit the server URL in the GPT Actions editor.
-
-## Step 5 — Verify
-
-Click **Test** on the `captureFeedback` action:
-
-```json
-{
-  "signal": "up",
-  "context": "GPT Actions install verified with a successful test call",
-  "whatWorked": "The hosted action returned accepted=true and a promoted status"
-}
-```
-
-Expected response: `200 OK` with `{ "accepted": true, "status": "promoted" }`.
-
-If you only send a bare `thumbs up/down` style payload, expect `422` with `status: "clarification_required"` and a follow-up `prompt`.
-
-## Available Actions
-
-| Action | Method | Path | Description |
-|---|---|---|---|
-| `captureFeedback` | POST | `/v1/feedback/capture` | Capture up/down signal plus one-line why |
-| `getFeedbackStats` | GET | `/v1/feedback/stats` | Aggregated feedback statistics |
-| `getFeedbackSummary` | GET | `/v1/feedback/summary` | Recent feedback summary |
-| `generatePreventionRules` | POST | `/v1/feedback/rules` | Generate prevention rules |
-| `exportDpoPairs` | POST | `/v1/dpo/export` | Export DPO preference pairs |
-| `listIntentCatalog` | GET | `/v1/intents/catalog` | List available intents |
-| `planIntent` | POST | `/v1/intents/plan` | Generate policy-scoped plan |
-| `constructContextPack` | POST | `/v1/context/construct` | Build context pack |
-
-Full spec: `adapters/chatgpt/openapi.yaml`
-
-## Troubleshooting
-
-- **401 Unauthorized**: Verify `THUMBGATE_API_KEY` is set and matches the Bearer token
-- **Connection refused**: Confirm Railway deployment is live (`curl https://<domain>/health`)
-- **Schema errors**: Ensure you are using the latest `openapi.yaml` (version 1.1.0+)

package/adapters/perplexity/.mcp.json

@@ -1,36 +0,0 @@
-{
-  "mcpServers": {
-    "thumbgate": {
-      "command": "npx",
-      "args": [
-        "--yes",
-        "--package",
-        "thumbgate@1.4.1",
-        "thumbgate",
-        "serve"
-      ]
-    },
-    "perplexity": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "@perplexity-ai/mcp-server"
-      ],
-      "env": {
-        "PERPLEXITY_API_KEY": "${PERPLEXITY_API_KEY}"
-      }
-    }
-  },
-  "hooks": {
-    "preToolUse": {
-      "command": "npx",
-      "args": [
-        "--yes",
-        "--package",
-        "thumbgate@1.4.1",
-        "thumbgate",
-        "gate-check"
-      ]
-    }
-  }
-}

package/adapters/perplexity/config.toml

@@ -1,16 +0,0 @@
-# Codex MCP profile: ThumbGate + Perplexity (copy into ~/.codex/config.toml or merge section)
-[mcp_servers.thumbgate]
-command = "npx"
-args = ["--yes", "--package", "thumbgate@1.4.1", "thumbgate", "serve"]
-
-[mcp_servers.perplexity]
-command = "npx"
-args = ["-y", "@perplexity-ai/mcp-server"]
-
-[mcp_servers.perplexity.env]
-PERPLEXITY_API_KEY = "${PERPLEXITY_API_KEY}"
-
-# Hard PreToolUse hook for Codex
-[hooks.pre_tool_use]
-command = "npx"
-args = ["--yes", "--package", "thumbgate@1.4.1", "thumbgate", "gate-check"]

package/adapters/perplexity/opencode.json

@@ -1,29 +0,0 @@
-{
-  "$schema": "https://opencode.ai/config.json",
-  "mcp": {
-    "thumbgate": {
-      "type": "local",
-      "command": [
-        "npx",
-        "--yes",
-        "--package",
-        "thumbgate@1.4.1",
-        "thumbgate",
-        "serve"
-      ],
-      "enabled": true
-    },
-    "perplexity": {
-      "type": "local",
-      "command": [
-        "npx",
-        "-y",
-        "@perplexity-ai/mcp-server"
-      ],
-      "env": {
-        "PERPLEXITY_API_KEY": "${PERPLEXITY_API_KEY}"
-      },
-      "enabled": true
-    }
-  }
-}

package/bin/memory.sh

@@ -1,64 +0,0 @@
-#!/bin/bash
-# bin/memory.sh - Layer 3 & 4 & 5 Memory Stack Refresher
-
-PRIMER_FILE="primer.md"
-
-if [ ! -f "$PRIMER_FILE" ]; then
-  echo "Error: $PRIMER_FILE not found."
-  exit 1
-fi
-
-echo "🤖 [Memory Stack] Refreshing context..."
-
-# 1. Behavioral Extraction (Layer 4)
-node scripts/behavioral-extraction.js > /dev/null
-TRAITS_FILE="$(node -e "const path = require('path'); const { resolveFeedbackDir } = require('./scripts/feedback-paths'); process.stdout.write(path.join(resolveFeedbackDir(), 'behavioral-traits.json'));" 2>/dev/null)"
-if [ -z "$TRAITS_FILE" ]; then
-  TRAITS_FILE=".thumbgate/behavioral-traits.json"
-fi
-
-# 2. Capture git context (Layer 3)
-CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
-LAST_COMMITS=$(git log -n 5 --oneline 2>/dev/null || echo "No commits found")
-DIRTY_FILES=$(git status --short 2>/dev/null || echo "")
-
-# 3. Rebuild Primer
-TEMP_FILE=$(mktemp)
-
-# Read primer until "## Behavioral Traits"
-sed -n '1,/## Behavioral Traits/p' "$PRIMER_FILE" > "$TEMP_FILE"
-echo "" >> "$TEMP_FILE"
-
-if [ -f "$TRAITS_FILE" ]; then
-  # Extract trait descriptions from JSON
-  cat "$TRAITS_FILE" | grep "description" | sed 's/.*: "//;s/".*//' | sed 's/^/- /' >> "$TEMP_FILE"
-else
-  echo "_No strong behavioral patterns identified yet._" >> "$TEMP_FILE"
-fi
-
-echo "" >> "$TEMP_FILE"
-echo "## Live Git Context" >> "$TEMP_FILE"
-echo "" >> "$TEMP_FILE"
-echo "### Branch: $CURRENT_BRANCH" >> "$TEMP_FILE"
-echo "" >> "$TEMP_FILE"
-echo "### Last 5 Commits:" >> "$TEMP_FILE"
-echo '```' >> "$TEMP_FILE"
-echo "$LAST_COMMITS" >> "$TEMP_FILE"
-echo '```' >> "$TEMP_FILE"
-echo "" >> "$TEMP_FILE"
-echo "### Modified Files:" >> "$TEMP_FILE"
-if [ -z "$DIRTY_FILES" ]; then
-  echo "_None (Clean working tree)_" >> "$TEMP_FILE"
-else
-  echo '```' >> "$TEMP_FILE"
-  echo "$DIRTY_FILES" >> "$TEMP_FILE"
-  echo '```' >> "$TEMP_FILE"
-fi
-
-mv "$TEMP_FILE" "$PRIMER_FILE"
-
-# 4. Sync to Obsidian (Layer 5)
-chmod +x bin/obsidian-sync.sh
-./bin/obsidian-sync.sh
-
-echo "✅ Context refresh complete."

package/bin/obsidian-sync.sh

@@ -1,20 +0,0 @@
-#!/bin/bash
-
-# obsidian-sync.sh
-#
-# Layer 5: Obsidian Knowledge Bridge
-# Exports ThumbGate data as interlinked Obsidian markdown notes to a vault.
-
-VAULT_PATH=$THUMBGATE_OBSIDIAN_VAULT_PATH
-PROJECT_NAME=$(basename "$(pwd)")
-
-if [ -z "$VAULT_PATH" ]; then
-  echo "🤖 [Layer 5] THUMBGATE_OBSIDIAN_VAULT_PATH not set. Skipping sync."
-  exit 0
-fi
-
-echo "🤖 [Layer 5] Exporting memories to Obsidian vault: $VAULT_PATH/AI-Memories/$PROJECT_NAME"
-
-npx thumbgate obsidian-export --vault-path="$VAULT_PATH" --output-dir="AI-Memories/$PROJECT_NAME"
-
-echo "✅ Sync complete."

package/plugins/amp-skill/INSTALL.md

@@ -1,52 +0,0 @@
-# Amp: ThumbGate Feedback Skill Install
-
-Install the ThumbGate skill for Amp in under 60 seconds. No manual file editing required.
-
-## One-Command Install
-
-```bash
-cp plugins/amp-skill/SKILL.md .amp/skills/thumbgate-feedback.md
-```
-
-Or from the npm package:
-
-```bash
-npx thumbgate init
-cp node_modules/thumbgate/plugins/amp-skill/SKILL.md .amp/skills/thumbgate-feedback.md
-```
-
-## What This Does
-
-Copies the skill definition to `.amp/skills/` so Amp loads it automatically on next launch.
-
-## Verify
-
-After copying, restart Amp. The skill will appear in the active skills list.
-
-Then test:
-
-```bash
-npx thumbgate capture --feedback=up --context="amp skill install verified" --tags="install"
-```
-
-## Available Commands (via skill)
-
-```bash
-# Positive feedback
-npx thumbgate capture --feedback=up --context="..." --tags="..."
-
-# Negative feedback
-npx thumbgate capture --feedback=down --context="..." --what-went-wrong="..." --what-to-change="..." --tags="..."
-```
-
-## Requirements
-
-- Amp (any version with skills support)
-- Node.js 18+ in PATH
-- `.thumbgate/` directory (created by `npx thumbgate init`)
-
-## Uninstall
-
-```bash
-rm .amp/skills/thumbgate-feedback.md
-```

package/plugins/amp-skill/SKILL.md

@@ -1,64 +0,0 @@
----
-name: thumbgate-feedback
-description: Dual-write feedback to Amp MCP memory AND thumbgate for DPO export, analytics, and cross-platform portability
----
-
-# ThumbGate Feedback Skill (Dual-Write)
-
-This skill captures feedback in TWO places simultaneously:
-1. **Amp MCP memory** — for immediate in-session recall (native to Amp)
-2. **thumbgate** — for DPO export, LanceDB vectors, prevention rules, and cross-platform analytics
-
-## On thumbs up / positive feedback
-
-First, store in Amp's native memory for in-session recall:
-```
-Use mcp__memory__remember to store: "GOOD: {context}. What worked: {details}"
-```
-
-Then, pipe to thumbgate for DPO export and analytics:
-```bash
-npx -y thumbgate capture --feedback=up --context="..." --what-worked="..." --tags="..."
-```
-
-## On thumbs down / negative feedback
-
-First, store in Amp's native memory so the mistake is recalled immediately:
-```
-Use mcp__memory__remember to store: "BAD: {context}. What went wrong: {details}. Fix: {what to change}"
-```
-
-Then, pipe to thumbgate for prevention rules and DPO pairs:
-```bash
-npx -y thumbgate capture --feedback=down --context="..." --what-went-wrong="..." --what-to-change="..." --tags="..."
-```
-
-## Before starting a new task
-
-Recall from Amp's memory (instant, in-session):
-```
-Use mcp__memory__recall with query describing the current task
-```
-
-Also check thumbgate for cross-session prevention rules:
-```bash
-npx -y thumbgate rules
-```
-
-## Triggers
-
-- "thumbs up" / "that worked" / "looks good" / "nice" / "perfect"
-- "thumbs down" / "that failed" / "that was wrong" / "no" / "fix this"
-
-## Negative Triggers (do NOT activate for)
-
-- "generate code" / "search files" / "explain this" / "run tests"
-
-## Why dual-write?
-
-Amp's MCP memory gives you instant in-session recall. thumbgate gives you:
-- **DPO training pairs** for fine-tuning your model
-- **Prevention rules** that block repeated mistakes
-- **Cross-platform portability** — same feedback works in Claude, Codex, Gemini
-- **LanceDB vector search** for semantic similarity across sessions
-- **REST API** for team dashboards and analytics

package/plugins/claude-codex-bridge/.claude-plugin/plugin.json

@@ -1,22 +0,0 @@
-{
-  "name": "codex-bridge",
-  "version": "1.4.3",
-  "description": "Run Codex review, adversarial review, and second-pass handoffs from Claude Code while keeping ThumbGate reliability memory in the loop.",
-  "author": {
-    "name": "Igor Ganapolsky",
-    "url": "https://github.com/IgorGanapolsky"
-  },
-  "homepage": "https://thumbgate-production.up.railway.app",
-  "repository": "https://github.com/IgorGanapolsky/ThumbGate",
-  "license": "MIT",
-  "keywords": [
-    "claude-code",
-    "codex",
-    "codex-review",
-    "adversarial-review",
-    "thumbgate",
-    "pre-action-gates",
-    "agent-reliability"
-  ],
-  "mcpServers": "./.mcp.json"
-}

package/plugins/claude-codex-bridge/.mcp.json

@@ -1,14 +0,0 @@
-{
-  "mcpServers": {
-    "thumbgate": {
-      "command": "npx",
-      "args": [
-        "--yes",
-        "--package",
-        "thumbgate@1.4.3",
-        "thumbgate",
-        "serve"
-      ]
-    }
-  }
-}

package/plugins/claude-codex-bridge/INSTALL.md

@@ -1,43 +0,0 @@
-# Install ThumbGate Codex Bridge for Claude Code
-
-## One-command session install
-
-```bash
-claude --plugin-dir "$(pwd)/plugins/claude-codex-bridge"
-```
-
-That loads the plugin for the current Claude Code session and makes the following skills available:
-
-- `/codex-bridge:setup`
-- `/codex-bridge:review`
-- `/codex-bridge:adversarial-review`
-- `/codex-bridge:second-pass`
-- `/codex-bridge:status`
-- `/codex-bridge:result`
-
-## Verify
-
-```bash
-claude plugin validate plugins/claude-codex-bridge
-node plugins/claude-codex-bridge/scripts/codex-bridge.js setup
-```
-
-Expected setup proof:
-
-- `codexInstalled: true`
-- `reviewCommand: true`
-- `execCommand: true`
-- `dataDir` points at the plugin data directory
-
-## Typical flow
-
-1. Run `/codex-bridge:review base=main` before merge.
-2. Run `/codex-bridge:adversarial-review` before deploy or publish.
-3. Run `/codex-bridge:second-pass focus on billing webhook hardening` when you want Codex to take another shot.
-4. Run `/codex-bridge:status` or `/codex-bridge:result` to inspect the saved artifact.
-
-## Codex prerequisites
-
-- `codex` must be installed and authenticated on the machine.
-- ThumbGate's existing Codex MCP profile still lives at `plugins/codex-profile/`.
-- This bridge plugin does not replace the Codex profile; it gives Claude Code a clean way to call Codex from the same repo.

package/plugins/claude-codex-bridge/README.md

@@ -1,46 +0,0 @@
-# ThumbGate Codex Bridge for Claude Code
-
-This repo-local Claude Code plugin brings Codex into the same workflow for three high-ROI cases:
-
-- independent review of uncommitted work or a base diff
-- skeptical adversarial review before risky merges or deploys
-- second-pass handoff when you want a different agent to take another shot
-
-The plugin keeps ThumbGate's local reliability memory available through the bundled `thumbgate` MCP server while the bridge script persists Codex artifacts in `${CLAUDE_PLUGIN_DATA}`.
-
-## Shipped skills
-
-- `/codex-bridge:setup` — verify Codex CLI, plugin data path, and ThumbGate MCP wiring
-- `/codex-bridge:review` — run a normal Codex review against `--uncommitted`, `--base`, or `--commit`
-- `/codex-bridge:adversarial-review` — run a stricter review focused on hidden regressions and security risk
-- `/codex-bridge:second-pass` — hand off the current task or diff to Codex for a second pass
-- `/codex-bridge:status` — show the latest saved bridge artifact metadata
-- `/codex-bridge:result` — print the last saved Codex output
-
-## Install
-
-Run Claude Code with the repo-local plugin loaded:
-
-```bash
-claude --plugin-dir "$(pwd)/plugins/claude-codex-bridge"
-```
-
-Validate the plugin shape before shipping changes:
-
-```bash
-claude plugin validate plugins/claude-codex-bridge
-```
-
-The plugin launches ThumbGate's MCP server automatically through `plugins/claude-codex-bridge/.mcp.json`, so Claude Code gets the reliability tools without extra configuration.
-
-## How it works
-
-1. Claude invokes a bridge skill such as `/codex-bridge:review`.
-2. The skill runs `plugins/claude-codex-bridge/scripts/codex-bridge.js`.
-3. The bridge script shells out to `codex exec review` or `codex exec`.
-4. Codex output is saved under `${CLAUDE_PLUGIN_DATA}/runs/`.
-5. `/codex-bridge:status` and `/codex-bridge:result` replay the latest artifact without rerunning Codex.
-
-## Why this matters
-
-ThumbGate is not trying to replace Codex. The point is to give Claude Code users a fast second reviewer and adversarial pass while keeping pre-action gates, thumbs-up/down feedback memory, and proof artifacts local-first.