npm - thumbgate - Versions diffs - 1.5.2 → 1.5.4 - Mend

thumbgate 1.5.2 → 1.5.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/.claude-plugin/marketplace.json +2 -2
package/.claude-plugin/plugin.json +1 -1
package/.well-known/mcp/server-card.json +1 -1
package/README.md +10 -6
package/adapters/README.md +1 -1
package/adapters/claude/.mcp.json +2 -2
package/adapters/codex/config.toml +2 -2
package/adapters/mcp/server-stdio.js +1 -1
package/adapters/opencode/opencode.json +1 -1
package/package.json +12 -3
package/public/blog.html +474 -0
package/public/dashboard.html +39 -2
package/public/index.html +8 -9
package/public/learn.html +274 -0
package/public/lessons.html +16 -0
package/public/pro.html +1087 -0

package/public/blog.html ADDED Viewed

@@ -0,0 +1,474 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>ThumbGate Blog — Agent Governance Engineering</title>
+    <script defer data-domain="thumbgate-production.up.railway.app" src="https://plausible.io/js/script.js"></script>
+    <meta
+      name="description"
+      content="Technical breakdowns, release notes, and agent governance insights from the ThumbGate team."
+    />
+    <link
+      rel="canonical"
+      href="https://thumbgate-production.up.railway.app/blog"
+    />
+    <meta
+      property="og:title"
+      content="ThumbGate Blog — Agent Governance Engineering"
+    />
+    <meta
+      property="og:description"
+      content="Technical breakdowns, release notes, and agent governance insights from the ThumbGate team."
+    />
+    <meta property="og:type" content="website" />
+    <meta
+      property="og:url"
+      content="https://thumbgate-production.up.railway.app/blog"
+    />
+    <script type="application/ld+json">
+      {
+        "@context": "https://schema.org",
+        "@type": "Blog",
+        "name": "ThumbGate Blog",
+        "url": "https://thumbgate-production.up.railway.app/blog",
+        "publisher": { "@type": "Organization", "name": "Max Smith KDP LLC" },
+        "blogPost": [
+          {
+            "@type": "BlogPosting",
+            "headline": "Your AI agent is a supply chain attack surface. Here's how to gate it.",
+            "datePublished": "2026-04-10",
+            "keywords": "AI agent security, supply chain attack, pre-action gates, agent governance, ThumbGate"
+          },
+          {
+            "@type": "BlogPosting",
+            "headline": "The Claude Code Leak Proves Why Pre-Action Gates Matter",
+            "datePublished": "2026-04-01",
+            "keywords": "Claude Code security, Claude Code guardrails, AI agent safety, pre-action gates"
+          },
+          {
+            "@type": "BlogPosting",
+            "headline": "v0.8.5: Gate Reasoning Chains, Org Dashboard, and the Checkout Funnel That Didn't Exist",
+            "datePublished": "2026-03-31"
+          }
+        ]
+      }
+    </script>
+    <style>
+      :root {
+        --bg: #0a0a0a;
+        --surface: #141414;
+        --border: #2a2a2a;
+        --text: #e0e0e0;
+        --text-dim: #888;
+        --cyan: #00d4aa;
+      }
+      * {
+        margin: 0;
+        padding: 0;
+        box-sizing: border-box;
+      }
+      body {
+        font-family:
+          -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+        background: var(--bg);
+        color: var(--text);
+        line-height: 1.7;
+      }
+      .container {
+        max-width: 720px;
+        margin: 0 auto;
+        padding: 0 24px;
+      }
+      header {
+        padding: 24px 0;
+        border-bottom: 1px solid var(--border);
+      }
+      header a {
+        color: var(--cyan);
+        text-decoration: none;
+        font-weight: 600;
+      }
+      h1 {
+        font-size: 18px;
+        font-weight: 700;
+      }
+      .post {
+        padding: 48px 0;
+        border-bottom: 1px solid var(--border);
+      }
+      .post-date {
+        font-size: 13px;
+        color: var(--text-dim);
+        margin-bottom: 8px;
+      }
+      .post h2 {
+        font-size: 24px;
+        font-weight: 700;
+        margin-bottom: 16px;
+        letter-spacing: -0.02em;
+      }
+      .post h3 {
+        font-size: 18px;
+        font-weight: 600;
+        margin: 24px 0 8px;
+      }
+      .post p {
+        margin-bottom: 16px;
+        color: var(--text-dim);
+      }
+      .post ul {
+        margin: 0 0 16px 24px;
+        color: var(--text-dim);
+      }
+      .post li {
+        margin-bottom: 6px;
+      }
+      .post code {
+        background: var(--surface);
+        padding: 2px 6px;
+        border-radius: 4px;
+        font-size: 14px;
+      }
+      .post strong {
+        color: var(--text);
+      }
+      .cta {
+        display: inline-block;
+        margin-top: 16px;
+        padding: 10px 20px;
+        background: var(--cyan);
+        color: #000;
+        border-radius: 6px;
+        text-decoration: none;
+        font-weight: 600;
+        font-size: 14px;
+      }
+      footer {
+        padding: 48px 0 24px;
+        text-align: center;
+        color: var(--text-dim);
+        font-size: 13px;
+      }
+      footer a {
+        color: var(--cyan);
+        text-decoration: none;
+      }
+    </style>
+  </head>
+  <body>
+    <header>
+      <div
+        class="container"
+        style="
+          display: flex;
+          justify-content: space-between;
+          align-items: center;
+        "
+      >
+        <h1><a href="/">ThumbGate</a> / Blog</h1>
+        <a href="/">Back to home</a>
+      </div>
+    </header>
+    <div class="container">
+      <article class="post">
+        <div class="post-date">April 10, 2026</div>
+        <h2>Your AI agent is a supply chain attack surface. Here's how to gate it.</h2>
+        <p>
+          Your AI coding agent runs shell commands. It installs packages. It
+          modifies files, pushes commits, and calls external APIs &mdash; all
+          without requiring you to type a single character. That's the pitch.
+          That's also the attack surface.
+        </p>
+        <h3>The gap is pre-action enforcement</h3>
+        <p>
+          Static analysis catches known-bad patterns in code you've already
+          written. Dependency scanners audit lock files <em>after</em> packages
+          are installed. By the time your scanner flags a problem, the agent
+          already ran the command.
+        </p>
+        <p>
+          These tools operate on the <em>output</em> of agent actions. You need
+          something that operates on the <em>input</em> &mdash; before execution.
+        </p>
+        <h3>Pre-Action Gates via PreToolUse hooks</h3>
+        <p>
+          ThumbGate implements pre-action gates via <code>PreToolUse</code> hooks
+          &mdash; interception points that run before every tool invocation. No
+          action reaches execution without passing through the gate. Not Bash
+          commands, not file edits, not web fetches.
+        </p>
+        <p>
+          What makes this more than a static blocklist is the
+          <strong>feedback-to-enforcement pipeline</strong>. When something goes
+          wrong, you record a thumbs-down with context. That failure feeds a
+          promotion engine. One failure becomes a warning. Three confirmed
+          failures of the same pattern become a hard block.
+        </p>
+        <h3>Real examples</h3>
+        <ul>
+          <li>
+            <strong>Force-push to main</strong> &mdash; Gate fires, push never
+            happens. Agent is redirected to create a branch and open a PR.
+          </li>
+          <li>
+            <strong>Unknown dependency install</strong> &mdash; Flagged for human
+            review. Agent pauses until you approve.
+          </li>
+          <li>
+            <strong>Destructive shell command</strong> &mdash; Blocked by a
+            prevention rule learned from a prior incident.
+          </li>
+        </ul>
+        <h3>Five-minute setup</h3>
+        <p>
+          <code>npx thumbgate init</code> installs the PreToolUse hook and
+          generates a starter gate config. Gates are just JSON &mdash; commit
+          them, review them, share them across your team.
+        </p>
+        <p>
+          <strong>Human judgment leads. AI supports. ThumbGate enforces it.</strong>
+        </p>
+        <a class="cta" href="/guide">Full setup guide &rarr;</a>
+      </article>
+      <article class="post">
+        <div class="post-date">April 1, 2026</div>
+        <h2>Dual-Signal Feedback: Why "What Failed" Isn't Enough</h2>
+        <p>
+          Standard thumbs-down tells you <em>something</em> went wrong. But was
+          it a bad decision (wrong tool) or bad execution (right tool, wrong
+          parameters)?
+        </p>
+        <p>
+          Inspired by
+          <a
+            href="https://huggingface.co/papers/2603.28767"
+            style="color: var(--cyan)"
+            >Gen-Searcher's dual reward system</a
+          >, ThumbGate now supports an optional <code>failureType</code> field
+          on <code>capture_feedback</code>:
+        </p>
+        <ul>
+          <li>
+            <strong><code>"decision"</code></strong> — the agent chose the wrong
+            action entirely
+          </li>
+          <li>
+            <strong><code>"execution"</code></strong> — right action, bad
+            parameters or output
+          </li>
+        </ul>
+        <p>
+          Thompson Sampling creates separate sub-arms (e.g.,
+          <code>git:decision</code> and <code>git:execution</code>) so
+          reliability scores diverge per dimension. An agent might be great at
+          choosing git commands but bad at parameterizing them — now you can see
+          that distinction.
+        </p>
+        <p>
+          Backward compatible. Existing feedback without
+          <code>failureType</code> works unchanged.
+        </p>
+        <a class="cta" href="https://www.npmjs.com/package/thumbgate"
+          >Try it now</a
+        >
+      </article>
+      <article class="post">
+        <div class="post-date">April 1, 2026</div>
+        <h2>The Claude Code Leak Proves Why Pre-Action Gates Matter</h2>
+        <p>
+          Anthropic accidentally shipped 512,000 lines of Claude Code source
+          inside an npm package. A missing <code>.npmignore</code> exposed the
+          full agent architecture: tool-call loops, permission models, retry
+          logic, 44 unreleased feature flags.
+        </p>
+        <p>
+          Within 24 hours, a clean rewrite called Claw-code hit 100K GitHub
+          stars — the fastest-growing repo in GitHub history.
+        </p>
+        <h3>What the leak revealed about agent security</h3>
+        <p>
+          Claude Code has a sophisticated permission model and tool-calling
+          pipeline. What it does <strong>not</strong> have is feedback-driven
+          enforcement — the ability to learn from past mistakes and physically
+          block the agent from repeating them.
+        </p>
+        <p>
+          That's exactly what ThumbGate does. Every Claude Code user — and every
+          Claw-code user — can add pre-action gates today:
+        </p>
+        <ul>
+          <li>
+            <strong>Thumbs-down a mistake</strong> — it auto-generates a
+            prevention rule
+          </li>
+          <li>
+            <strong>Gates enforce</strong> — PreToolUse hooks block the action
+            before execution
+          </li>
+          <li>
+            <strong>Reasoning chains explain</strong> — every block tells you
+            WHY
+          </li>
+          <li>
+            <strong>Thompson Sampling adapts</strong> — confidence tiers prevent
+            false blocks
+          </li>
+        </ul>
+        <h3>Install in 30 seconds</h3>
+        <p>
+          <code>npx thumbgate init</code> works with Claude Code,
+          Claw-code, Cursor, Codex, Gemini, Amp, and any MCP-compatible agent.
+        </p>
+        <p>
+          The leak proves agents are powerful but fallible software. Memory
+          without enforcement is a suggestion.
+          <strong>ThumbGate is a guarantee.</strong>
+        </p>
+        <a class="cta" href="https://www.npmjs.com/package/thumbgate"
+          >Install ThumbGate</a
+        >
+      </article>
+      <article class="post">
+        <div class="post-date">March 31, 2026</div>
+        <h2>
+          v0.8.5: Gate Reasoning Chains, Org Dashboard, and the Checkout Funnel
+          That Didn't Exist
+        </h2>
+        <p>
+          ThumbGate v0.8.5 is our biggest release yet. Here's what shipped and
+          why.
+        </p>
+        <h3>The problem we didn't see</h3>
+        <p>
+          ~1,700 developers install ThumbGate via npm every month.
+          <strong>Zero of them ever saw a checkout button.</strong> They find
+          the GitHub README, run <code>npx thumbgate init</code>, use
+          it for free, and never visit the landing page. The checkout flow
+          nobody reaches is irrelevant. We were optimizing a storefront in a
+          building with no door.
+        </p>
+        <h3>Gate reasoning chains</h3>
+        <p>
+          Every gate block and warning now explains <strong>WHY</strong> it
+          fired. When ThumbGate blocks a <code>git push --force</code>, the
+          response includes:
+        </p>
+        <ul>
+          <li>Which pattern matched and what it matched against</li>
+          <li>Gate identity: ID, action, layer, severity</li>
+          <li>Source: manual policy rule vs auto-promoted from feedback</li>
+          <li>
+            How to bypass: <code>satisfy_gate("pr_threads_checked")</code>
+          </li>
+          <li>Historical fire count: "blocked 23x, warned 15x"</li>
+        </ul>
+        <p>
+          This was inspired by the neuro-symbolic explainability trend in
+          production AI systems. Gates are the symbolic rules; Thompson Sampling
+          provides the statistical confidence. The reasoning chain bridges both.
+        </p>
+        <h3>Multi-agent org dashboard</h3>
+        <p>
+          "I'm not going to have 10,000 agents running in the environment that I
+          don't know what they're doing." — CIO.com, March 2026
+        </p>
+        <p>
+          The new <code>org_dashboard</code> MCP tool aggregates gate decisions
+          across all registered agent sessions. CIOs and team leads see: total
+          active agents, org-wide adherence rate, top blocked gates, and risk
+          agents (those with the lowest adherence). Free tier shows 3 agents;
+          Pro shows the full org.
+        </p>
+        <h3>Multi-hop agentic retrieval</h3>
+        <p>
+          Inspired by Chroma's Context-1,
+          <code>constructMultiHopPack</code> iteratively retrieves context,
+          prunes weak chunks, refines the query with expansion terms, and checks
+          coverage — stopping when the coverage threshold (60%) is met or max
+          hops are reached. Each hop is logged.
+        </p>
+        <h3>Thompson Sampling calibration</h3>
+        <p>
+          <code>MIN_SAMPLES_THRESHOLD</code> (5) prevents low-sample
+          overconfidence. <code>getCalibration()</code> reports per-category
+          confidence tiers: none (0 samples), low (1-4), medium (5-19), high
+          (20+). Callers know when to trust the statistical arm vs fall back to
+          rules.
+        </p>
+        <h3>The funnel fix</h3>
+        <p>
+          Four touchpoints now put the checkout URL where 100% of npm users
+          actually are:
+        </p>
+        <ul>
+          <li>
+            <strong>Post-install banner</strong> — prints after
+            <code>npm install</code> (stderr, CI-safe)
+          </li>
+          <li>
+            <strong>Free-tier rate limits</strong> — power features capped,
+            upgrade URL in error
+          </li>
+          <li>
+            <strong>MCP enforceLimit</strong> — agents surface the checkout URL
+            when limits hit
+          </li>
+          <li>
+            <strong>CLI upgrade nudge</strong> — after <code>init</code>,
+            <code>capture</code>, <code>stats</code>
+          </li>
+        </ul>
+        <p>
+          13 funnel invariant CI tests prevent this blindspot from ever
+          regressing.
+        </p>
+        <a class="cta" href="https://www.npmjs.com/package/thumbgate"
+          >Install v0.8.5 on npm</a
+        >
+      </article>
+    </div>
+    <footer>
+      <div class="container">
+        <a href="/">Home</a> ·
+        <a href="https://github.com/IgorGanapolsky/ThumbGate">GitHub</a> ·
+        <a href="https://x.com/IgorGanapolsky">X</a> ·
+        <a href="https://www.linkedin.com/in/igorganapolsky">LinkedIn</a>
+        <br /><br />© 2026 Max Smith KDP LLC · MIT License
+      </div>
+    </footer>
+  </body>
+</html>

package/public/dashboard.html CHANGED Viewed

@@ -620,8 +620,45 @@ function setSource(el, source) {
 function switchTab(name) {
   document.querySelectorAll('.tab').forEach(function(t) { t.classList.remove('active'); });
   document.querySelectorAll('.tab-content').forEach(function(c) { c.classList.remove('active'); });
-  document.querySelector('[onclick*="' + name + '"]').classList.add('active');
-  document.getElementById('tab-' + name).classList.add('active');
+  var tabEl = document.querySelector('[onclick*="' + name + '"]');
+  var contentEl = document.getElementById('tab-' + name);
+  if (tabEl) tabEl.classList.add('active');
+  if (contentEl) contentEl.classList.add('active');
+  // Sync URL hash so deep-links stay shareable without scroll jump
+  try {
+    if (('#' + name) !== window.location.hash) {
+      history.replaceState(null, '', '#' + name);
+    }
+  } catch (e) { /* ignore: older browsers or sandboxed frames */ }
+}
+/**
+ * Resolve deep-link tab target from URL hash or query string.
+ * Supports: /dashboard#insights, /dashboard?tab=gates, /dashboard#tab-export.
+ * Valid targets match tab-content ids (search, gates, team, generated,
+ * settings, templates, insights, export).
+ */
+function getDeepLinkTab() {
+  var valid = ['search', 'gates', 'team', 'generated', 'settings', 'templates', 'insights', 'export'];
+  var raw = (window.location.hash || '').replace(/^#/, '').replace(/^tab-/, '');
+  if (!raw) {
+    try {
+      var q = new URLSearchParams(window.location.search);
+      raw = (q.get('tab') || '').trim();
+    } catch (e) { raw = ''; }
+  }
+  return valid.indexOf(raw) >= 0 ? raw : null;
+}
+function applyDeepLinkTab() {
+  var target = getDeepLinkTab();
+  if (target) switchTab(target);
+}
+// Apply deep-link on initial load AND on hash change (so back/forward works)
+if (typeof window !== 'undefined') {
+  window.addEventListener('DOMContentLoaded', applyDeepLinkTab);
+  window.addEventListener('hashchange', applyDeepLinkTab);
 }
 async function loadGates() {

package/public/index.html CHANGED Viewed

@@ -872,7 +872,7 @@ __GA_BOOTSTRAP__
 <!-- HOW IT WORKS -->
 <section class="how-it-works" id="how-it-works">
   <div class="container">
-    <div class="section-label">New in v1.5.2</div>
+    <div class="section-label">New in v1.5.4</div>
     <h2 class="section-title">Three steps to stop repeated AI failures</h2>
     <div class="steps">
       <div class="step">
@@ -1024,12 +1024,11 @@ __GA_BOOTSTRAP__
         <p style="font-size:13px;color:#aaa;margin-bottom:16px;">3 captures, 1 rule, 1 agent. Enough to prove the enforcement loop works. When you need more, you will know.</p>
         <ul>
           <li><strong>3 feedback captures total</strong> (not per day)</li>
-          <li>1 prevention rule</li>
-          <li>1 agent</li>
+          <li>1 auto-promoted prevention rule</li>
           <li>No recall or lesson search</li>
-          <li>No exports</li>
-          <li>All MCP integrations (Claude Code, Cursor, Codex, etc.)</li>
-          <li>PreToolUse hook blocking</li>
+          <li>No exports (DPO, Databricks, HuggingFace)</li>
+          <li>All MCP integrations (Claude Code, Cursor, Codex, Gemini, Amp, any MCP agent)</li>
+          <li>PreToolUse hook blocking with built-in safety gates (force-push, destructive SQL, secrets)</li>
           <li><a href="/guide" style="color:var(--cyan);text-decoration:underline;">Setup guide for all agents →</a></li>
         </ul>
         <div class="hero-install" onclick="copyInstall(this)" title="Click to copy" style="margin-bottom:12px;width:100%;justify-content:center;">
@@ -1060,9 +1059,9 @@ __GA_BOOTSTRAP__
         </div>
         <ul>
           <li>Everything in Free, plus:</li>
-          <li><a href="/dashboard" style="color:var(--cyan);text-decoration:underline;">Visual gate debugger →</a> see every blocked action and the gate that fired so you can trust the system in minutes</li>
+          <li><a href="/dashboard#insights" style="color:var(--cyan);text-decoration:underline;">Visual gate debugger →</a> see every blocked action and the gate that fired so you can trust the system in minutes</li>
           <li>Auto-connect — activate once with your license key, then your running agents appear automatically on your local dashboard</li>
-          <li><a href="/dashboard" style="color:var(--cyan);text-decoration:underline;">DPO training data export →</a> turn real thumbs-downs into ready-to-use preference pairs for fine-tuning (LoRA / JSONL)</li>
+          <li><a href="/dashboard#export" style="color:var(--cyan);text-decoration:underline;">DPO training data export →</a> turn real thumbs-downs into ready-to-use preference pairs for fine-tuning (LoRA / JSONL)</li>
           <li><strong>HuggingFace dataset export</strong> — share PII-redacted agent traces as open training datasets (<code>npm run export:hf</code>)</li>
           <li><strong>Model Hardening Advisor</strong> — get recommendations on when and how to fine-tune your model to natively avoid recurring failures</li>
           <li>Personal local dashboard — every Pro user gets a localhost dashboard without extra cloud setup</li>
@@ -1229,7 +1228,7 @@ __GA_BOOTSTRAP__
       <a href="https://www.linkedin.com/in/igorganapolsky" target="_blank" rel="noopener">LinkedIn</a>
       <a href="/blog">Blog</a>
     </div>
-    <span class="footer-copy">© 2026 Max Smith KDP LLC · MIT License · v1.5.2</span>
+    <span class="footer-copy">© 2026 Max Smith KDP LLC · MIT License · v1.5.4</span>
   </div>
 </footer>