thumbgate 1.7.0 → 1.9.0

package/scripts/statusline.sh

@@ -108,17 +108,28 @@ fi
 # ── ThumbGate package metadata ────────────────────────────────────────
 TG_VERSION="unknown"; TG_TIER="Free"
 _META_JSON=$(node "${SCRIPT_DIR}/statusline-meta.js" 2>/dev/null)
-if [ -n "$_META_JSON" ]; then
+if [[ -n "$_META_JSON" ]]; then
   eval "$(echo "$_META_JSON" | jq -r '
     @sh "TG_VERSION=\(.version // "unknown")",
     @sh "TG_TIER=\(.tier // "Free")"
   ' 2>/dev/null)"
 fi
 
+# ── Repo context (branch / work item / PR) ───────────────────────────
+BRANCH_NAME=""; WORK_ITEM_LABEL=""; PR_LABEL=""
+_CONTEXT_JSON=$(node "${SCRIPT_DIR}/statusline-context.js" 2>/dev/null)
+if [[ -n "$_CONTEXT_JSON" ]]; then
+  eval "$(echo "$_CONTEXT_JSON" | jq -r '
+    @sh "BRANCH_NAME=\(.branchName // "")",
+    @sh "WORK_ITEM_LABEL=\(.workItemLabel // "")",
+    @sh "PR_LABEL=\(.prLabel // "")"
+  ' 2>/dev/null)"
+fi
+
 # ── Control Tower stats ──────────────────────────────────────────
 SLO_V="0"; AT_RISK="0"; ANOMALIES="0"
 _TOWER_JSON=$(node "${SCRIPT_DIR}/statusline-tower.js" 2>/dev/null)
-if [ -n "$_TOWER_JSON" ]; then
+if [[ -n "$_TOWER_JSON" ]]; then
   eval "$(echo "$_TOWER_JSON" | jq -r '
     @sh "SLO_V=\(.sloViolations // 0)",
     @sh "AT_RISK=\(.atRiskToolCount // 0)",
@@ -129,7 +140,7 @@ fi
 # ── Latest lesson (data available for extensions; not rendered in statusbar) ──
 LESSON_TEXT=""; LESSON_ID=""; LESSON_LABEL=""; LESSON_LINK=""
 _LESSON_JSON=$(node "${SCRIPT_DIR}/statusline-lesson.js" 2>/dev/null)
-if [ -n "$_LESSON_JSON" ]; then
+if [[ -n "$_LESSON_JSON" ]]; then
   eval "$(echo "$_LESSON_JSON" | jq -r '
     @sh "LESSON_TEXT=\(.text // "")",
     @sh "LESSON_ID=\(.lessonId // "")",
@@ -155,7 +166,7 @@ osc_link() {
   # ThumbGate as a non-last row in a multi-line statusline should set this, because
   # some agents (Claude Code) silently drop downstream rows when a preceding row
   # contains OSC 8 sequences.
-  if [ "${THUMBGATE_STATUSLINE_PLAIN:-0}" = "1" ]; then
+  if [[ "${THUMBGATE_STATUSLINE_PLAIN:-0}" = "1" ]]; then
     printf '%s' "$label"
     return 0
   fi
@@ -171,9 +182,9 @@ DOWN_LINK="$(osc_link "$DOWN_URL" "👎")"
 DASHBOARD_LINK="$(osc_link "$DASHBOARD_URL" "$DASHBOARD_LABEL")"
 LESSONS_LINK="$(osc_link "$LESSONS_URL" "$LESSONS_LABEL")"
 LATEST_LESSON_LINK=""
-if [ -n "$LESSON_LABEL" ]; then
+if [[ -n "$LESSON_LABEL" ]]; then
   _DISPLAY_LINK="$LESSON_LINK"
-  if [ -n "$LESSON_TEXT" ]; then
+  if [[ -n "$LESSON_TEXT" ]]; then
     LATEST_LESSON_LINK="$(osc_link "$_DISPLAY_LINK" "${LESSON_LABEL}: ${LESSON_TEXT}")"
   else
     LATEST_LESSON_LINK="$(osc_link "$_DISPLAY_LINK" "$LESSON_LABEL")"
@@ -181,20 +192,26 @@ if [ -n "$LESSON_LABEL" ]; then
 fi
 
 # ── Output (single line) ─────────────────────────────────────────
-LINE="ThumbGate v${TG_VERSION} · ${TG_TIER}"
-if [ "$UP" = "0" ] && [ "$DOWN" = "0" ]; then
-  LINE="${D}${LINE} · no feedback yet${RST} · ${C}${DASHBOARD_LINK}${RST} · ${M}${LESSONS_LINK}${RST}"
-  [ -n "$LATEST_LESSON_LINK" ] && LINE="${LINE} · ${D}${LATEST_LESSON_LINK}${RST}"
+LINE=""
+[[ -n "$BRANCH_NAME" ]] && LINE="${BRANCH_NAME}"
+[[ -n "$WORK_ITEM_LABEL" ]] && LINE="${LINE:+${LINE} · }${WORK_ITEM_LABEL}"
+LINE="${LINE:+${LINE} · }ThumbGate v${TG_VERSION} · ${TG_TIER}"
+if [[ "$UP" = "0" && "$DOWN" = "0" ]]; then
+  LINE="${D}${LINE}${RST} · no feedback yet"
+  [[ -n "$PR_LABEL" ]] && LINE="${LINE} · ${D}${PR_LABEL}${RST}"
+  LINE="${LINE} · ${C}${DASHBOARD_LINK}${RST} · ${M}${LESSONS_LINK}${RST}"
+  [[ -n "$LATEST_LESSON_LINK" ]] && LINE="${LINE} · ${D}${LATEST_LESSON_LINK}${RST}"
   printf '%b\n' "$LINE"
 else
   LINE="${LINE} · ${G}${BD}${UP}${RST}${UP_LINK} ${R}${BD}${DOWN}${RST}${DOWN_LINK} ${ARROW}"
 
   # Control Tower alerts (if any)
-  [ "${SLO_V:-0}" -gt 0 ] && LINE="${LINE} ${R}${SLO_V} SLO${RST}"
-  [ "${AT_RISK:-0}" -gt 0 ] && LINE="${LINE} ${R}${AT_RISK}⚠${RST}"
-  [ "${ANOMALIES:-0}" -gt 0 ] && LINE="${LINE} ${R}${ANOMALIES}☠${RST}"
+  [[ "${SLO_V:-0}" -gt 0 ]] && LINE="${LINE} ${R}${SLO_V} SLO${RST}"
+  [[ "${AT_RISK:-0}" -gt 0 ]] && LINE="${LINE} ${R}${AT_RISK}⚠${RST}"
+  [[ "${ANOMALIES:-0}" -gt 0 ]] && LINE="${LINE} ${R}${ANOMALIES}☠${RST}"
+  [[ -n "$PR_LABEL" ]] && LINE="${LINE} · ${D}${PR_LABEL}${RST}"
   LINE="${LINE} · ${C}${DASHBOARD_LINK}${RST} · ${M}${LESSONS_LINK}${RST}"
-  [ -n "$LATEST_LESSON_LINK" ] && LINE="${LINE} · ${D}${LATEST_LESSON_LINK}${RST}"
+  [[ -n "$LATEST_LESSON_LINK" ]] && LINE="${LINE} · ${D}${LATEST_LESSON_LINK}${RST}"
 
   printf '%b\n' "$LINE"
 fi

package/scripts/tool-registry.js

@@ -134,6 +134,25 @@ const TOOLS = [
       },
     },
   }),
+  readOnlyTool({
+    name: 'plan_multimodal_retrieval',
+    description: 'Plan a high-ROI multimodal retrieval rollout for screenshots, PDF pages, dashboard captures, and proof artifacts without starting GPU training.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        goal: { type: 'string', description: 'Business or workflow objective for visual/document retrieval.' },
+        evidenceTypes: {
+          type: 'array',
+          items: { type: 'string' },
+          description: 'Evidence surfaces to include, such as screenshots, pdf_pages, proof_artifacts, dashboards, or videos.',
+        },
+        corpusItems: { type: 'number', description: 'Estimated number of visual artifacts or document pages to index.' },
+        maxEmbeddingDim: { type: 'number', description: 'Maximum embedding dimension to budget for Matryoshka-style truncation planning.' },
+        latencyBudgetMs: { type: 'number', description: 'Target retrieval latency budget for agent recall.' },
+        useReranker: { type: 'boolean', description: 'Whether to include a multimodal reranker stage after initial embedding retrieval.' },
+      },
+    },
+  }),
   destructiveTool({
     name: 'import_document',
     description: 'Import a local policy or runbook document into ThumbGate, normalize it for search, and propose provenance-backed gate candidates.',
@@ -872,6 +891,24 @@ const TOOLS = [
       },
     },
   }),
+  destructiveTool({
+    name: 'run_autoresearch',
+    description: 'Run a bounded metric-improvement loop: measure a baseline, test a hypothesis, require primary and holdout checks, then keep or discard the candidate mutation with proof.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        iterations: { type: 'number', description: 'Number of iterations to run. Capped at 5 per call; default 1.' },
+        targetName: { type: 'string', enum: ['half_life_days', 'decay_floor', 'prevention_min_occurrences', 'verification_max_retries', 'dpo_beta'], description: 'Optional evolution target to mutate.' },
+        nextValue: { type: 'number', description: 'Optional explicit candidate value for the target.' },
+        testCommand: { type: 'string', description: 'Primary metric command. Defaults to npm test.' },
+        holdoutCommands: { type: 'array', items: { type: 'string' }, description: 'Additional checks required before a candidate can be kept.' },
+        timeoutMs: { type: 'number', description: 'Per-command timeout in milliseconds. Capped at 600000; default 120000.' },
+        cwd: { type: 'string', description: 'Optional workspace directory for the evaluation commands.' },
+        researchQuery: { type: 'string', description: 'Optional research query used to build an autoresearch context brief.' },
+        paperLimit: { type: 'number', description: 'Maximum research papers to ingest when researchQuery is set. Capped at 10; default 5.' },
+      },
+    },
+  }),
   destructiveTool({
     name: 'schedule',
     description: 'Create, list, or delete scheduled tasks. Supports natural language scheduling like "daily 9:00", "weekly monday 8:30", "hourly". Installs as macOS LaunchAgent or Linux crontab.',
@@ -1041,6 +1078,45 @@ const TOOLS = [
       properties: {},
     },
   }),
+  readOnlyTool({
+    name: 'require_evidence_for_claim',
+    description: 'Leader-Agent completion gate. Before any agent declares done/fixed/shipped/resolved, require tracked evidence. Blocking response when evidence missing; callers honor the blocking flag to stop completion claims.',
+    inputSchema: {
+      type: 'object',
+      required: ['claim'],
+      properties: {
+        claim: { type: 'string', description: 'The completion claim text to verify (e.g. "Fix shipped", "Tests passing")' },
+        mode: { type: 'string', enum: ['blocking', 'advisory'], description: 'blocking (default) returns blocking=true when evidence missing; advisory returns blocking=false' },
+        sessionId: { type: 'string', description: 'Optional session id to associate with the gate decision' },
+      },
+    },
+  }),
+  destructiveTool({
+    name: 'distribute_context_to_agents',
+    description: 'Leader-Agent swarm coordinator. Constructs one context pack and distributes it to N worker agents (perplexity-bug-resolver, codex-reviewer, grok-x-intelligence, etc.), recording provenance per agent. Replaces N independent context derivations with a single shared pack.',
+    inputSchema: {
+      type: 'object',
+      required: ['agents'],
+      properties: {
+        query: { type: 'string', description: 'Context query used to construct the pack' },
+        agents: { type: 'array', items: { type: 'string' }, description: 'Agent names that should receive the pack' },
+        maxItems: { type: 'number', description: 'Max items in the constructed pack (default 8)' },
+        maxChars: { type: 'number', description: 'Max characters in the constructed pack (default 6000)' },
+        namespaces: { type: 'array', items: { type: 'string' }, description: 'Optional contextfs namespaces to source from' },
+        ttlMs: { type: 'number', description: 'Optional pack TTL in milliseconds (default 15 minutes)' },
+      },
+    },
+  }),
+  readOnlyTool({
+    name: 'session_report',
+    description: 'Unified observability rollup. Aggregates feedback stats, gate stats, and recent context/provenance events over a time window in one call. Replaces separate dashboard/gate_stats/feedback_stats calls with a single LangSmith-style report.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        windowHours: { type: 'number', description: 'Lookback window in hours (default 24, max 720)' },
+      },
+    },
+  }),
   readOnlyTool({
     name: 'context_stuff_lessons',
     description: 'Dump ALL prevention lessons into a single text block for context-window injection. Bypasses RAG/search — returns every lesson sorted by confidence. For most projects (20-200 lessons), fits in 1K-10K tokens.',

package/src/api/server.js

@@ -552,6 +552,169 @@ function getServerCardTools() {
   }));
 }
 
+function buildPublicUrl(hostedConfig, pathname) {
+  return `${hostedConfig.appOrigin}${pathname}`;
+}
+
+const VERIFICATION_EVIDENCE_URL = 'https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md';
+
+function getToolDiscoveryIndex(hostedConfig) {
+  return MCP_TOOLS.map((tool) => ({
+    name: tool.name,
+    description: tool.description,
+    annotations: tool.annotations || {},
+    schemaUrl: buildPublicUrl(hostedConfig, `/.well-known/mcp/tools/${encodeURIComponent(tool.name)}.json`),
+  }));
+}
+
+function getMcpSkillManifests(hostedConfig) {
+  return [
+    {
+      name: 'thumbgate',
+      title: 'ThumbGate Pre-Action Gates',
+      description: 'Capture feedback, recall lessons, generate rules, and block repeated agent mistakes before tool execution.',
+      triggers: ['thumbgate', 'pre-action gates', 'prevent repeated AI mistakes', 'agent feedback', 'PreToolUse hooks'],
+      recommendedFlow: [
+        'Recall lessons before risky work.',
+        'Plan high-risk actions with checkpoints.',
+        'Capture concrete thumbs-down/up feedback.',
+        'Inspect prevention_rules after repeats.',
+      ],
+      installCommand: 'npx thumbgate init',
+      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      proofUrl: VERIFICATION_EVIDENCE_URL,
+    },
+    {
+      name: 'workflow-hardening-sprint',
+      title: 'Workflow Hardening Sprint',
+      description: 'Turn one repeated agent failure into an enforced gate with proof and rollout evidence.',
+      triggers: ['workflow hardening', 'team rollout', 'agent governance', 'approval boundary', 'audit trail'],
+      recommendedFlow: [
+        'Pick one costly repeated failure.',
+        'Import the policy or runbook.',
+        'Ship the gate with dashboard proof.',
+      ],
+      intakeUrl: buildPublicUrl(hostedConfig, '/#workflow-sprint-intake'),
+      proofUrl: VERIFICATION_EVIDENCE_URL,
+    },
+    {
+      name: 'visual-proof-retrieval',
+      title: 'Visual Proof Retrieval',
+      description: 'Use screenshots, PDF pages, dashboard captures, and proof artifacts as searchable evidence for agent-governance claims.',
+      triggers: ['visual document retrieval', 'multimodal embeddings', 'screenshots', 'PDF evidence', 'proof artifacts'],
+      recommendedFlow: [
+        'Plan the corpus and Matryoshka dimension budget.',
+        'Baseline text-only retrieval before finetuning.',
+        'Evaluate NDCG@10 on visual hard negatives.',
+        'Require artifact links before using retrieved evidence in claims.',
+      ],
+      contextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+      proofUrl: VERIFICATION_EVIDENCE_URL,
+    },
+  ];
+}
+
+function getMcpApplications(hostedConfig) {
+  return [
+    {
+      name: 'dashboard',
+      title: 'ThumbGate Dashboard',
+      description: 'Review feedback, gates, blocked actions, funnel metrics, and proof.',
+      url: buildPublicUrl(hostedConfig, '/dashboard'),
+      useWhen: 'Need proof before approving more autonomy.',
+    },
+    {
+      name: 'lessons',
+      title: 'Lessons',
+      description: 'Browse promoted lessons and corrective actions.',
+      url: buildPublicUrl(hostedConfig, '/lessons'),
+      useWhen: 'Need human-approved context before risk.',
+    },
+    {
+      name: 'guide',
+      title: 'Setup Guide',
+      description: 'Install ThumbGate for Claude Code, Cursor, Codex, Gemini CLI, Amp, OpenCode, and MCP agents.',
+      url: buildPublicUrl(hostedConfig, '/guide'),
+      useWhen: 'Need setup without searching the repo.',
+    },
+    {
+      name: 'workflow-sprint-intake',
+      title: 'Workflow Hardening Sprint Intake',
+      description: 'Submit a repeated agent failure for a proof-backed sprint.',
+      url: buildPublicUrl(hostedConfig, '/#workflow-sprint-intake'),
+      useWhen: 'Ready to convert mistakes into gates.',
+    },
+  ];
+}
+
+function getMcpDiscoveryManifest(hostedConfig) {
+  return {
+    schemaVersion: '2026-04-20',
+    name: 'thumbgate',
+    title: 'ThumbGate',
+    version: pkg.version,
+    description: 'Pre-Action Gates for AI coding agents: feedback, recall, prevention rules, and tool-call blocking.',
+    homepage: hostedConfig.appOrigin,
+    repository: 'https://github.com/IgorGanapolsky/ThumbGate',
+    package: {
+      registry: 'npm',
+      name: 'thumbgate',
+      installCommand: 'npx thumbgate init',
+    },
+    transport: {
+      type: 'streamable-http',
+      endpoint: buildPublicUrl(hostedConfig, '/mcp'),
+      unauthenticatedDiscovery: ['initialize', 'tools/list'],
+      authenticatedMethods: ['tools/call'],
+    },
+    discovery: {
+      serverCardUrl: buildPublicUrl(hostedConfig, '/.well-known/mcp/server-card.json'),
+      toolIndexUrl: buildPublicUrl(hostedConfig, '/.well-known/mcp/tools.json'),
+      toolSchemaUrlTemplate: buildPublicUrl(hostedConfig, '/.well-known/mcp/tools/{name}.json'),
+      skillsUrl: buildPublicUrl(hostedConfig, '/.well-known/mcp/skills.json'),
+      applicationsUrl: buildPublicUrl(hostedConfig, '/.well-known/mcp/applications.json'),
+      llmsTxtUrl: buildPublicUrl(hostedConfig, '/.well-known/llms.txt'),
+      progressive: {
+        pattern: 'Load manifest, inspect tools.json, fetch one tool schema only when needed.',
+        tokenStrategy: 'Do not preload every inputSchema. Use per-tool schema URLs.',
+      },
+    },
+    primaryFlows: [
+      {
+        name: 'capture-to-gate',
+        description: 'Capture feedback, retrieve lessons, generate rules, enforce a gate.',
+        tools: ['capture_feedback', 'search_lessons', 'prevention_rules', 'gate_stats'],
+      },
+      {
+        name: 'safe-autonomous-work',
+        description: 'Plan high-risk work, recall lessons, diagnose failures.',
+        tools: ['plan_intent', 'recall', 'diagnose_failure', 'feedback_summary'],
+      },
+      {
+        name: 'team-rollout-proof',
+        description: 'Show dashboard evidence, metrics, and sprint proof.',
+        tools: ['dashboard', 'get_business_metrics', 'construct_context_pack'],
+      },
+      {
+        name: 'metric-autoresearch',
+        description: 'Run bounded baseline -> hypothesis -> holdout loops with keep/discard proof.',
+        tools: ['get_business_metrics', 'construct_context_pack', 'run_autoresearch', 'require_evidence_for_claim'],
+      },
+      {
+        name: 'visual-proof-retrieval',
+        description: 'Plan screenshot/PDF/proof-artifact retrieval before investing in multimodal finetuning.',
+        tools: ['plan_multimodal_retrieval', 'search_thumbgate', 'construct_context_pack', 'require_evidence_for_claim'],
+      },
+    ],
+    skills: getMcpSkillManifests(hostedConfig),
+    applications: getMcpApplications(hostedConfig),
+    proof: {
+      verificationEvidenceUrl: VERIFICATION_EVIDENCE_URL,
+      llmContextUrl: buildPublicUrl(hostedConfig, '/public/llm-context.md'),
+    },
+  };
+}
+
 function createHttpError(statusCode, message) {
   const err = new Error(message);
   err.statusCode = statusCode;
@@ -3904,7 +4067,85 @@ async function addContext(){
       return;
     }
 
+    if (isGetLikeRequest && pathname === '/.well-known/mcp.json') {
+      sendJson(res, 200, getMcpDiscoveryManifest(hostedConfig), {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+
+    if (isGetLikeRequest && pathname === '/.well-known/mcp/tools.json') {
+      sendJson(res, 200, {
+        name: 'thumbgate',
+        version: pkg.version,
+        count: MCP_TOOLS.length,
+        tools: getToolDiscoveryIndex(hostedConfig),
+      }, {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+
+    if (isGetLikeRequest && pathname.startsWith('/.well-known/mcp/tools/') && pathname.endsWith('.json')) {
+      const encodedToolName = pathname.slice('/.well-known/mcp/tools/'.length, -'.json'.length);
+      let toolName = encodedToolName;
+      try {
+        toolName = decodeURIComponent(encodedToolName);
+      } catch (_err) {
+        sendJson(res, 400, {
+          error: 'invalid_tool_name',
+          toolIndexUrl: buildPublicUrl(hostedConfig, '/.well-known/mcp/tools.json'),
+        }, {}, {
+          headOnly: isHeadRequest,
+        });
+        return;
+      }
+      const tool = MCP_TOOLS.find((candidate) => candidate.name === toolName);
+      if (!tool) {
+        sendJson(res, 404, {
+          error: 'tool_not_found',
+          toolName,
+          toolIndexUrl: buildPublicUrl(hostedConfig, '/.well-known/mcp/tools.json'),
+        }, {}, {
+          headOnly: isHeadRequest,
+        });
+        return;
+      }
+      sendJson(res, 200, {
+        name: tool.name,
+        description: tool.description,
+        annotations: tool.annotations || {},
+        inputSchema: tool.inputSchema,
+      }, {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+
+    if (isGetLikeRequest && pathname === '/.well-known/mcp/skills.json') {
+      sendJson(res, 200, {
+        name: 'thumbgate',
+        version: pkg.version,
+        skills: getMcpSkillManifests(hostedConfig),
+      }, {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+
+    if (isGetLikeRequest && pathname === '/.well-known/mcp/applications.json') {
+      sendJson(res, 200, {
+        name: 'thumbgate',
+        version: pkg.version,
+        applications: getMcpApplications(hostedConfig),
+      }, {}, {
+        headOnly: isHeadRequest,
+      });
+      return;
+    }
+
     if (isGetLikeRequest && pathname === '/.well-known/mcp/server-card.json') {
+      const discoveryManifest = getMcpDiscoveryManifest(hostedConfig);
       sendJson(res, 200, {
         serverInfo: {
           name: 'thumbgate',
@@ -3913,7 +4154,12 @@ async function addContext(){
         name: 'thumbgate',
         description: 'Pre-action gates that physically block AI coding agents from repeating known mistakes. Captures feedback, auto-promotes failures into prevention rules, and enforces them via PreToolUse hooks. Works with Claude Code, Codex, Gemini, Amp, Cursor, OpenCode, and any MCP-compatible agent.',
         version: pkg.version,
+        transport: discoveryManifest.transport,
+        discovery: discoveryManifest.discovery,
         tools: getServerCardTools(),
+        skills: getMcpSkillManifests(hostedConfig),
+        applications: getMcpApplications(hostedConfig),
+        proof: discoveryManifest.proof,
         repository: 'https://github.com/IgorGanapolsky/ThumbGate',
         homepage: hostedConfig.appOrigin,
       }, {}, {