thumbgate@1.28.3

thumbgate@1.28.3

Release Links

• npm: https://www.npmjs.com/package/thumbgate/v/1.28.3
• GitHub Release: https://github.com/IgorGanapolsky/ThumbGate/releases/tag/v1.28.3
• Compare: v1.28.2...v1.28.3
• Publish workflow: https://github.com/IgorGanapolsky/ThumbGate/actions/runs/29441789061
• npm published at: 2026-07-15T18:46:01.172Z
• npm shasum: bbf2d445058fd4bf48a82c4368492838d2b89afa
• npm tarball: https://registry.npmjs.org/thumbgate/-/thumbgate-1.28.3.tgz
• Release ref: 2f3f223

npm Email Companion

npm controls the native "Successfully published" email template, so the email itself stays short. Treat this generated artifact as the full release-note companion for that email: it carries the Changeset summaries, CHANGELOG entry, publish workflow, npm tarball, and shasum when available.

Full Changeset Release Notes

No changed .changeset/*.md entries were detected for this release range.

CHANGELOG.md Entry

1.28.3

Patch Changes

• Capture explicit thumbs feedback in the same turn with a durable event ID, distinguish capture from reusable-memory promotion, and deduplicate repeated hook deliveries including emoji-only signals without storing raw session identifiers.

  Expose only executable MCP tools for the active profile, label unavailable private-core capabilities internally, use the documented essential factory profile, and fail clearly instead of returning an empty retrieval result when a required capability is missing.

  Ship lesson-retrieval.js, lesson-reranker.js, cross-encoder-reranker.js, and lesson-embedding-index.js in the public npm package so retrieve_lessons works after installation. This intentionally raises the audited public-bundle ceiling from 333 to 337 files.

  Reduce guardrail noise by limiting network warnings to executable egress, applying task scope only to mutating actions, and requiring contextual recurring-memory matches before hard denial. Self-harness prompt mutation is now explicit opt-in instead of silently editing and committing AGENTS.md/GEMINI.md after negative feedback.

  Keep learned deny/warn policy advisory for read-only inspection, while retaining the prediction in structured diagnostics and preserving enforcement for execution-oriented actions.

  Redact Gemini/Vertex authentication failures to scalar summaries and clear ambient provider credentials in tests so an accidental live authentication call cannot expose structured credential metadata.

Verification Standard

• Publish only runs from main after version sync, tests, and runtime proof pass.
• The npm package is smoke-tested after publish by installing thumbgate@VERSION in a clean runtime.
• GitHub Release notes are generated from Changesets, not only GitHub auto-generated PR titles.