great-cto 2.3.4 → 2.5.0

package/dist/main.js

@@ -83,6 +83,18 @@ function parseArgs(argv) {
             args.command = "scan";
         else if (a === "list-rules")
             args.command = "list-rules";
+        else if (a === "ci")
+            args.command = "ci";
+        else if (a === "mcp")
+            args.command = "mcp";
+        else if (a === "adapt")
+            args.command = "adapt";
+        else if (a === "serve")
+            args.command = "serve";
+        else if (a === "webhook")
+            args.command = "webhook";
+        else if (a === "report")
+            args.command = "report";
         else if (a.startsWith("--dir="))
             args.dir = a.slice("--dir=".length);
         else if (a === "--dir")
@@ -316,6 +328,10 @@ ${bold("Usage:")}
   npx great-cto register [--dir PATH]
   npx great-cto scan [path] [--severity LVL] [--scanner NAME] [--sarif FILE]
   npx great-cto list-rules
+  npx great-cto ci [path] [--fail-on LVL] [--sarif F] [--junit F]
+  npx great-cto mcp [--sse --port N]
+  npx great-cto adapt --platform [claude|codex|cursor|aider|continue|all]
+  npx great-cto serve [--port 3142]
   npx great-cto help
   npx great-cto version
 
@@ -338,6 +354,32 @@ ${bold("Scan (AI-security):")}
   great-cto list-rules                 Print rule catalog
   ${dim("(exits 1 if findings ≥ severity threshold; CI-friendly)")}
 
+${bold("CI gate:")}
+  great-cto ci                         Single-command CI gate (scan + archetype check)
+  great-cto ci --fail-on critical      Exit 1 only on critical findings (default)
+  great-cto ci --sarif out.sarif       Emit SARIF (uploadable to GitHub Security)
+  great-cto ci --junit out.xml         Emit JUnit XML for test reporters
+  ${dim("(auto-detects \$GITHUB_ACTIONS → emits ::error:: annotations)")}
+
+${bold("MCP server (cross-platform):")}
+  great-cto mcp                        Stdio MCP server — works in Claude Desktop /
+                                       Cursor / Continue / any MCP host
+  great-cto mcp --sse --port 8765      SSE mode for remote / multi-client (TODO v2.5)
+  ${dim("Tools exposed: scan, list_rules, detect_archetype, estimate_cost, query_decisions")}
+
+${bold("Platform adapter (multi-tool support):")}
+  great-cto adapt --platform claude    Generate AGENTS.md + CLAUDE.md
+  great-cto adapt --platform codex     Generate AGENTS.md (OpenAI Codex CLI)
+  great-cto adapt --platform cursor    Generate .cursorrules + .cursor/rules/*.mdc
+  great-cto adapt --platform aider     Generate .aider.conf.yml + CONVENTIONS.md
+  great-cto adapt --platform continue  Generate .continue/rules.md
+  great-cto adapt --platform all       All of the above
+  ${dim("Idempotent — re-run after editing .great_cto/PROJECT.md")}
+
+${bold("Webhook server (preview):")}
+  great-cto serve --port 3142          Webhook receiver (logs to ~/.great_cto/webhook-events.log)
+  ${dim("Endpoints: POST /webhook/github, POST /webhook/generic, GET /events, GET /healthz")}
+
 ${bold("Options:")}
   -y, --yes              Skip confirmation prompts (non-interactive)
       --dry-run          Show what would be done without doing it
@@ -732,6 +774,99 @@ async function main() {
             process.exit(1);
         }
     }
+    if (args.command === "ci") {
+        try {
+            const { runCi, parseCiArgs } = await import("./ci.js");
+            const code = await runCi(parseCiArgs(rawArgv));
+            process.exit(code);
+        }
+        catch (e) {
+            error(e.message);
+            process.exit(2);
+        }
+    }
+    if (args.command === "mcp") {
+        try {
+            const { runMcp } = await import("./mcp.js");
+            const sse = rawArgv.includes("--sse");
+            const portArg = rawArgv.indexOf("--port");
+            const port = portArg >= 0 ? parseInt(rawArgv[portArg + 1] ?? "8765", 10) : 8765;
+            const code = await runMcp({ mode: sse ? "sse" : "stdio", port, version: getCliVersion() });
+            process.exit(code);
+        }
+        catch (e) {
+            error(e.message);
+            process.exit(2);
+        }
+    }
+    if (args.command === "adapt") {
+        try {
+            const { runAdapt } = await import("./adapt.js");
+            const platArg = rawArgv.indexOf("--platform");
+            const platform = (platArg >= 0 ? rawArgv[platArg + 1] : "all");
+            const valid = ["claude", "codex", "cursor", "aider", "continue", "all"];
+            if (!valid.includes(platform)) {
+                error(`adapt: --platform must be one of ${valid.join(", ")} (got: ${platform})`);
+                process.exit(2);
+            }
+            const code = await runAdapt({
+                platform,
+                dryRun: rawArgv.includes("--dry-run"),
+                cwd: args.dir,
+            });
+            process.exit(code);
+        }
+        catch (e) {
+            error(e.message);
+            process.exit(2);
+        }
+    }
+    if (args.command === "serve") {
+        try {
+            const { runServe } = await import("./serve.js");
+            const code = await runServe({
+                port: args.boardPort === 3141 ? 3142 : args.boardPort,
+                noLog: rawArgv.includes("--no-log"),
+                insecure: rawArgv.includes("--insecure"),
+            });
+            process.exit(code);
+        }
+        catch (e) {
+            error(e.message);
+            process.exit(2);
+        }
+    }
+    if (args.command === "webhook") {
+        try {
+            const { runWebhookCli, parseWebhookArgs } = await import("./webhook-cli.js");
+            const parsed = parseWebhookArgs(rawArgv);
+            if (!parsed) {
+                error("usage: great-cto webhook list | add-incoming <name> --secret <s> | add-outgoing <name> --url <u> --format <f> --triggers <t1,t2> | remove <name> | test <name>");
+                process.exit(2);
+            }
+            const code = await runWebhookCli(parsed);
+            process.exit(code);
+        }
+        catch (e) {
+            error(e.message);
+            process.exit(2);
+        }
+    }
+    if (args.command === "report") {
+        try {
+            const { runReport, parseReportArgs } = await import("./report.js");
+            const parsed = parseReportArgs(rawArgv, args.dir);
+            if (!parsed) {
+                process.exit(2);
+            }
+            const code = await runReport(parsed);
+            process.exit(code);
+        }
+        catch (e) {
+            error(e.message);
+            process.exit(2);
+        }
+    }
     if (args.command === "version") {
         // Version resolved in index.mjs or from package.json at runtime
         try {

package/dist/mcp.js

@@ -0,0 +1,355 @@
+// great-cto mcp — Model Context Protocol server.
+//
+// Exposes great_cto's core capabilities as MCP tools so any MCP-compatible
+// host (Claude Desktop, Cursor, Continue, Codex CLI via MCP, custom agents)
+// can call them. This is the single biggest cross-platform multiplier — one
+// implementation, all clients.
+//
+// Modes:
+//   stdio (default)  — Claude Desktop / Cursor / Continue spawn this as subprocess
+//   sse              — long-running HTTP/SSE for remote / multi-client access
+//
+// Tools exposed:
+//   scan              OWASP LLM Top 10 + 24 rules → findings
+//   list_rules        full rule catalogue
+//   detect_archetype  archetype + compliance for a path
+//   estimate_cost     LLM/human time for a task
+//   query_decisions   search ~/.great_cto/decisions.md
+//
+// Protocol: minimal MCP 2024-11-05 implementation. We hand-roll because
+// adding @modelcontextprotocol/sdk would balloon install size for what is
+// fundamentally a few JSON messages over stdio.
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+const PROTOCOL_VERSION = "2024-11-05";
+const SERVER_INFO = {
+    name: "great-cto",
+    version: "", // populated at startup
+};
+// ── Tool implementations ────────────────────────────────────────────────────
+async function toolScan(args) {
+    const { scan } = await import("./agentshield/scanner.js");
+    const path = args.path ?? ".";
+    const report = scan(resolve(path), {
+        minSeverity: (args.severity ?? "info"),
+        scanners: args.scanner,
+    });
+    return {
+        files_scanned: report.filesScanned,
+        duration_ms: report.durationMs,
+        findings: report.findings.map((f) => ({
+            rule_id: f.rule.id,
+            severity: f.rule.severity,
+            title: f.rule.title,
+            owasp: f.rule.owasp,
+            file: f.location.file,
+            line: f.location.line,
+            snippet: f.location.snippet,
+        })),
+    };
+}
+async function toolListRules() {
+    const { loadRules } = await import("./agentshield/rules-loader.js");
+    const rules = loadRules();
+    return {
+        count: rules.length,
+        rules: rules.map((r) => ({
+            id: r.id,
+            severity: r.severity,
+            scanner: r.scanner,
+            title: r.title,
+            owasp: r.owasp ?? null,
+        })),
+    };
+}
+async function toolDetectArchetype(args) {
+    const { detect } = await import("./detect.js");
+    const { pickArchetype, suggestCompliance } = await import("./archetypes.js");
+    const cwd = resolve(args.path ?? ".");
+    const detected = await detect(cwd);
+    const result = pickArchetype(detected);
+    const compliance = suggestCompliance(detected, result.primary);
+    return {
+        archetype: result.primary,
+        confidence: result.confidence,
+        rationale: result.rationale,
+        alternatives: result.alternatives,
+        compliance,
+    };
+}
+async function toolEstimateCost(args) {
+    // Rough heuristic — for production, agents call /cost feature directly.
+    // This is the LLM-host-friendly summary.
+    const scale = args.scale ?? "standard";
+    const minutesByScale = {
+        quick: 15,
+        standard: 45,
+        deep: 90,
+    };
+    const llmRatePerHr = 0.02;
+    const humanRatePerHr = 150;
+    const minutes = minutesByScale[scale] ?? 45;
+    const llmUsd = +(minutes / 60 * llmRatePerHr).toFixed(4);
+    const humanUsd = +(minutes / 60 * humanRatePerHr).toFixed(2);
+    const humanDays = +(minutes / 60 / 6).toFixed(1); // 6 productive hrs / day
+    return {
+        task: args.task_description ?? "",
+        archetype: args.archetype ?? "unknown",
+        scale,
+        llm_agent: { wall_clock_min: minutes, cost_usd: llmUsd },
+        human_team: { working_days: humanDays, cost_usd: humanUsd },
+        savings_x: Math.round(humanUsd / Math.max(llmUsd, 0.0001)),
+    };
+}
+function toolQueryDecisions(args) {
+    const decisionsPath = join(homedir(), ".great_cto", "decisions.md");
+    if (!existsSync(decisionsPath)) {
+        return { count: 0, results: [], note: "No ~/.great_cto/decisions.md found." };
+    }
+    const text = readFileSync(decisionsPath, "utf8");
+    const entries = text.split(/\n---\n/).filter(s => s.trim());
+    const q = (args.query ?? "").toLowerCase();
+    const limit = args.limit ?? 10;
+    const matches = q
+        ? entries.filter(e => e.toLowerCase().includes(q))
+        : entries.slice(-limit);
+    return {
+        count: matches.length,
+        total_decisions: entries.length,
+        results: matches.slice(0, limit).map(e => {
+            const titleMatch = e.match(/^##\s+(.+)$/m);
+            return {
+                title: titleMatch?.[1] ?? "(untitled)",
+                excerpt: e.slice(0, 400),
+            };
+        }),
+    };
+}
+// ── Tool dispatch table ────────────────────────────────────────────────────
+const TOOLS = [
+    {
+        name: "scan",
+        description: "Scan code for AI/LLM-specific security issues (OWASP LLM Top 10, 24 rules). Returns findings with severity, file, line, OWASP mapping.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                path: { type: "string", description: "File or directory to scan (default: cwd)" },
+                severity: {
+                    type: "string",
+                    enum: ["info", "low", "medium", "high", "critical"],
+                    description: "Minimum severity to report",
+                },
+                scanner: {
+                    type: "array",
+                    items: {
+                        type: "string",
+                        enum: ["prompt-injection", "secrets-in-prompts", "ssrf-in-tools", "rag-poisoning", "cost-runaway"],
+                    },
+                    description: "Limit to specific scanner categories",
+                },
+            },
+        },
+        handler: toolScan,
+    },
+    {
+        name: "list_rules",
+        description: "List all 24 AgentShield security rules with severity and OWASP LLM Top 10 mapping.",
+        inputSchema: { type: "object", properties: {} },
+        handler: toolListRules,
+    },
+    {
+        name: "detect_archetype",
+        description: "Detect the project archetype (one of 25: fintech, healthcare, commerce, agent-product, mlops, edtech, gov-public, insurance, ...) and the compliance gates that apply.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                path: { type: "string", description: "Project root (default: cwd)" },
+            },
+        },
+        handler: toolDetectArchetype,
+    },
+    {
+        name: "estimate_cost",
+        description: "Estimate LLM-agent wall-clock time and cost vs human-team equivalent for a task. Returns LLM/human cost and savings ratio (~7500×).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                task_description: { type: "string" },
+                archetype: { type: "string" },
+                scale: { type: "string", enum: ["quick", "standard", "deep"] },
+            },
+        },
+        handler: toolEstimateCost,
+    },
+    {
+        name: "query_decisions",
+        description: "Search the cross-project ADR log at ~/.great_cto/decisions.md. Returns matching decisions for the given query string.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                query: { type: "string", description: "Search string (case-insensitive). Empty = recent decisions." },
+                limit: { type: "number", description: "Max results (default 10)" },
+            },
+        },
+        handler: toolQueryDecisions,
+    },
+];
+// ── JSON-RPC handler ───────────────────────────────────────────────────────
+async function handle(req) {
+    const { method, id = null, params } = req;
+    // Notifications (no id) get no response
+    const isNotification = id === null || id === undefined;
+    const reply = (result) => isNotification ? null : { jsonrpc: "2.0", id: id, result };
+    const fail = (code, message, data) => isNotification ? null : { jsonrpc: "2.0", id: id, error: { code, message, data } };
+    try {
+        switch (method) {
+            case "initialize":
+                return reply({
+                    protocolVersion: PROTOCOL_VERSION,
+                    capabilities: { tools: {} },
+                    serverInfo: SERVER_INFO,
+                });
+            case "initialized":
+            case "notifications/initialized":
+                return null;
+            case "tools/list":
+                return reply({
+                    tools: TOOLS.map(t => ({
+                        name: t.name,
+                        description: t.description,
+                        inputSchema: t.inputSchema,
+                    })),
+                });
+            case "tools/call": {
+                const name = params?.name;
+                const args = params?.arguments ?? {};
+                const tool = TOOLS.find(t => t.name === name);
+                if (!tool)
+                    return fail(-32601, `Unknown tool: ${name}`);
+                const result = await tool.handler(args);
+                return reply({
+                    content: [
+                        { type: "text", text: JSON.stringify(result, null, 2) },
+                    ],
+                    isError: false,
+                });
+            }
+            case "ping":
+                return reply({});
+            default:
+                return fail(-32601, `Method not found: ${method}`);
+        }
+    }
+    catch (e) {
+        return fail(-32603, `Internal error: ${e.message}`);
+    }
+}
+// ── SSE transport ──────────────────────────────────────────────────────────
+async function runSse(port, version) {
+    const { createServer } = await import("node:http");
+    // Each connection gets a unique session id and an open SSE stream.
+    // Inbound JSON-RPC arrives via POST /message?sessionId=<id>; responses are
+    // pushed back over the SSE stream. This matches the standard MCP SSE
+    // transport (https://spec.modelcontextprotocol.io/specification/transports).
+    const sessions = new Map();
+    const server = createServer(async (req, res) => {
+        const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+        if (req.method === "GET" && url.pathname === "/sse") {
+            const sessionId = `s-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            res.writeHead(200, {
+                "Content-Type": "text/event-stream",
+                "Cache-Control": "no-cache, no-transform",
+                Connection: "keep-alive",
+                "X-Accel-Buffering": "no",
+            });
+            // Initial endpoint event — tells client where to POST messages
+            res.write(`event: endpoint\ndata: /message?sessionId=${sessionId}\n\n`);
+            sessions.set(sessionId, res);
+            req.on("close", () => sessions.delete(sessionId));
+            return;
+        }
+        if (req.method === "POST" && url.pathname === "/message") {
+            const sessionId = url.searchParams.get("sessionId") ?? "";
+            const sse = sessions.get(sessionId);
+            if (!sse) {
+                res.writeHead(404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "unknown sessionId" }));
+                return;
+            }
+            const chunks = [];
+            req.on("data", c => chunks.push(Buffer.from(c)));
+            req.on("end", async () => {
+                const body = Buffer.concat(chunks).toString("utf8");
+                try {
+                    const reqJson = JSON.parse(body);
+                    const reply = await handle(reqJson);
+                    if (reply) {
+                        sse.write(`event: message\ndata: ${JSON.stringify(reply)}\n\n`);
+                    }
+                    res.writeHead(202).end();
+                }
+                catch (e) {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: e.message }));
+                }
+            });
+            return;
+        }
+        if (req.method === "GET" && url.pathname === "/healthz") {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: true, version, sessions: sessions.size, transport: "sse" }));
+            return;
+        }
+        res.writeHead(404).end();
+    });
+    return new Promise(resolve => {
+        server.listen(port, "127.0.0.1", () => {
+            process.stderr.write(`great-cto mcp v${version} (sse) → http://localhost:${port}/sse\n`);
+            process.stderr.write(`  GET  /sse                       open event stream\n`);
+            process.stderr.write(`  POST /message?sessionId=...     send JSON-RPC\n`);
+            process.stderr.write(`  GET  /healthz                   liveness\n`);
+        });
+        process.on("SIGINT", () => { server.close(); resolve(0); });
+        process.on("SIGTERM", () => { server.close(); resolve(0); });
+    });
+}
+// ── stdio transport ────────────────────────────────────────────────────────
+async function runStdio() {
+    // Read newline-delimited JSON from stdin, write to stdout. This is the
+    // standard MCP stdio transport.
+    let buffer = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", async (chunk) => {
+        buffer += chunk;
+        let nl;
+        while ((nl = buffer.indexOf("\n")) >= 0) {
+            const line = buffer.slice(0, nl).trim();
+            buffer = buffer.slice(nl + 1);
+            if (!line)
+                continue;
+            try {
+                const req = JSON.parse(line);
+                const res = await handle(req);
+                if (res)
+                    process.stdout.write(JSON.stringify(res) + "\n");
+            }
+            catch (e) {
+                process.stderr.write(`mcp: parse error: ${e.message}\n`);
+            }
+        }
+    });
+    return new Promise(resolve => {
+        process.stdin.on("end", () => resolve(0));
+        process.stdin.on("error", () => resolve(2));
+    });
+}
+export async function runMcp(args) {
+    SERVER_INFO.version = args.version;
+    if (args.mode === "sse") {
+        return runSse(args.port, args.version);
+    }
+    // Notify clients we're ready (some hosts log this)
+    process.stderr.write(`great-cto mcp v${args.version} (stdio) — ${TOOLS.length} tools\n`);
+    return runStdio();
+}