great-cto 2.5.0 → 2.5.2

package/dist/agentshield/scanner.js

@@ -54,21 +54,46 @@ function* walk(root, exclude) {
 function fileMatchesGlobs(file, globs) {
     if (!globs || globs.length === 0)
         return true;
-    // Tiny glob → regex. Convert globs in two passes:
-    //   1. Replace ** and * with sentinel placeholders.
-    //   2. Escape remaining regex metachars.
-    //   3. Replace placeholders with their regex equivalents.
+    // Normalize path separators for cross-platform matching
+    const normalized = file.replace(/\\/g, '/');
     return globs.some((g) => {
-        const pattern = g
-            .replace(/\*\*/g, '
') // ** → SOH
-            .replace(/\*/g, '') // *  → STX
-            .replace(/\?/g, '') // ?  → ETX
-            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-            .replace(/
/g, '.*')
-            .replace(//g, '[^/]*')
-            .replace(//g, '.');
+        // Token-based glob → regex conversion. Walks character-by-character to
+        // avoid the substitution-order pitfalls of multiple replace passes.
+        // Treats `**/` as "zero or more path segments" — so `**/*.ts` matches
+        // both `foo.ts` (root) and `src/lib/foo.ts` (nested).
+        let re = '';
+        for (let i = 0; i < g.length; i++) {
+            const c = g[i];
+            if (c === '*' && g[i + 1] === '*') {
+                // ** consumes the trailing /, so `**/x` becomes `(?:.*\/)?x` not `.*\/x`
+                if (g[i + 2] === '/') {
+                    re += '(?:.*\\/)?';
+                    i += 2;
+                }
+                else {
+                    re += '.*';
+                    i++;
+                }
+            }
+            else if (c === '*') {
+                re += '[^/]*';
+            }
+            else if (c === '?') {
+                re += '.';
+            }
+            else if ('.+^${}()|[]\\'.includes(c)) {
+                re += '\\' + c;
+            }
+            else if (c === '/') {
+                re += '/';
+            }
+            else {
+                re += c;
+            }
+        }
         try {
-            return new RegExp(pattern).test(file);
+            // Match suffix — `src/foo.ts` matches `**/*.ts` regardless of cwd
+            return new RegExp('(?:^|/)' + re + '$').test(normalized);
         }
         catch {
             return false;

package/dist/main.js

@@ -16,7 +16,7 @@ import { pickArchetype, suggestCompliance } from "./archetypes.js";
 import { install, findInstalledVersions } from "./installer.js";
 import { enableGreatCto } from "./settings.js";
 import { bootstrap } from "./bootstrap.js";
-import { resolveTelemetryConsent, sendInstallPing } from "./telemetry.js";
+import { resolveTelemetryConsent, sendInstallPing, sendUsagePing } from "./telemetry.js";
 import { shouldUseLlmFallback, suggestArchetypeFromLlm } from "./llm-fallback.js";
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -727,6 +727,19 @@ async function runInit(args) {
     log("");
     return 0;
 }
+/**
+ * Exit with telemetry ping for a subcommand. Fire-and-forget — we wait up
+ * to 200ms for the ping to land before exiting so it doesn't get killed by
+ * process termination. Honours all telemetry opt-out signals.
+ */
+async function exitWithTelemetry(subcommand, code) {
+    try {
+        const promise = sendUsagePing({ cliVersion: getCliVersion(), subcommand, exitCode: code });
+        await Promise.race([promise, new Promise(r => setTimeout(r, 200))]);
+    }
+    catch { /* never block exit */ }
+    process.exit(code);
+}
 async function main() {
     const rawArgv = process.argv.slice(2);
     const args = parseArgs(rawArgv);
@@ -778,7 +791,7 @@ async function main() {
         try {
             const { runCi, parseCiArgs } = await import("./ci.js");
             const code = await runCi(parseCiArgs(rawArgv));
-            process.exit(code);
+            await exitWithTelemetry("ci", code);
         }
         catch (e) {
             error(e.message);
@@ -792,7 +805,7 @@ async function main() {
             const portArg = rawArgv.indexOf("--port");
             const port = portArg >= 0 ? parseInt(rawArgv[portArg + 1] ?? "8765", 10) : 8765;
             const code = await runMcp({ mode: sse ? "sse" : "stdio", port, version: getCliVersion() });
-            process.exit(code);
+            await exitWithTelemetry("mcp", code);
         }
         catch (e) {
             error(e.message);
@@ -814,7 +827,7 @@ async function main() {
                 dryRun: rawArgv.includes("--dry-run"),
                 cwd: args.dir,
             });
-            process.exit(code);
+            await exitWithTelemetry("adapt", code);
         }
         catch (e) {
             error(e.message);
@@ -829,7 +842,7 @@ async function main() {
                 noLog: rawArgv.includes("--no-log"),
                 insecure: rawArgv.includes("--insecure"),
             });
-            process.exit(code);
+            await exitWithTelemetry("serve", code);
         }
         catch (e) {
             error(e.message);
@@ -845,7 +858,7 @@ async function main() {
                 process.exit(2);
             }
             const code = await runWebhookCli(parsed);
-            process.exit(code);
+            await exitWithTelemetry("webhook", code);
         }
         catch (e) {
             error(e.message);
@@ -860,7 +873,7 @@ async function main() {
                 process.exit(2);
             }
             const code = await runReport(parsed);
-            process.exit(code);
+            await exitWithTelemetry("report", code);
         }
         catch (e) {
             error(e.message);

package/dist/telemetry.js

@@ -115,3 +115,45 @@ export async function sendInstallPing(opts) {
         // never block install on telemetry failure
     }
 }
+/**
+ * Subcommand-usage ping. Fire-and-forget. Used to track which v2.4+ commands
+ * (ci / mcp / adapt / serve / report / webhook) actually get used in the wild.
+ *
+ * Sends only:
+ *   - install_id (random UUID, set on first install)
+ *   - cli_version
+ *   - subcommand name
+ *   - exit code (0 / 1 / 2)
+ *
+ * No paths, no flags (since flags often contain user input), no archetype.
+ * Honours the same opt-out signals as install ping.
+ */
+export async function sendUsagePing(opts) {
+    if (process.env.GREATCTO_NO_TELEMETRY === "1")
+        return;
+    const cfg = readConfig();
+    if (cfg.telemetry === false)
+        return;
+    if (!cfg.install_id)
+        return; // never ping without an established install_id
+    try {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), TELEMETRY_TIMEOUT_MS);
+        await fetch(`${TELEMETRY_ENDPOINT.replace("/install", "/usage")}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "User-Agent": `great-cto-cli/${opts.cliVersion}` },
+            body: JSON.stringify({
+                install_id: cfg.install_id,
+                cli_version: opts.cliVersion,
+                subcommand: opts.subcommand,
+                exit_code: opts.exitCode,
+                ts: new Date().toISOString(),
+            }),
+            signal: ctrl.signal,
+        }).catch(() => { });
+        clearTimeout(timer);
+    }
+    catch {
+        // best-effort
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.5.0",
+  "version": "2.5.2",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",