great-cto 2.77.0 → 2.77.1

package/board/scripts/lib/change-tier.mjs

@@ -0,0 +1,119 @@
+// scripts/lib/change-tier.mjs — classify a change into a risk tier (T0/T1/T2).
+//
+// The build-side analog of the runtime volume/scope-aware escalation (great_cto-34g).
+// Pairs with effectiveGates() in packages/cli/src/archetypes.ts: this module decides
+// HOW DANGEROUS a change is; effectiveGates maps that tier to a human-gate set.
+//
+//   T2 — irreversible / regulated / deploy-to-prod. A HARD FLOOR: an explicit
+//        label can never downgrade a change that trips a T2 trigger.
+//   T0 — maintenance: every touched file is non-behavioral (docs/tests/lockfiles).
+//        CI + green tests are the gate.
+//   T1 — everything else (default): a reversible source change.
+//
+// Plan: docs/plans/PLAN-2026-06-18-gate-tiering-reviewer-consolidation.md
+
+export const TIER_RANK = { T0: 0, T1: 1, T2: 2 };
+
+// Files that, on their own, never change external behavior. A change touching ONLY
+// these is maintenance (T0). Anything else is "behavioral".
+const NON_BEHAVIORAL = [
+  /\.md$/i,
+  /(^|\/)docs?\//i,
+  /(^|\/)tests?\//i,
+  /\.test\.[mc]?[jt]s$/i,
+  /(^|\/)__tests__\//,
+  /(^|\/)\.beads\//,
+  /(^|\/)CHANGELOG/i,
+  /\.(png|jpe?g|gif|svg|webp)$/i,
+  /(^|\/)package-lock\.json$/,
+  /(^|\/)\.gitignore$/,
+];
+
+// Behavioral files whose mere presence makes the change irreversible/regulated (T2).
+// Checked ONLY against behavioral files, so a docs/pricing.md never trips it.
+const T2_PATHS = [
+  { re: /(^|\/)migrations?\//i, why: 'migration' },
+  { re: /(^|\/)_domains\.json$/i, why: 'domain-config' },
+  { re: /(^|\/)(auth|authentication)[\/.]/i, why: 'auth-surface' },
+  { re: /(^|\/)pricing[\/.]/i, why: 'pricing-surface' },
+];
+
+const isNonBehavioral = (f) => NON_BEHAVIORAL.some((re) => re.test(f));
+
+/** Parse an explicit `tier:tN` beads label → 'T0'|'T1'|'T2'|null (last one wins). */
+function labelTier(labels) {
+  let found = null;
+  for (const l of labels || []) {
+    const m = /^tier:(t[012])$/i.exec(String(l).trim());
+    if (m) found = m[1].toUpperCase();
+  }
+  return found;
+}
+
+/**
+ * Classify a change.
+ * @param {object} signals
+ * @param {string[]} [signals.changedFiles] repo-relative paths
+ * @param {Array<{id?:string,hasWrite?:boolean,isNew?:boolean}>} [signals.connectors]
+ * @param {string|null} [signals.deployTarget] e.g. 'production'
+ * @param {string[]} [signals.labels] beads labels (may include `tier:tN`)
+ * @returns {{tier:'T0'|'T1'|'T2', reasons:string[], escalatedFromLabel:('T0'|'T1'|null)}}
+ */
+export function classify(signals = {}) {
+  const changedFiles = Array.isArray(signals.changedFiles) ? signals.changedFiles : [];
+  const connectors = Array.isArray(signals.connectors) ? signals.connectors : [];
+  const deployTarget = signals.deployTarget ?? null;
+  const explicit = labelTier(signals.labels);
+
+  // ── Hard T2 triggers ────────────────────────────────────────────────────────
+  const hard = [];
+  const behavioral = changedFiles.filter((f) => !isNonBehavioral(f));
+  for (const f of behavioral) {
+    const hit = T2_PATHS.find((p) => p.re.test(f));
+    if (hit) hard.push(`${hit.why}:${f}`);
+  }
+  for (const c of connectors) {
+    if (c && c.isNew && c.hasWrite) hard.push(`connector:new-write:${c.id ?? '?'}`);
+  }
+  if (String(deployTarget).toLowerCase() === 'production') hard.push('deploy:production');
+
+  // Volume/scope escalation — the build-side analog of the runtime AI-firewall
+  // (great_cto-34g): a change touching many behavioral files has a large blast radius;
+  // even if each file is individually reversible, the bulk gets a human look (T2).
+  const bulkThreshold = Number(
+    signals.bulkThreshold ?? process.env.GREAT_CTO_BULK_THRESHOLD ?? 50,
+  );
+  if (Number.isFinite(bulkThreshold) && bulkThreshold > 0 && behavioral.length >= bulkThreshold) {
+    hard.push(`bulk:${behavioral.length}files`);
+  }
+
+  if (hard.length) {
+    // T2 floor: a lower explicit label is overridden — recorded for the audit log.
+    const escalatedFromLabel =
+      explicit && TIER_RANK[explicit] < TIER_RANK.T2 ? explicit : null;
+    return { tier: 'T2', reasons: hard, escalatedFromLabel };
+  }
+
+  // ── Auto baseline (no hard trigger) ───────────────────────────────────────────
+  // T0 only when there is at least one file and EVERY file is non-behavioral.
+  const baseAuto =
+    changedFiles.length > 0 && behavioral.length === 0 ? 'T0' : 'T1';
+
+  // Explicit label wins within the non-floored range (can up- or down-grade).
+  const tier = explicit ?? baseAuto;
+  const reasons = explicit
+    ? [`label:${explicit}`]
+    : [
+        baseAuto === 'T0'
+          ? `auto:T0:non-behavioral(${changedFiles.length})`
+          : `auto:T1:${behavioral.length ? `behavioral(${behavioral.length})` : 'default'}`,
+      ];
+  return { tier, reasons, escalatedFromLabel: null };
+}
+
+// CLI: node scripts/lib/change-tier.mjs file1 file2 …  → prints the tier + reasons
+// (a thin probe; the orchestrator imports classify() directly with richer signals).
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const r = classify({ changedFiles: process.argv.slice(2) });
+  process.stdout.write(`${r.tier}  ${r.reasons.join(', ')}\n`);
+}

package/board/scripts/lib/gate-plan.mjs

@@ -0,0 +1,119 @@
+// scripts/lib/gate-plan.mjs — compute the human gates that should open for THE
+// CURRENT CHANGE, by composing the two pure pieces of the two-axis gate model:
+//
+//   classify(diff)            → change_tier (T0/T1/T2)       [scripts/lib/change-tier.mjs]
+//   effectiveGates(arch,size,tier) → the gate set            [packages/cli/src/archetypes.ts]
+//
+// This is the runtime entry point the orchestrator (or a human) calls at the start
+// of a change: "given what I'm touching, which gates actually open?". The static
+// FLOW.md gate menu (compileFlow → gatesFor) is unchanged — it lists what a project
+// CAN gate; this decides what THIS change DOES gate.
+//
+// CLI:
+//   node scripts/lib/gate-plan.mjs                 classify the working-tree diff
+//   node scripts/lib/gate-plan.mjs --base main     diff against a base ref
+//   node scripts/lib/gate-plan.mjs --deploy production
+//   node scripts/lib/gate-plan.mjs --label tier:t2 --json
+//
+// Plan: docs/plans/PLAN-2026-06-18-gate-tiering-reviewer-consolidation.md
+// ADR:  docs/adr/ADR-003-two-axis-gate-model.md
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+import { classify } from './change-tier.mjs';
+import { selectJudgeModel } from './judge-model.mjs';
+// effectiveGates lives in the built CLI package (TS → dist).
+import { effectiveGates } from '../../packages/cli/dist/archetypes.js';
+
+/** Parse archetype + project_size out of a .great_cto/PROJECT.md body. */
+export function parseProject(text) {
+  const get = (k) => {
+    const m = String(text).match(new RegExp(`^${k}:\\s*(\\S+)`, 'm'));
+    return m ? m[1] : null;
+  };
+  return {
+    archetype: get('archetype') ?? get('primary') ?? 'greenfield',
+    size: get('project_size') ?? get('size') ?? 'medium',
+  };
+}
+
+// Governance regime per gate (mech-gov R1/R2 vocabulary, borrow-santander TAKE 1):
+//   R2 = MECHANICALLY enforced — a script/CI produces the verdict and can hard-block
+//        (qa runs tests, security runs secret/CVE scans, ship gates on CI green).
+//   R1 = text-only judgment — a human/reviewer reads and approves the direction.
+// R2 gates are the moat: an enforced control, not a vibe. Surfacing the split lets
+// /gov-metrics measure how much of the pipeline is actually enforced vs prose.
+const R2_GATES = new Set(['qa', 'security', 'ship']);
+export function regimeOfGate(gate) { return R2_GATES.has(gate) ? 'R2' : 'R1'; }
+
+/**
+ * Compose classify → effectiveGates for one change.
+ * @returns {{tier:string, reasons:string[], escalatedFromLabel:(string|null), gates:string[], gateRegimes:Object, r2Share:number, judge:Object}}
+ */
+export function planGates({ archetype, size, changedFiles, connectors, deployTarget, labels }) {
+  const c = classify({ changedFiles, connectors, deployTarget, labels });
+  const gates = effectiveGates(archetype, size, c.tier);
+  // ADR-004: the per-change plan also says which judge model to use (cheap on T0/T1,
+  // frontier + human on T2). Same tier, two consequences — gates and judge.
+  const judge = selectJudgeModel(c.tier);
+  const gateRegimes = Object.fromEntries(gates.map((g) => [g, regimeOfGate(g)]));
+  const r2 = gates.filter((g) => regimeOfGate(g) === 'R2').length;
+  const r2Share = gates.length ? Math.round((100 * r2) / gates.length) : 0;
+  return { tier: c.tier, reasons: c.reasons, escalatedFromLabel: c.escalatedFromLabel, gates, gateRegimes, r2Share, judge };
+}
+
+// ── CLI ───────────────────────────────────────────────────────────────────────
+
+function gitChangedFiles(base) {
+  try {
+    const args = base
+      ? ['diff', '--name-only', `${base}...HEAD`]
+      : ['diff', '--name-only', 'HEAD'];
+    const out = execFileSync('git', args, { encoding: 'utf8' });
+    const tracked = out.split('\n').map((s) => s.trim()).filter(Boolean);
+    // include untracked files too (a new connector/migration not yet staged)
+    const un = execFileSync('git', ['ls-files', '--others', '--exclude-standard'], { encoding: 'utf8' })
+      .split('\n').map((s) => s.trim()).filter(Boolean);
+    return [...new Set([...tracked, ...un])];
+  } catch {
+    return [];
+  }
+}
+
+function readProject() {
+  for (const p of ['.great_cto/PROJECT.md', 'PROJECT.md']) {
+    try { return parseProject(readFileSync(p, 'utf8')); } catch { /* next */ }
+  }
+  return { archetype: 'greenfield', size: 'medium' };
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const argv = process.argv.slice(2);
+  const opt = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : null; };
+  const json = argv.includes('--json');
+  const labels = argv.reduce((a, v, i) => (argv[i - 1] === '--label' ? [...a, v] : a), []);
+
+  const { archetype, size } = readProject();
+  const changedFiles = gitChangedFiles(opt('--base'));
+  const result = planGates({
+    archetype, size, changedFiles,
+    deployTarget: opt('--deploy'),
+    labels,
+  });
+
+  if (json) {
+    process.stdout.write(`${JSON.stringify({ archetype, size, ...result }, null, 2)}\n`);
+  } else {
+    const esc = result.escalatedFromLabel ? `  (label ${result.escalatedFromLabel} overridden by T2 floor)` : '';
+    process.stdout.write(
+      `archetype=${archetype} size=${size}\n` +
+      `tier=${result.tier}${esc}\n` +
+      `reasons: ${result.reasons.join(', ')}\n` +
+      `gates:   ${result.gates.length ? result.gates.map((g) => `${g}[${result.gateRegimes[g]}]`).join(', ') : '(none — CI is the gate)'}\n` +
+      `regime:  R2-mechanical ${result.r2Share}% · R1-textual ${100 - result.r2Share}%\n` +
+      `judge:   ${result.judge.model}${result.judge.human ? ' + human' : ''}\n`,
+    );
+  }
+}

package/board/scripts/lib/judge-model.mjs

@@ -0,0 +1,42 @@
+// scripts/lib/judge-model.mjs — runtime judge-model router (ADR-004).
+//
+// The cost-of-error axis from ADR-004: a judge/eval/scorer grading a T0/T1 (reversible,
+// CI-checked) change runs a CHEAP model — a wrong "looks good" is cheap there. On a T2
+// (irreversible / regulated / prod-deploy) change the judge runs the FRONTIER model AND
+// the human is in the loop, because a false-APPROVED carries liability.
+//
+// The cheap-judge id is env-pluggable (GREAT_CTO_JUDGE_MODEL) so a fine-tuned open judge
+// (Qwen-class — matches frontier at ~100x lower cost per the 2026-06 result) can replace
+// the default without a code change, once qualified by scripts/judge-validate.mjs.
+//
+// Pairs with change-tier.mjs (the tier) + gate-plan.mjs (per-change plan) + ADR-004.
+
+export const DEFAULT_FRONTIER_JUDGE = 'claude-opus-4-8';
+export const DEFAULT_CHEAP_JUDGE = 'claude-haiku-4-5';
+
+/**
+ * Pick the judge model for a change of the given tier.
+ * @param {('T0'|'T1'|'T2')} changeTier
+ * @param {{cheapModel?:string, frontierModel?:string}} [opts]
+ * @returns {{model:string, tier:string, human:boolean, reason:string}}
+ */
+export function selectJudgeModel(changeTier, opts = {}) {
+  const cheap = opts.cheapModel || process.env.GREAT_CTO_JUDGE_MODEL || DEFAULT_CHEAP_JUDGE;
+  const frontier = opts.frontierModel || DEFAULT_FRONTIER_JUDGE;
+
+  // Fail-safe: an unknown tier is treated as T2 (frontier + human) — never silently cheap.
+  const tier = (changeTier === 'T0' || changeTier === 'T1') ? changeTier : 'T2';
+
+  if (tier === 'T2') {
+    return { model: frontier, tier, human: true,
+      reason: 'T2 (irreversible/regulated) — frontier judge + human gate; a false-APPROVED carries liability' };
+  }
+  return { model: cheap, tier, human: false,
+    reason: `${tier} (reversible) — cheap judge; CI + tests are the safety net` };
+}
+
+// CLI: node scripts/lib/judge-model.mjs T1  → prints the model + reason
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const r = selectJudgeModel(process.argv[2]);
+  process.stdout.write(`${r.tier}  model=${r.model}  human=${r.human}\n  ${r.reason}\n`);
+}

package/dist/board-path.js

@@ -0,0 +1,47 @@
+// Board server resolution — extracted from main.ts so it is unit-testable
+// (main.ts self-executes on import). See great_cto-hbu3.
+import { existsSync as fsExistsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Locate the board server.mjs. Order:
+ *   1. dev layouts (running from a repo checkout)
+ *   2. installed plugin cache — ANY marketplace under ~/.claude/plugins/cache,
+ *      newest 5 versions each (not just the "local" marketplace)
+ *   3. the copy bundled into the npm package by scripts/bundle-board.mjs —
+ *      guaranteed fallback so a fresh `npm i -g great-cto` can run the board
+ *      without the plugin installed
+ */
+export function findBoardServerPath(baseDir, home) {
+    const here = baseDir ?? dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        join(here, "..", "..", "board", "server.mjs"), // packages/cli/dist (dev)
+        join(here, "..", "board", "server.mjs"), // alt dev layout
+        join(here, "board", "server.mjs"), // flat layout
+    ];
+    // Numeric semver sort — a plain .sort() is lexicographic and would rank
+    // 2.99.0 above 2.100.0 (and once ranked 2.7.0 above 2.69.0).
+    const byVer = (a, b) => {
+        const pa = a.split(".").map(Number), pb = b.split(".").map(Number);
+        return (pb[0] - pa[0]) || (pb[1] - pa[1]) || (pb[2] - pa[2]) || 0;
+    };
+    const cacheRoot = join(home ?? homedir(), ".claude", "plugins", "cache");
+    if (fsExistsSync(cacheRoot)) {
+        try {
+            for (const marketplace of readdirSync(cacheRoot)) {
+                const pluginBase = join(cacheRoot, marketplace, "great_cto");
+                if (!fsExistsSync(pluginBase))
+                    continue;
+                const versions = readdirSync(pluginBase).filter(v => /^\d/.test(v)).sort(byVer);
+                for (const v of versions.slice(0, 5)) {
+                    candidates.push(join(pluginBase, v, "packages", "board", "server.mjs"));
+                }
+            }
+        }
+        catch { /* ignore */ }
+    }
+    // bundled copy (dist → ../board/packages/board/server.mjs)
+    candidates.push(join(here, "..", "board", "packages", "board", "server.mjs"));
+    return candidates.find(fsExistsSync);
+}

package/dist/main.js

@@ -21,7 +21,8 @@ import { bootstrap } from "./bootstrap.js";
 import { compileFlow } from "./flow.js";
 import { shouldUseLlmFallback, suggestArchetypeFromLlm } from "./llm-fallback.js";
 import { sendUsagePing, sendInstallPing, telemetrySubcommand, isTelemetryEnabled, computeAnonId } from "./telemetry.js";
-import { readFileSync, writeFileSync, copyFileSync, chmodSync, mkdirSync, readdirSync, unlinkSync, existsSync as fsExistsSync } from "node:fs";
+import { findBoardServerPath } from "./board-path.js";
+import { readFileSync, writeFileSync, copyFileSync, chmodSync, mkdirSync, unlinkSync, existsSync as fsExistsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
@@ -215,35 +216,6 @@ function boardPidFilePath(surface) {
     // start must never kill the builder board (and vice versa).
     return join(homedir(), ".great_cto", surface === "console" ? "console.pid" : "board.pid");
 }
-/**
- * Locate the board server.mjs — checks dev layouts then plugin cache versions
- * in descending order, returning the first path that exists.
- */
-function findBoardServerPath() {
-    const here = dirname(fileURLToPath(import.meta.url));
-    const candidates = [
-        join(here, "..", "..", "board", "server.mjs"), // packages/cli/dist (dev)
-        join(here, "..", "board", "server.mjs"), // alt dev layout
-        join(here, "board", "server.mjs"), // flat layout
-    ];
-    const pluginBase = join(homedir(), ".claude", "plugins", "cache", "local", "great_cto");
-    if (fsExistsSync(pluginBase)) {
-        try {
-            // Numeric semver sort — a plain .sort() is lexicographic and would rank
-            // 2.99.0 above 2.100.0 (and once ranked 2.7.0 above 2.69.0).
-            const byVer = (a, b) => {
-                const pa = a.split(".").map(Number), pb = b.split(".").map(Number);
-                return (pb[0] - pa[0]) || (pb[1] - pa[1]) || (pb[2] - pa[2]) || 0;
-            };
-            const versions = readdirSync(pluginBase).filter(v => /^\d/.test(v)).sort(byVer);
-            for (const v of versions.slice(0, 5)) {
-                candidates.push(join(pluginBase, v, "packages", "board", "server.mjs"));
-            }
-        }
-        catch { /* ignore */ }
-    }
-    return candidates.find(fsExistsSync);
-}
 /**
  * Kill the board server recorded in the PID file.
  * Returns true if a live process was terminated.
@@ -336,7 +308,7 @@ async function runBoard(args, surface) {
     }
     const serverPath = findBoardServerPath();
     if (!serverPath) {
-        error("Board server not found. Try reinstalling: npx great-cto@latest");
+        error("Board server not found. Reinstall the CLI (npm i -g great-cto@latest) or install the great_cto plugin (npx great-cto install).");
         return 1;
     }
     const nodeArgs = [serverPath];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.77.0",
+  "version": "2.77.1",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",
@@ -70,6 +70,7 @@
     "index.mjs",
     "dist/",
     "assets/",
+    "board/",
     "postinstall.mjs",
     "README.md",
     "scripts/hooks/"
@@ -80,6 +81,7 @@
     "test": "npm run build && node --test tests/*.test.mjs tests/**/*.test.mjs",
     "test:e2e": "npm run build && node ../../tests/run-archetype-e2e.mjs",
     "postinstall": "node postinstall.mjs",
+    "prepack": "node scripts/bundle-board.mjs",
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {