great-cto 2.77.2 → 2.78.0

package/board/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "great_cto",
   "id": "great_cto",
   "description": "Engineering process for solo founders and teams up to 50 engineers. Agents do architecture, code review, QA, and security. You make two decisions per feature.",
-  "version": "2.77.2",
+  "version": "2.78.0",
   "author": {
     "name": "Great CTO",
     "url": "https://github.com/avelikiy/great_cto"

package/board/packages/board/lib/alerts.mjs

@@ -16,6 +16,7 @@ import { getTasks } from './beads.mjs';
 import { readVerdicts } from './verdicts.mjs';
 import { isFailure } from './fleet.mjs';
 import { getShareState, toggleShare } from './share.mjs';
+import { log } from './log.mjs';
 
 // ── Email alerts (Resend) ─────────────────────────────────────────────────
 // Dispatch model: read webhooks.json on every fire (idempotent if disabled
@@ -91,12 +92,12 @@ async function fireEmailAlert(eventName, dedupeKey, payload) {
     });
     if (!res.ok) {
       const txt = await res.text().catch(() => '');
-      console.warn(`fireEmailAlert ${eventName}: relay HTTP ${res.status} ${txt.slice(0, 200)}`);
+      log.warn(`fireEmailAlert ${eventName}: relay HTTP ${res.status} ${txt.slice(0, 200)}`);
       return;
     }
-    console.log(`fireEmailAlert: sent ${eventName} (${dedupeKey})`);
+    log.info(`fireEmailAlert: sent ${eventName} (${dedupeKey})`);
   } catch (e) {
-    console.warn(`fireEmailAlert ${eventName} failed:`, e.message);
+    log.warn(`fireEmailAlert ${eventName} failed:`, e.message);
   }
 }
 
@@ -119,12 +120,12 @@ async function firePushAlert(eventName, dedupeKey, payload) {
       catch (e) {
         // 410 = subscription expired — browser unsubscribed, clean up
         if (e.statusCode === 410) removeSubscription(PUSH_SUBS_FILE, sub.endpoint);
-        else console.warn(`firePushAlert send failed for ${sub.endpoint}:`, e.message);
+        else log.warn(`firePushAlert send failed for ${sub.endpoint}:`, e.message);
       }
     }
     fired[pushKey] = new Date().toISOString();
     writeAlertsFired(fired);
-  } catch (e) { console.warn('firePushAlert failed:', e.message); }
+  } catch (e) { log.warn('firePushAlert failed:', e.message); }
 }
 
 // ── Cron: scan gates / cost / weekly digest ───────────────────────────────
@@ -172,7 +173,7 @@ function startAlertCron() {
           firePushAlert('incident.p0', dedupeKey, p0Payload);
         }
       }
-    } catch (e) { console.warn('cron incident.p0 failed:', e.message); }
+    } catch (e) { log.warn('cron incident.p0 failed:', e.message); }
   }, FIVE_MIN);
 
   // gate.blocked: new BLOCKED verdict from security-officer
@@ -207,7 +208,7 @@ function startAlertCron() {
         addNotification('gate.blocked', blockedPayload);
         firePushAlert('gate.blocked', dedupeKey, blockedPayload);
       }
-    } catch (e) { console.warn('cron gate.blocked failed:', e.message); }
+    } catch (e) { log.warn('cron gate.blocked failed:', e.message); }
   }, FIVE_MIN);
 
   // gate.stale: gate task open between 2h and 7 days.
@@ -238,7 +239,7 @@ function startAlertCron() {
           firePushAlert('gate.stale', dedupeKey, stalePayload);
         }
       }
-    } catch (e) { console.warn('cron gate.stale failed:', e.message); }
+    } catch (e) { log.warn('cron gate.stale failed:', e.message); }
   }, FIVE_MIN);
 
   // cost.threshold: monthly LLM spend at 80% / 100% of budget
@@ -277,7 +278,7 @@ function startAlertCron() {
           firePushAlert('cost.threshold', dedupeKey, costPayload);
         }
       }
-    } catch (e) { console.warn('cron cost.threshold failed:', e.message); }
+    } catch (e) { log.warn('cron cost.threshold failed:', e.message); }
   }, ONE_HOUR);
 
   // digest.weekly: Friday 09:00 UTC ± server tick
@@ -317,7 +318,7 @@ function startAlertCron() {
         addNotification('digest.weekly', weeklyPayload);
         await firePushAlert('digest.weekly', dedupeKey, weeklyPayload);
       }
-    } catch (e) { console.warn('cron digest.weekly failed:', e.message); }
+    } catch (e) { log.warn('cron digest.weekly failed:', e.message); }
   }, FIVE_MIN);
 
   // digest.daily: morning summary (Mon–Fri, 08:00 UTC).
@@ -384,7 +385,7 @@ function startAlertCron() {
         addNotification('digest.daily', dailyPayload);
         await firePushAlert('digest.daily', dedupeKey, dailyPayload);
       }
-    } catch (e) { console.warn('cron digest.daily failed:', e.message); }
+    } catch (e) { log.warn('cron digest.daily failed:', e.message); }
   }, FIVE_MIN);
 
   // report.daily: republish share reports every day at 09:00 UTC
@@ -401,13 +402,13 @@ function startAlertCron() {
         if (_reportRepublishDedupeSet.has(dedupeKey)) continue;
         _reportRepublishDedupeSet.add(dedupeKey);
         toggleShare(true, proj.path, true)
-          .then(() => console.log(`report.daily: republished ${proj.slug}`))
-          .catch(e => console.warn(`report.daily: ${proj.slug} failed: ${e.message}`));
+          .then(() => log.info(`report.daily: republished ${proj.slug}`))
+          .catch(e => log.warn(`report.daily: ${proj.slug} failed: ${e.message}`));
       }
-    } catch (e) { console.warn('cron report.daily failed:', e.message); }
+    } catch (e) { log.warn('cron report.daily failed:', e.message); }
   }, FIVE_MIN);
 
-  console.log('Alert cron started: gate.stale (5min), sla.escalate (5min), connector.health (5min), cost.threshold (1h), digest.daily (Mon–Fri 08:00), digest.weekly (Fri 09:00), report.daily (09:00)');
+  log.info('Alert cron started: gate.stale (5min), sla.escalate (5min), connector.health (5min), cost.threshold (1h), digest.daily (Mon–Fri 08:00), digest.weekly (Fri 09:00), report.daily (09:00)');
 }
 
 export { readAlertsFired, writeAlertsFired, fireEmailAlert, firePushAlert, startAlertCron };

package/board/packages/board/lib/beads.mjs

@@ -3,6 +3,7 @@ import path from 'path';
 import os from 'os';
 import { spawnSync } from 'child_process';
 import { bdCache } from './state.mjs';
+import { log } from './log.mjs';
 
 // ── Beads data ─────────────────────────────────────────────────────────────────
 // Cache bdList output per cwd for BD_CACHE_TTL_MS. Invalidated when the project's
@@ -85,7 +86,7 @@ function checkBeadsAvailable(cwd) {
 let _bdWriteChain = Promise.resolve();
 function bdWriteSerialised(fn) {
   const next = _bdWriteChain.then(() => fn()).catch((e) => {
-    console.error('[bd-write-serialised] error:', e?.message || e);
+    log.error('[bd-write-serialised]', e?.message || e);
     return null;
   });
   _bdWriteChain = next.then(() => undefined).catch(() => undefined);

package/board/packages/board/lib/log.mjs

@@ -0,0 +1,44 @@
+// Zero-dep structured logger for the great_cto board server.
+//
+// Design:
+//   - Levels: debug < info < warn < error. Threshold read once from
+//     GREAT_CTO_LOG_LEVEL (default 'info'); unrecognized values fall back to 'info'.
+//   - Output: single-line `<ISO timestamp> <LEVEL> <message>` per call.
+//   - Routing: error → stderr; debug/info/warn → stdout. This matches Unix
+//     convention (stdout = normal operation, stderr = attention-worthy) and
+//     keeps the board's stdout free of interleaved error noise.
+//   - No external deps, ESM only, node: prefix for built-ins.
+
+const LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
+
+function currentThreshold() {
+  const raw = (process.env.GREAT_CTO_LOG_LEVEL || 'info').toLowerCase();
+  return LEVELS[raw] ?? LEVELS.info;
+}
+
+function format(level, args) {
+  const ts = new Date().toISOString();
+  const msg = args
+    .map(a => (typeof a === 'string' ? a : a instanceof Error ? (a.stack || a.message) : JSON.stringify(a)))
+    .join(' ');
+  return `${ts} ${level.toUpperCase()} ${msg}`;
+}
+
+function emit(level, args) {
+  if (LEVELS[level] < currentThreshold()) return;
+  const line = format(level, args);
+  if (level === 'error') {
+    process.stderr.write(line + '\n');
+  } else {
+    process.stdout.write(line + '\n');
+  }
+}
+
+export const log = {
+  debug: (...args) => emit('debug', args),
+  info: (...args) => emit('info', args),
+  warn: (...args) => emit('warn', args),
+  error: (...args) => emit('error', args),
+};
+
+export default log;

package/board/packages/board/lib/projects.mjs

@@ -4,6 +4,20 @@ import os from 'os';
 import { spawnSync } from 'child_process';
 import { planGates } from '../../../scripts/lib/gate-plan.mjs';
 import { GREAT_CTO_DIR, PROJECTS_FILE } from './config.mjs';
+import { isInsideDir } from './util.mjs';
+
+// Same HOME-boundary policy /api/projects/register enforces (lib/routes.mjs):
+// a raw absolute/tilde path must resolve inside the operator's home directory,
+// no exceptions. Without this, a request like ?project=/etc or ?project=/tmp
+// makes the board read/write project data (.beads, verdicts/, PROJECT.md)
+// at an arbitrary filesystem location the operator never registered. Returns
+// null (not process.cwd()) so callers can distinguish "not a raw path" from
+// "raw path rejected" and fall back explicitly.
+function resolveRawPathWithinHome(slugOrPath) {
+  const raw = slugOrPath.startsWith('~') ? slugOrPath.replace(/^~/, os.homedir()) : slugOrPath;
+  const resolved = path.resolve(raw);
+  return isInsideDir(os.homedir(), resolved) ? resolved : null;
+}
 
 // ── Project registry ───────────────────────────────────────────────────────────
 function readProjectsRegistry() {
@@ -251,12 +265,19 @@ function listProjects() {
 }
 function resolveProjectCwd(slugOrPath) {
   if (!slugOrPath) return process.cwd();
-  // If absolute path or starts with ~, use directly
-  if (slugOrPath.startsWith('/')) return slugOrPath;
-  if (slugOrPath.startsWith('~')) return slugOrPath.replace(/^~/, os.homedir());
+  // If absolute path or starts with ~, it's raw user input — enforce the same
+  // HOME-boundary policy /api/projects/register uses. A path outside HOME
+  // falls back to process.cwd() (same fallback already used below for an
+  // unknown slug) rather than being honored verbatim.
+  if (slugOrPath.startsWith('/') || slugOrPath.startsWith('~')) {
+    const withinHome = resolveRawPathWithinHome(slugOrPath);
+    return withinHome || process.cwd();
+  }
   // Else look up in registry by slug — among duplicate slugs (great_cto-7xfc),
   // prefer the entry whose path exists on disk; among several existing (or
-  // several missing), prefer the most recently added_at.
+  // several missing), prefer the most recently added_at. Registry entries were
+  // already validated at registration time (register enforces the HOME
+  // boundary before writing), so slug resolution is untouched.
   const reg = readProjectsRegistry();
   const matches = reg.projects.filter(p => p.slug === slugOrPath);
   const found = pickBestBySlug(matches);
@@ -271,16 +292,18 @@ function resolveProjectCwd(slugOrPath) {
  *
  * resolved values:
  *   'cwd'      — no project param passed; using server cwd as documented
- *   'path'     — absolute / tilde path passed and used directly
+ *   'path'     — absolute / tilde path passed, resolved inside HOME, used directly
  *   'slug'     — slug found in registry
- *   'fallback' — slug requested but NOT in registry; using cwd as fallback.
- *                Caller should warn the user (header + log).
+ *   'fallback' — slug requested but NOT in registry, OR a raw path was requested
+ *                that resolves outside HOME (great_cto-qvg9); using cwd as
+ *                fallback. Caller should warn the user (header + log).
  */
 function resolveProjectInfo(slugOrPath) {
   if (!slugOrPath) return { cwd: process.cwd(), resolved: 'cwd' };
-  if (slugOrPath.startsWith('/')) return { cwd: slugOrPath, resolved: 'path' };
-  if (slugOrPath.startsWith('~')) {
-    return { cwd: slugOrPath.replace(/^~/, os.homedir()), resolved: 'path' };
+  if (slugOrPath.startsWith('/') || slugOrPath.startsWith('~')) {
+    const withinHome = resolveRawPathWithinHome(slugOrPath);
+    if (withinHome) return { cwd: withinHome, resolved: 'path' };
+    return { cwd: process.cwd(), resolved: 'fallback', requested: slugOrPath };
   }
   const reg = readProjectsRegistry();
   const matches = reg.projects.filter(p => p.slug === slugOrPath);

package/board/packages/board/lib/routes.mjs

@@ -6,13 +6,14 @@ import {
   addSubscription,
   removeSubscription,
 } from '../push-adapter.mjs';
-import { PORT, GREAT_CTO_DIR, VAPID_KEYS_FILE, PUSH_SUBS_FILE, BUILD_VERSION } from './config.mjs';
-import { eventSurface, readFileSafe } from './util.mjs';
+import { GREAT_CTO_DIR, VAPID_KEYS_FILE, PUSH_SUBS_FILE, BUILD_VERSION } from './config.mjs';
+import { eventSurface, readFileSafe, originAllowed } from './util.mjs';
 import { sseClients, notifHistory } from './state.mjs';
 import { autoRegisterProject, listProjects, resolveProjectCwd, getChangeTier } from './projects.mjs';
 import { broadcastTasks } from './sse.mjs';
 import { saveNotifHistory } from './notifications.mjs';
 import { getMemory, getPipeline, getCostHistory, getInbox } from './data-readers.mjs';
+import { log } from './log.mjs';
 import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks } from './beads.mjs';
 import { getMetrics } from './metrics.mjs';
 import { readVerdicts } from './verdicts.mjs';
@@ -54,18 +55,12 @@ async function dispatch(req, res, url, cwd) {
   // it MUST reject cross-origin requests. The board listens on 127.0.0.1
   // but a malicious page the user visits can still issue text/plain POSTs
   // (simple CORS request — no preflight) to localhost. Two gates:
-  //   1) Origin / Referer must match http://localhost:PORT or 127.0.0.1:PORT.
+  //   1) Origin / Referer must be same-origin (originAllowed() in lib/util.mjs —
+  //      also enforced as the top-level CSRF guard in server.mjs before dispatch()
+  //      is ever called, so this is defense-in-depth, not the only check).
   //   2) Resolved target path must live inside HOME — no /tmp, no /etc.
   if (pathname === '/api/projects/register' && req.method === 'POST') {
-    const origin = req.headers.origin || req.headers.referer || '';
-    const expectedOrigin = `http://localhost:${PORT}`;
-    const expectedOrigin2 = `http://127.0.0.1:${PORT}`;
-    const originOk = !origin
-      || origin === expectedOrigin
-      || origin === expectedOrigin2
-      || origin.startsWith(expectedOrigin + '/')
-      || origin.startsWith(expectedOrigin2 + '/');
-    if (!originOk) {
+    if (!originAllowed(req)) {
       res.writeHead(403, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'origin not allowed' }));
       return true;
@@ -384,8 +379,8 @@ async function dispatch(req, res, url, cwd) {
         const shareState = getShareState(gateCwd);
         if (shareState.enabled) {
           toggleShare(true, gateCwd, true)
-            .then(() => console.log(`report: auto-republished after gate approve (${id})`))
-            .catch(e => console.warn(`report: republish after gate failed: ${e.message}`));
+            .then(() => log.info(`report: auto-republished after gate approve (${id})`))
+            .catch(e => log.warn(`report: republish after gate failed: ${e.message}`));
         }
       }
     });
@@ -850,16 +845,10 @@ async function dispatch(req, res, url, cwd) {
   // (DESIGN-agents-fleet-view §9 Top-2 #2: reversible sidecar chosen over
   // filesystem move; founder may revise.)
   if (pathname.startsWith('/api/agents/') && req.method === 'POST') {
-    // Cross-origin guard — same pattern as BH-23 on /api/projects/register.
-    const origin = req.headers.origin || req.headers.referer || '';
-    const expectedOrigin = `http://localhost:${PORT}`;
-    const expectedOrigin2 = `http://127.0.0.1:${PORT}`;
-    const originOk = !origin
-      || origin === expectedOrigin
-      || origin === expectedOrigin2
-      || origin.startsWith(expectedOrigin + '/')
-      || origin.startsWith(expectedOrigin2 + '/');
-    if (!originOk) {
+    // Cross-origin guard — same helper as BH-23 on /api/projects/register
+    // (originAllowed() in lib/util.mjs; also enforced as the top-level CSRF
+    // guard in server.mjs before dispatch() is ever called).
+    if (!originAllowed(req)) {
       res.writeHead(403, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'origin_not_allowed' }));
       return true;

package/board/packages/board/lib/util.mjs

@@ -1,4 +1,5 @@
 import fs from 'fs';
+import path from 'path';
 import { PORT } from './config.mjs';
 
 /**
@@ -33,4 +34,16 @@ function readFileSafe(p) {
   try { return fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null; } catch { return null; }
 }
 
-export { csvCell, originAllowed, eventSurface, readFileSafe };
+// Path-containment check used by any handler that joins user-controlled input
+// onto a base directory (static file serving, doc reads, etc.). Resolves both
+// sides and requires `target` to be exactly `base`, or a real descendant of
+// it (base + path.sep prefix) — this is what actually blocks ".." escapes,
+// since a naive startsWith(base) would wrongly allow a sibling directory
+// like "/public-evil" when base is "/public".
+function isInsideDir(base, target) {
+  const resolvedBase = path.resolve(base);
+  const resolvedTarget = path.resolve(target);
+  return resolvedTarget === resolvedBase || resolvedTarget.startsWith(resolvedBase + path.sep);
+}
+
+export { csvCell, originAllowed, eventSurface, readFileSafe, isInsideDir };

package/board/packages/board/server.mjs

@@ -13,11 +13,12 @@ import fs from 'fs';
 import path from 'path';
 import { spawnSync } from 'child_process';
 import { PORT, PUBLIC, HOST } from './lib/config.mjs';
-import { originAllowed } from './lib/util.mjs';
+import { originAllowed, isInsideDir } from './lib/util.mjs';
 import { discoverProjects, resolveProjectInfo } from './lib/projects.mjs';
 import { startAlertCron } from './lib/alerts.mjs';
 import { watchBeads, watchVerdicts } from './lib/watchers.mjs';
 import { dispatch } from './lib/routes.mjs';
+import { log } from './lib/log.mjs';
 
 // ── Helpers ────────────────────────────────────────────────────────────────────
 
@@ -77,7 +78,13 @@ const server = http.createServer(async (req, res) => {
   // Static files
   let filePath = pathname === '/' ? '/index.html' : pathname;
   const fullPath = path.join(PUBLIC, filePath);
-  if (fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
+  // Path-traversal guard (mirrors the /api/doc containment check in lib/routes.mjs):
+  // the joined path must resolve to somewhere inside PUBLIC. Without this, a decoded
+  // pathname like /..%2F..%2Fetc%2Fpasswd can escape the public/ directory via
+  // path.join's ".." collapsing. Reject with 404 (same as the generic static 404
+  // below) so a traversal attempt is indistinguishable from a missing file — no
+  // signal to a prober about what exists outside PUBLIC.
+  if (isInsideDir(PUBLIC, fullPath) && fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
     const ext = path.extname(fullPath);
     const mime = { '.html': 'text/html', '.css': 'text/css', '.js': 'text/javascript', '.svg': 'image/svg+xml' };
     // HTML must never cache — board UI is iterated daily and stale layouts
@@ -102,15 +109,15 @@ const server = http.createServer(async (req, res) => {
 
 // ── Start ──────────────────────────────────────────────────────────────────────
 server.listen(PORT, HOST, () => {
-  console.log(`great_cto board → http://${HOST === '0.0.0.0' ? 'localhost' : HOST}:${PORT}`);
+  log.info(`great_cto board → http://${HOST === '0.0.0.0' ? 'localhost' : HOST}:${PORT}`);
   if (HOST !== '127.0.0.1' && HOST !== 'localhost') {
-    console.log(`  ⚠ bound to ${HOST} — reachable beyond this machine. Operators authenticate via invite`);
-    console.log(`    links; put your reverse-proxy auth in front for anything admin-grade.`);
+    log.info(`  ⚠ bound to ${HOST} — reachable beyond this machine. Operators authenticate via invite`);
+    log.info(`    links; put your reverse-proxy auth in front for anything admin-grade.`);
   }
   // Discover all great_cto projects on disk asynchronously — don't block
   // the listening event so /api/tasks is available immediately.
   discoverProjects().then(n => {
-    if (n > 0) console.log(`  → discovered ${n} project${n === 1 ? '' : 's'} with .great_cto/PROJECT.md`);
+    if (n > 0) log.info(`  → discovered ${n} project${n === 1 ? '' : 's'} with .great_cto/PROJECT.md`);
   }).catch(() => {}); // non-fatal
   watchBeads();
   startAlertCron();
@@ -125,9 +132,9 @@ server.listen(PORT, HOST, () => {
 
 server.on('error', e => {
   if (e.code === 'EADDRINUSE') {
-    console.log(`Port ${PORT} in use — board already running at http://localhost:${PORT}`);
+    log.info(`Port ${PORT} in use — board already running at http://localhost:${PORT}`);
   } else {
-    console.error(e);
+    log.error(e);
   }
   process.exit(0);
 });

package/dist/telemetry.js

@@ -27,9 +27,9 @@ import * as path from "node:path";
 import * as os from "node:os";
 import * as crypto from "node:crypto";
 const TELEMETRY_ENDPOINT = process.env.GREAT_CTO_TELEMETRY_ENDPOINT
-    || "https://great-cto-telemetry.alexander-velikiy.workers.dev/v1/event";
-// Note: workers.dev URL is the temporary default until telemetry.greatcto.systems
-// custom domain is bound. Override anytime with GREAT_CTO_TELEMETRY_ENDPOINT.
+    || "https://telemetry.greatcto.systems/v1/event";
+// Override anytime with GREAT_CTO_TELEMETRY_ENDPOINT (e.g. to point at a
+// workers.dev URL during local worker development).
 const TELEMETRY_TIMEOUT_MS = 1000;
 // Allowlist — anything else is dropped client-side and server-side.
 const ALLOWED_COMMANDS = new Set([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.77.2",
+  "version": "2.78.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",