great-cto 2.77.2 → 2.79.0

package/board/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "great_cto",
   "id": "great_cto",
   "description": "Engineering process for solo founders and teams up to 50 engineers. Agents do architecture, code review, QA, and security. You make two decisions per feature.",
-  "version": "2.77.2",
+  "version": "2.79.0",
   "author": {
     "name": "Great CTO",
     "url": "https://github.com/avelikiy/great_cto"

package/board/packages/board/lib/alerts.mjs

@@ -6,7 +6,7 @@ import {
   loadSubscriptions,
   removeSubscription,
 } from '../push-adapter.mjs';
-import { GREAT_CTO_DIR, PUSH_SUBS_FILE, VAPID_KEYS_FILE, VAPID_SUBJECT } from './config.mjs';
+import { GREAT_CTO_DIR, PUSH_SUBS_FILE, VAPID_KEYS_FILE, VAPID_SUBJECT, BUILD_VERSION } from './config.mjs';
 import { _reportRepublishDedupeSet } from './state.mjs';
 import { listProjects, readProjectMd } from './projects.mjs';
 import { addNotification } from './notifications.mjs';
@@ -16,6 +16,8 @@ import { getTasks } from './beads.mjs';
 import { readVerdicts } from './verdicts.mjs';
 import { isFailure } from './fleet.mjs';
 import { getShareState, toggleShare } from './share.mjs';
+import { checkForRelease, buildUpdatePayload } from './update-alert.mjs';
+import { log } from './log.mjs';
 
 // ── Email alerts (Resend) ─────────────────────────────────────────────────
 // Dispatch model: read webhooks.json on every fire (idempotent if disabled
@@ -91,12 +93,12 @@ async function fireEmailAlert(eventName, dedupeKey, payload) {
     });
     if (!res.ok) {
       const txt = await res.text().catch(() => '');
-      console.warn(`fireEmailAlert ${eventName}: relay HTTP ${res.status} ${txt.slice(0, 200)}`);
+      log.warn(`fireEmailAlert ${eventName}: relay HTTP ${res.status} ${txt.slice(0, 200)}`);
       return;
     }
-    console.log(`fireEmailAlert: sent ${eventName} (${dedupeKey})`);
+    log.info(`fireEmailAlert: sent ${eventName} (${dedupeKey})`);
   } catch (e) {
-    console.warn(`fireEmailAlert ${eventName} failed:`, e.message);
+    log.warn(`fireEmailAlert ${eventName} failed:`, e.message);
   }
 }
 
@@ -119,12 +121,12 @@ async function firePushAlert(eventName, dedupeKey, payload) {
       catch (e) {
         // 410 = subscription expired — browser unsubscribed, clean up
         if (e.statusCode === 410) removeSubscription(PUSH_SUBS_FILE, sub.endpoint);
-        else console.warn(`firePushAlert send failed for ${sub.endpoint}:`, e.message);
+        else log.warn(`firePushAlert send failed for ${sub.endpoint}:`, e.message);
       }
     }
     fired[pushKey] = new Date().toISOString();
     writeAlertsFired(fired);
-  } catch (e) { console.warn('firePushAlert failed:', e.message); }
+  } catch (e) { log.warn('firePushAlert failed:', e.message); }
 }
 
 // ── Cron: scan gates / cost / weekly digest ───────────────────────────────
@@ -133,6 +135,7 @@ async function firePushAlert(eventName, dedupeKey, payload) {
 function startAlertCron() {
   const FIVE_MIN = 5 * 60 * 1000;
   const ONE_HOUR = 60 * 60 * 1000;
+  const ONE_DAY = 24 * 60 * 60 * 1000;
 
   // incident.p0: open P0 task with recent activity (last 24h).
   // Older P0s are existing backlog — surfacing them via email is spam.
@@ -172,7 +175,7 @@ function startAlertCron() {
           firePushAlert('incident.p0', dedupeKey, p0Payload);
         }
       }
-    } catch (e) { console.warn('cron incident.p0 failed:', e.message); }
+    } catch (e) { log.warn('cron incident.p0 failed:', e.message); }
   }, FIVE_MIN);
 
   // gate.blocked: new BLOCKED verdict from security-officer
@@ -207,7 +210,7 @@ function startAlertCron() {
         addNotification('gate.blocked', blockedPayload);
         firePushAlert('gate.blocked', dedupeKey, blockedPayload);
       }
-    } catch (e) { console.warn('cron gate.blocked failed:', e.message); }
+    } catch (e) { log.warn('cron gate.blocked failed:', e.message); }
   }, FIVE_MIN);
 
   // gate.stale: gate task open between 2h and 7 days.
@@ -238,7 +241,7 @@ function startAlertCron() {
           firePushAlert('gate.stale', dedupeKey, stalePayload);
         }
       }
-    } catch (e) { console.warn('cron gate.stale failed:', e.message); }
+    } catch (e) { log.warn('cron gate.stale failed:', e.message); }
   }, FIVE_MIN);
 
   // cost.threshold: monthly LLM spend at 80% / 100% of budget
@@ -277,7 +280,7 @@ function startAlertCron() {
           firePushAlert('cost.threshold', dedupeKey, costPayload);
         }
       }
-    } catch (e) { console.warn('cron cost.threshold failed:', e.message); }
+    } catch (e) { log.warn('cron cost.threshold failed:', e.message); }
   }, ONE_HOUR);
 
   // digest.weekly: Friday 09:00 UTC ± server tick
@@ -317,7 +320,7 @@ function startAlertCron() {
         addNotification('digest.weekly', weeklyPayload);
         await firePushAlert('digest.weekly', dedupeKey, weeklyPayload);
       }
-    } catch (e) { console.warn('cron digest.weekly failed:', e.message); }
+    } catch (e) { log.warn('cron digest.weekly failed:', e.message); }
   }, FIVE_MIN);
 
   // digest.daily: morning summary (Mon–Fri, 08:00 UTC).
@@ -384,7 +387,7 @@ function startAlertCron() {
         addNotification('digest.daily', dailyPayload);
         await firePushAlert('digest.daily', dedupeKey, dailyPayload);
       }
-    } catch (e) { console.warn('cron digest.daily failed:', e.message); }
+    } catch (e) { log.warn('cron digest.daily failed:', e.message); }
   }, FIVE_MIN);
 
   // report.daily: republish share reports every day at 09:00 UTC
@@ -401,13 +404,32 @@ function startAlertCron() {
         if (_reportRepublishDedupeSet.has(dedupeKey)) continue;
         _reportRepublishDedupeSet.add(dedupeKey);
         toggleShare(true, proj.path, true)
-          .then(() => console.log(`report.daily: republished ${proj.slug}`))
-          .catch(e => console.warn(`report.daily: ${proj.slug} failed: ${e.message}`));
+          .then(() => log.info(`report.daily: republished ${proj.slug}`))
+          .catch(e => log.warn(`report.daily: ${proj.slug} failed: ${e.message}`));
       }
-    } catch (e) { console.warn('cron report.daily failed:', e.message); }
+    } catch (e) { log.warn('cron report.daily failed:', e.message); }
   }, FIVE_MIN);
 
-  console.log('Alert cron started: gate.stale (5min), sla.escalate (5min), connector.health (5min), cost.threshold (1h), digest.daily (Mon–Fri 08:00), digest.weekly (Fri 09:00), report.daily (09:00)');
+  // update.available: daily check for a newer great-cto npm release.
+  // Dedupe key embeds the latest version string (see update-alert.mjs), so a
+  // given release notifies exactly once no matter how many daily ticks pass
+  // while it remains latest — a fresh key is only minted when npm publishes
+  // a newer version. Fails silent offline; skipped entirely when
+  // GREAT_CTO_NO_UPDATE_CHECK=1 (checkForRelease honors the env var itself).
+  setInterval(() => {
+    checkForRelease({
+      currentVersion: BUILD_VERSION,
+      isFired: (dedupeKey) => Boolean(readAlertsFired()[dedupeKey]),
+      notify: (current, latest, dedupeKey) => {
+        const payload = buildUpdatePayload(current, latest);
+        fireEmailAlert('update.available', dedupeKey, payload);
+        addNotification('update.available', payload);
+        firePushAlert('update.available', dedupeKey, payload);
+      },
+    }).catch(e => log.warn('cron update.available failed:', e.message));
+  }, ONE_DAY);
+
+  log.info('Alert cron started: gate.stale (5min), sla.escalate (5min), connector.health (5min), cost.threshold (1h), digest.daily (Mon–Fri 08:00), digest.weekly (Fri 09:00), report.daily (09:00), update.available (24h)');
 }
 
 export { readAlertsFired, writeAlertsFired, fireEmailAlert, firePushAlert, startAlertCron };

package/board/packages/board/lib/beads.mjs

@@ -3,6 +3,7 @@ import path from 'path';
 import os from 'os';
 import { spawnSync } from 'child_process';
 import { bdCache } from './state.mjs';
+import { log } from './log.mjs';
 
 // ── Beads data ─────────────────────────────────────────────────────────────────
 // Cache bdList output per cwd for BD_CACHE_TTL_MS. Invalidated when the project's
@@ -85,7 +86,7 @@ function checkBeadsAvailable(cwd) {
 let _bdWriteChain = Promise.resolve();
 function bdWriteSerialised(fn) {
   const next = _bdWriteChain.then(() => fn()).catch((e) => {
-    console.error('[bd-write-serialised] error:', e?.message || e);
+    log.error('[bd-write-serialised]', e?.message || e);
     return null;
   });
   _bdWriteChain = next.then(() => undefined).catch(() => undefined);

package/board/packages/board/lib/log.mjs

@@ -0,0 +1,44 @@
+// Zero-dep structured logger for the great_cto board server.
+//
+// Design:
+//   - Levels: debug < info < warn < error. Threshold read once from
+//     GREAT_CTO_LOG_LEVEL (default 'info'); unrecognized values fall back to 'info'.
+//   - Output: single-line `<ISO timestamp> <LEVEL> <message>` per call.
+//   - Routing: error → stderr; debug/info/warn → stdout. This matches Unix
+//     convention (stdout = normal operation, stderr = attention-worthy) and
+//     keeps the board's stdout free of interleaved error noise.
+//   - No external deps, ESM only, node: prefix for built-ins.
+
+const LEVELS = { debug: 10, info: 20, warn: 30, error: 40 };
+
+function currentThreshold() {
+  const raw = (process.env.GREAT_CTO_LOG_LEVEL || 'info').toLowerCase();
+  return LEVELS[raw] ?? LEVELS.info;
+}
+
+function format(level, args) {
+  const ts = new Date().toISOString();
+  const msg = args
+    .map(a => (typeof a === 'string' ? a : a instanceof Error ? (a.stack || a.message) : JSON.stringify(a)))
+    .join(' ');
+  return `${ts} ${level.toUpperCase()} ${msg}`;
+}
+
+function emit(level, args) {
+  if (LEVELS[level] < currentThreshold()) return;
+  const line = format(level, args);
+  if (level === 'error') {
+    process.stderr.write(line + '\n');
+  } else {
+    process.stdout.write(line + '\n');
+  }
+}
+
+export const log = {
+  debug: (...args) => emit('debug', args),
+  info: (...args) => emit('info', args),
+  warn: (...args) => emit('warn', args),
+  error: (...args) => emit('error', args),
+};
+
+export default log;

package/board/packages/board/lib/projects.mjs

@@ -4,6 +4,20 @@ import os from 'os';
 import { spawnSync } from 'child_process';
 import { planGates } from '../../../scripts/lib/gate-plan.mjs';
 import { GREAT_CTO_DIR, PROJECTS_FILE } from './config.mjs';
+import { isInsideDir } from './util.mjs';
+
+// Same HOME-boundary policy /api/projects/register enforces (lib/routes.mjs):
+// a raw absolute/tilde path must resolve inside the operator's home directory,
+// no exceptions. Without this, a request like ?project=/etc or ?project=/tmp
+// makes the board read/write project data (.beads, verdicts/, PROJECT.md)
+// at an arbitrary filesystem location the operator never registered. Returns
+// null (not process.cwd()) so callers can distinguish "not a raw path" from
+// "raw path rejected" and fall back explicitly.
+function resolveRawPathWithinHome(slugOrPath) {
+  const raw = slugOrPath.startsWith('~') ? slugOrPath.replace(/^~/, os.homedir()) : slugOrPath;
+  const resolved = path.resolve(raw);
+  return isInsideDir(os.homedir(), resolved) ? resolved : null;
+}
 
 // ── Project registry ───────────────────────────────────────────────────────────
 function readProjectsRegistry() {
@@ -251,12 +265,19 @@ function listProjects() {
 }
 function resolveProjectCwd(slugOrPath) {
   if (!slugOrPath) return process.cwd();
-  // If absolute path or starts with ~, use directly
-  if (slugOrPath.startsWith('/')) return slugOrPath;
-  if (slugOrPath.startsWith('~')) return slugOrPath.replace(/^~/, os.homedir());
+  // If absolute path or starts with ~, it's raw user input — enforce the same
+  // HOME-boundary policy /api/projects/register uses. A path outside HOME
+  // falls back to process.cwd() (same fallback already used below for an
+  // unknown slug) rather than being honored verbatim.
+  if (slugOrPath.startsWith('/') || slugOrPath.startsWith('~')) {
+    const withinHome = resolveRawPathWithinHome(slugOrPath);
+    return withinHome || process.cwd();
+  }
   // Else look up in registry by slug — among duplicate slugs (great_cto-7xfc),
   // prefer the entry whose path exists on disk; among several existing (or
-  // several missing), prefer the most recently added_at.
+  // several missing), prefer the most recently added_at. Registry entries were
+  // already validated at registration time (register enforces the HOME
+  // boundary before writing), so slug resolution is untouched.
   const reg = readProjectsRegistry();
   const matches = reg.projects.filter(p => p.slug === slugOrPath);
   const found = pickBestBySlug(matches);
@@ -271,16 +292,18 @@ function resolveProjectCwd(slugOrPath) {
  *
  * resolved values:
  *   'cwd'      — no project param passed; using server cwd as documented
- *   'path'     — absolute / tilde path passed and used directly
+ *   'path'     — absolute / tilde path passed, resolved inside HOME, used directly
  *   'slug'     — slug found in registry
- *   'fallback' — slug requested but NOT in registry; using cwd as fallback.
- *                Caller should warn the user (header + log).
+ *   'fallback' — slug requested but NOT in registry, OR a raw path was requested
+ *                that resolves outside HOME (great_cto-qvg9); using cwd as
+ *                fallback. Caller should warn the user (header + log).
  */
 function resolveProjectInfo(slugOrPath) {
   if (!slugOrPath) return { cwd: process.cwd(), resolved: 'cwd' };
-  if (slugOrPath.startsWith('/')) return { cwd: slugOrPath, resolved: 'path' };
-  if (slugOrPath.startsWith('~')) {
-    return { cwd: slugOrPath.replace(/^~/, os.homedir()), resolved: 'path' };
+  if (slugOrPath.startsWith('/') || slugOrPath.startsWith('~')) {
+    const withinHome = resolveRawPathWithinHome(slugOrPath);
+    if (withinHome) return { cwd: withinHome, resolved: 'path' };
+    return { cwd: process.cwd(), resolved: 'fallback', requested: slugOrPath };
   }
   const reg = readProjectsRegistry();
   const matches = reg.projects.filter(p => p.slug === slugOrPath);

package/board/packages/board/lib/routes.mjs

@@ -6,13 +6,14 @@ import {
   addSubscription,
   removeSubscription,
 } from '../push-adapter.mjs';
-import { PORT, GREAT_CTO_DIR, VAPID_KEYS_FILE, PUSH_SUBS_FILE, BUILD_VERSION } from './config.mjs';
-import { eventSurface, readFileSafe } from './util.mjs';
+import { GREAT_CTO_DIR, VAPID_KEYS_FILE, PUSH_SUBS_FILE, BUILD_VERSION } from './config.mjs';
+import { eventSurface, readFileSafe, originAllowed } from './util.mjs';
 import { sseClients, notifHistory } from './state.mjs';
 import { autoRegisterProject, listProjects, resolveProjectCwd, getChangeTier } from './projects.mjs';
 import { broadcastTasks } from './sse.mjs';
 import { saveNotifHistory } from './notifications.mjs';
 import { getMemory, getPipeline, getCostHistory, getInbox } from './data-readers.mjs';
+import { log } from './log.mjs';
 import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks } from './beads.mjs';
 import { getMetrics } from './metrics.mjs';
 import { readVerdicts } from './verdicts.mjs';
@@ -54,18 +55,12 @@ async function dispatch(req, res, url, cwd) {
   // it MUST reject cross-origin requests. The board listens on 127.0.0.1
   // but a malicious page the user visits can still issue text/plain POSTs
   // (simple CORS request — no preflight) to localhost. Two gates:
-  //   1) Origin / Referer must match http://localhost:PORT or 127.0.0.1:PORT.
+  //   1) Origin / Referer must be same-origin (originAllowed() in lib/util.mjs —
+  //      also enforced as the top-level CSRF guard in server.mjs before dispatch()
+  //      is ever called, so this is defense-in-depth, not the only check).
   //   2) Resolved target path must live inside HOME — no /tmp, no /etc.
   if (pathname === '/api/projects/register' && req.method === 'POST') {
-    const origin = req.headers.origin || req.headers.referer || '';
-    const expectedOrigin = `http://localhost:${PORT}`;
-    const expectedOrigin2 = `http://127.0.0.1:${PORT}`;
-    const originOk = !origin
-      || origin === expectedOrigin
-      || origin === expectedOrigin2
-      || origin.startsWith(expectedOrigin + '/')
-      || origin.startsWith(expectedOrigin2 + '/');
-    if (!originOk) {
+    if (!originAllowed(req)) {
       res.writeHead(403, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'origin not allowed' }));
       return true;
@@ -384,8 +379,8 @@ async function dispatch(req, res, url, cwd) {
         const shareState = getShareState(gateCwd);
         if (shareState.enabled) {
           toggleShare(true, gateCwd, true)
-            .then(() => console.log(`report: auto-republished after gate approve (${id})`))
-            .catch(e => console.warn(`report: republish after gate failed: ${e.message}`));
+            .then(() => log.info(`report: auto-republished after gate approve (${id})`))
+            .catch(e => log.warn(`report: republish after gate failed: ${e.message}`));
         }
       }
     });
@@ -850,16 +845,10 @@ async function dispatch(req, res, url, cwd) {
   // (DESIGN-agents-fleet-view §9 Top-2 #2: reversible sidecar chosen over
   // filesystem move; founder may revise.)
   if (pathname.startsWith('/api/agents/') && req.method === 'POST') {
-    // Cross-origin guard — same pattern as BH-23 on /api/projects/register.
-    const origin = req.headers.origin || req.headers.referer || '';
-    const expectedOrigin = `http://localhost:${PORT}`;
-    const expectedOrigin2 = `http://127.0.0.1:${PORT}`;
-    const originOk = !origin
-      || origin === expectedOrigin
-      || origin === expectedOrigin2
-      || origin.startsWith(expectedOrigin + '/')
-      || origin.startsWith(expectedOrigin2 + '/');
-    if (!originOk) {
+    // Cross-origin guard — same helper as BH-23 on /api/projects/register
+    // (originAllowed() in lib/util.mjs; also enforced as the top-level CSRF
+    // guard in server.mjs before dispatch() is ever called).
+    if (!originAllowed(req)) {
       res.writeHead(403, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify({ error: 'origin_not_allowed' }));
       return true;

package/board/packages/board/lib/update-alert.mjs

@@ -0,0 +1,107 @@
+// Release notification — daily check for a newer great-cto npm release,
+// surfaced through the board's existing notification + push-alert pipeline.
+//
+// Design mirrors the CLI's update-check.ts (same registry endpoint, same
+// zero-dependency approach) but fires through addNotification()/firePushAlert()
+// instead of a stderr hint, since the board is a long-running server, not a
+// one-shot CLI invocation.
+//
+// Registry endpoint: https://registry.npmjs.org/-/package/great-cto/dist-tags
+//   Verified with curl to return only `{"latest":"x.y.z"}`.
+//
+// Dedupe: alerts-fired.json (existing mechanism in alerts.mjs) is keyed by
+// dedupeKey; the key here embeds the latest version string so each new
+// release notifies exactly once, no matter how many daily ticks pass while
+// that version remains the latest.
+//
+// Opt-out: GREAT_CTO_NO_UPDATE_CHECK=1 (same env var as the CLI hint).
+
+const REGISTRY_DIST_TAGS_URL = 'https://registry.npmjs.org/-/package/great-cto/dist-tags';
+const FETCH_TIMEOUT_MS = 3000;
+
+/** Pure function: parse "x.y.z" into a 3-tuple of ints (missing/garbage segments -> 0). */
+function parseSemver(v) {
+  return String(v || '').split('.').map(n => parseInt(n, 10) || 0);
+}
+
+/** Pure function: true when `latest` is strictly newer than `current` (semver order). */
+function isNewerVersion(current, latest) {
+  if (!current || !latest || current === 'unknown') return false;
+  const a = parseSemver(latest);
+  const b = parseSemver(current);
+  for (let i = 0; i < 3; i++) {
+    const d = (a[i] ?? 0) - (b[i] ?? 0);
+    if (d !== 0) return d > 0;
+  }
+  return false;
+}
+
+/** Pure function: the dedupe key for a given latest version — one notification per new release, ever. */
+function updateDedupeKey(latest) {
+  return `update.available:${latest}`;
+}
+
+/** Pure function: build the notification payload for a given current/latest pair. */
+function buildUpdatePayload(current, latest) {
+  return {
+    title: `great_cto v${latest} released (you run v${current})`,
+    body: `A new great-cto release is available. Upgrade with: npx great-cto upgrade`,
+    level: 'info',
+    project: 'great_cto',
+    link: 'https://github.com/avelikiy/great_cto/releases',
+    action: 'View release',
+    kv: { current, latest },
+  };
+}
+
+/** Fetch {latest} from the npm registry. Returns null on any error/timeout/offline — fail-silent by design. */
+async function fetchLatestVersion(fetchFn = fetch) {
+  try {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), FETCH_TIMEOUT_MS);
+    try {
+      const res = await fetchFn(REGISTRY_DIST_TAGS_URL, { signal: ctrl.signal });
+      if (!res.ok) return null;
+      const body = await res.json();
+      return typeof body?.latest === 'string' ? body.latest : null;
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Run one update check. Injectable deps for testing — no real network calls
+ * or fs/notification side effects when `fetchFn`/`isFired`/`notify` are stubs.
+ *
+ * @param {object} opts
+ * @param {string} opts.currentVersion   BUILD_VERSION from lib/config.mjs
+ * @param {(url: string, init?: object) => Promise<Response>} [opts.fetchFn]
+ * @param {(dedupeKey: string) => boolean} [opts.isFired]   dedupe lookup (alerts-fired.json)
+ * @param {(current: string, latest: string, dedupeKey: string) => void} [opts.notify]
+ *   called once when a newer, undelivered version is found
+ * @returns {Promise<{checked: boolean, latest: string|null, notified: boolean}>}
+ */
+async function checkForRelease({ currentVersion, fetchFn = fetch, isFired = () => false, notify = () => {} }) {
+  if (process.env.GREAT_CTO_NO_UPDATE_CHECK === '1') {
+    return { checked: false, latest: null, notified: false };
+  }
+  const latest = await fetchLatestVersion(fetchFn);
+  if (!latest) return { checked: true, latest: null, notified: false };
+  if (!isNewerVersion(currentVersion, latest)) return { checked: true, latest, notified: false };
+  const dedupeKey = updateDedupeKey(latest);
+  if (isFired(dedupeKey)) return { checked: true, latest, notified: false };
+  notify(currentVersion, latest, dedupeKey);
+  return { checked: true, latest, notified: true };
+}
+
+export {
+  REGISTRY_DIST_TAGS_URL,
+  isNewerVersion,
+  updateDedupeKey,
+  buildUpdatePayload,
+  fetchLatestVersion,
+  checkForRelease,
+};

package/board/packages/board/lib/util.mjs

@@ -1,4 +1,5 @@
 import fs from 'fs';
+import path from 'path';
 import { PORT } from './config.mjs';
 
 /**
@@ -33,4 +34,16 @@ function readFileSafe(p) {
   try { return fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null; } catch { return null; }
 }
 
-export { csvCell, originAllowed, eventSurface, readFileSafe };
+// Path-containment check used by any handler that joins user-controlled input
+// onto a base directory (static file serving, doc reads, etc.). Resolves both
+// sides and requires `target` to be exactly `base`, or a real descendant of
+// it (base + path.sep prefix) — this is what actually blocks ".." escapes,
+// since a naive startsWith(base) would wrongly allow a sibling directory
+// like "/public-evil" when base is "/public".
+function isInsideDir(base, target) {
+  const resolvedBase = path.resolve(base);
+  const resolvedTarget = path.resolve(target);
+  return resolvedTarget === resolvedBase || resolvedTarget.startsWith(resolvedBase + path.sep);
+}
+
+export { csvCell, originAllowed, eventSurface, readFileSafe, isInsideDir };

package/board/packages/board/server.mjs

@@ -13,11 +13,12 @@ import fs from 'fs';
 import path from 'path';
 import { spawnSync } from 'child_process';
 import { PORT, PUBLIC, HOST } from './lib/config.mjs';
-import { originAllowed } from './lib/util.mjs';
+import { originAllowed, isInsideDir } from './lib/util.mjs';
 import { discoverProjects, resolveProjectInfo } from './lib/projects.mjs';
 import { startAlertCron } from './lib/alerts.mjs';
 import { watchBeads, watchVerdicts } from './lib/watchers.mjs';
 import { dispatch } from './lib/routes.mjs';
+import { log } from './lib/log.mjs';
 
 // ── Helpers ────────────────────────────────────────────────────────────────────
 
@@ -77,7 +78,13 @@ const server = http.createServer(async (req, res) => {
   // Static files
   let filePath = pathname === '/' ? '/index.html' : pathname;
   const fullPath = path.join(PUBLIC, filePath);
-  if (fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
+  // Path-traversal guard (mirrors the /api/doc containment check in lib/routes.mjs):
+  // the joined path must resolve to somewhere inside PUBLIC. Without this, a decoded
+  // pathname like /..%2F..%2Fetc%2Fpasswd can escape the public/ directory via
+  // path.join's ".." collapsing. Reject with 404 (same as the generic static 404
+  // below) so a traversal attempt is indistinguishable from a missing file — no
+  // signal to a prober about what exists outside PUBLIC.
+  if (isInsideDir(PUBLIC, fullPath) && fs.existsSync(fullPath) && fs.statSync(fullPath).isFile()) {
     const ext = path.extname(fullPath);
     const mime = { '.html': 'text/html', '.css': 'text/css', '.js': 'text/javascript', '.svg': 'image/svg+xml' };
     // HTML must never cache — board UI is iterated daily and stale layouts
@@ -102,15 +109,15 @@ const server = http.createServer(async (req, res) => {
 
 // ── Start ──────────────────────────────────────────────────────────────────────
 server.listen(PORT, HOST, () => {
-  console.log(`great_cto board → http://${HOST === '0.0.0.0' ? 'localhost' : HOST}:${PORT}`);
+  log.info(`great_cto board → http://${HOST === '0.0.0.0' ? 'localhost' : HOST}:${PORT}`);
   if (HOST !== '127.0.0.1' && HOST !== 'localhost') {
-    console.log(`  ⚠ bound to ${HOST} — reachable beyond this machine. Operators authenticate via invite`);
-    console.log(`    links; put your reverse-proxy auth in front for anything admin-grade.`);
+    log.info(`  ⚠ bound to ${HOST} — reachable beyond this machine. Operators authenticate via invite`);
+    log.info(`    links; put your reverse-proxy auth in front for anything admin-grade.`);
   }
   // Discover all great_cto projects on disk asynchronously — don't block
   // the listening event so /api/tasks is available immediately.
   discoverProjects().then(n => {
-    if (n > 0) console.log(`  → discovered ${n} project${n === 1 ? '' : 's'} with .great_cto/PROJECT.md`);
+    if (n > 0) log.info(`  → discovered ${n} project${n === 1 ? '' : 's'} with .great_cto/PROJECT.md`);
   }).catch(() => {}); // non-fatal
   watchBeads();
   startAlertCron();
@@ -125,9 +132,9 @@ server.listen(PORT, HOST, () => {
 
 server.on('error', e => {
   if (e.code === 'EADDRINUSE') {
-    console.log(`Port ${PORT} in use — board already running at http://localhost:${PORT}`);
+    log.info(`Port ${PORT} in use — board already running at http://localhost:${PORT}`);
   } else {
-    console.error(e);
+    log.error(e);
   }
   process.exit(0);
 });

package/dist/main.js

@@ -21,6 +21,7 @@ import { bootstrap } from "./bootstrap.js";
 import { compileFlow } from "./flow.js";
 import { shouldUseLlmFallback, suggestArchetypeFromLlm } from "./llm-fallback.js";
 import { sendUsagePing, sendInstallPing, telemetrySubcommand, isTelemetryEnabled, computeAnonId } from "./telemetry.js";
+import { checkForUpdate } from "./update-check.js";
 import { findBoardServerPath } from "./board-path.js";
 import { readFileSync, writeFileSync, copyFileSync, chmodSync, mkdirSync, unlinkSync, existsSync as fsExistsSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -1047,6 +1048,14 @@ async function main() {
             });
         }
         catch { /* telemetry never affects the exit */ }
+        // Update hint — printed after the command's own output, never blocks on
+        // network (reads a local cache; spawns a detached refresh if stale).
+        // Excluded automatically for mcp/worker/task via PROTOCOL_SENSITIVE_COMMANDS
+        // inside checkForUpdate — worker/task don't even route through finish().
+        try {
+            checkForUpdate({ currentVersion: getCliVersion(), command: args.command });
+        }
+        catch { /* update hint never affects the exit */ }
         process.exit(code);
     };
     // `great-cto telemetry <on|off|status|whoami>` — inspect / toggle, never sends.

package/dist/telemetry.js

@@ -27,9 +27,9 @@ import * as path from "node:path";
 import * as os from "node:os";
 import * as crypto from "node:crypto";
 const TELEMETRY_ENDPOINT = process.env.GREAT_CTO_TELEMETRY_ENDPOINT
-    || "https://great-cto-telemetry.alexander-velikiy.workers.dev/v1/event";
-// Note: workers.dev URL is the temporary default until telemetry.greatcto.systems
-// custom domain is bound. Override anytime with GREAT_CTO_TELEMETRY_ENDPOINT.
+    || "https://telemetry.greatcto.systems/v1/event";
+// Override anytime with GREAT_CTO_TELEMETRY_ENDPOINT (e.g. to point at a
+// workers.dev URL during local worker development).
 const TELEMETRY_TIMEOUT_MS = 1000;
 // Allowlist — anything else is dropped client-side and server-side.
 const ALLOWED_COMMANDS = new Set([

package/dist/update-check-worker.js

@@ -0,0 +1,6 @@
+// Standalone entry point for the detached background update-check process.
+// Spawned by update-check.ts (spawnBackgroundCheck) via `node dist/update-check-worker.js`.
+// Deliberately tiny: just calls refreshCache() and exits. stdio is "ignore"
+// from the parent, so nothing here should assume a console is attached.
+import { refreshCache } from "./update-check.js";
+await refreshCache();

package/dist/update-check.js

@@ -0,0 +1,193 @@
+// Update notifier — classic update-notifier pattern, zero dependency.
+//
+// Design:
+//   - Foreground NEVER waits on the network. It only reads a local cache
+//     file (~/.great_cto/update-check.json) written by a previous run.
+//   - When the cache is missing or stale (>24h), a DETACHED background
+//     process is spawned (node, stdio ignored, unref'd) that hits the npm
+//     registry and refreshes the cache for the *next* invocation to read.
+//   - This means the very first run (and the first run after 24h) never
+//     shows a hint — the hint appears one run later, once the cache is
+//     warm. That's the standard update-notifier trade-off: never block,
+//     never slow down the command the user actually asked for.
+//
+// Registry endpoint: https://registry.npmjs.org/-/package/great-cto/dist-tags
+//   Verified with curl to return only `{"latest":"x.y.z"}` — much smaller
+//   than the full package document (https://registry.npmjs.org/great-cto),
+//   which would pull the entire versions/times history.
+//
+// Privacy: read-only GET against the public npm registry, equivalent to the
+// request `npm install` already performs. No project data, no PII, nothing
+// user-specific is sent. See docs/PRIVACY.md.
+//
+// Opt-out: GREAT_CTO_NO_UPDATE_CHECK=1 (checked by both the foreground read
+// and the background refresh entry point).
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { semverDescending } from "./semver.js";
+export const REGISTRY_DIST_TAGS_URL = "https://registry.npmjs.org/-/package/great-cto/dist-tags";
+export const CACHE_FRESH_MS = 24 * 60 * 60 * 1000; // 24h
+export const PACKAGE_NAME = "great-cto";
+/** Commands where stdout/stderr are machine-parsed — never print a hint, never spawn a check. */
+export const PROTOCOL_SENSITIVE_COMMANDS = new Set([
+    "mcp", // stdio JSON-RPC protocol — any stray byte on stdout/stderr breaks the client
+    "worker", // long-running daemon; status is polled programmatically
+    "task", // machine-invoked task runner (spawned by worker)
+]);
+function defaultCachePath() {
+    return join(homedir(), ".great_cto", "update-check.json");
+}
+/** Resolve the cache file path — GREAT_CTO_HOME lets tests/worker isolate state, same convention as worker.ts/task-queue.ts. */
+export function cachePath() {
+    const base = process.env.GREAT_CTO_HOME || join(homedir(), ".great_cto");
+    return join(base, "update-check.json");
+}
+/** Pure function: is a suppression condition active? Fail-open to "suppressed" on any ambiguity. */
+export function isSuppressed(opts = {}) {
+    const env = opts.env ?? process.env;
+    if (env.CI != null && env.CI !== "" && env.CI !== "0" && env.CI !== "false")
+        return true;
+    if (env.GREAT_CTO_NO_UPDATE_CHECK === "1")
+        return true;
+    if (opts.command && PROTOCOL_SENSITIVE_COMMANDS.has(opts.command))
+        return true;
+    if (opts.stderrIsTTY === false)
+        return true;
+    return false;
+}
+/** Pure function: read + parse cache JSON. Returns null on any error (missing/corrupt). */
+export function readCache(readFileFn = (p) => readFileSync(p, "utf8"), path = cachePath()) {
+    try {
+        const raw = readFileFn(path);
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.checkedAt !== "string" || typeof parsed.latest !== "string")
+            return null;
+        return { checkedAt: parsed.checkedAt, latest: parsed.latest };
+    }
+    catch {
+        return null;
+    }
+}
+/** Pure function: is a cache entry still fresh (<24h old)? */
+export function isCacheFresh(cache, now = Date.now(), freshMs = CACHE_FRESH_MS) {
+    if (!cache)
+        return false;
+    const checkedAtMs = Date.parse(cache.checkedAt);
+    if (Number.isNaN(checkedAtMs))
+        return false;
+    return now - checkedAtMs < freshMs;
+}
+/** Pure function: does `latest` represent a newer version than `current`? */
+export function isNewerVersion(current, latest) {
+    if (!current || !latest || current === "unknown")
+        return false;
+    // semverDescending(a, b) < 0 means a > b (descending sort). latest > current => descending(latest, current) < 0.
+    return semverDescending(latest, current) < 0;
+}
+/** Pure function: build the one-line stderr hint text. `styler` lets callers inject color helpers (matches ui.ts). */
+export function formatHint(current, latest, styler = {
+    cyan: (s) => s,
+    dim: (s) => s,
+    bold: (s) => s,
+}) {
+    return `${styler.dim("update available:")} ${styler.dim(current)} ${styler.dim("→")} ${styler.bold(styler.cyan(latest))}  ${styler.dim(`run ${styler.cyan("npm i -g great-cto")} to upgrade`)}`;
+}
+/**
+ * Foreground entry point. Call once per CLI invocation, after the command's
+ * normal output has been printed. Never throws, never awaits network I/O.
+ *
+ * - If suppressed: no-op.
+ * - If cache is fresh: print hint (if newer) synchronously, no spawn.
+ * - If cache is missing/stale: spawn a detached background refresh and
+ *   return immediately (no hint this run — the cache isn't warm yet).
+ */
+export function checkForUpdate(opts) {
+    try {
+        const env = opts.env ?? process.env;
+        const stderrIsTTY = opts.stderrIsTTY ?? Boolean(process.stderr.isTTY);
+        if (isSuppressed({ env, command: opts.command, stderrIsTTY }))
+            return;
+        const cache = readCache();
+        if (isCacheFresh(cache, opts.now)) {
+            if (cache && isNewerVersion(opts.currentVersion, cache.latest)) {
+                printHint(opts.currentVersion, cache.latest);
+            }
+            return;
+        }
+        spawnBackgroundCheck();
+    }
+    catch {
+        // Fail-silent — an update hint must never break or slow down a real command.
+    }
+}
+function printHint(current, latest) {
+    try {
+        // Local, minimal color helpers mirroring ui.ts's NO_COLOR-aware wrap(),
+        // but gated on stderr TTY (ui.ts gates on stdout, which is the wrong
+        // stream for a hint that must print to stderr).
+        const useColor = Boolean(process.stderr.isTTY) && process.env.NO_COLOR !== "1";
+        const wrap = (code) => (s) => (useColor ? `\x1b[${code}m${s}\x1b[0m` : s);
+        const styler = { cyan: wrap("36"), dim: wrap("2"), bold: wrap("1") };
+        process.stderr.write(formatHint(current, latest, styler) + "\n");
+    }
+    catch {
+        /* fail-silent */
+    }
+}
+/** Spawn a detached, unref'd background process that refreshes the cache. Never awaited by the caller. */
+function spawnBackgroundCheck() {
+    try {
+        // Test-only escape hatch: unit tests exercise checkForUpdate()'s control
+        // flow (including "cache missing/stale -> spawn") without ever launching
+        // a real child process or touching the network. Never set in production.
+        if (process.env.GREAT_CTO_UPDATE_CHECK_NO_SPAWN === "1")
+            return;
+        const here = dirname(fileURLToPath(import.meta.url));
+        const entry = join(here, "update-check-worker.js");
+        if (!existsSync(entry))
+            return; // dist not built (e.g. running from src in dev) — skip rather than crash
+        const child = spawn(process.execPath, [entry], {
+            detached: true,
+            stdio: "ignore",
+            env: process.env,
+        });
+        child.unref();
+    }
+    catch {
+        /* fail-silent — network/update check is best-effort only */
+    }
+}
+/**
+ * Background worker body — invoked as a standalone script by
+ * update-check-worker.ts. Fetches the registry dist-tags and writes the
+ * cache. Exported so it's independently unit-testable with an injected
+ * fetcher, without needing to actually spawn a child process.
+ */
+export async function refreshCache(fetchFn = fetch, writeFileFn = writeFileSync, mkdirFn = (p) => mkdirSync(p, { recursive: true }), path = cachePath()) {
+    try {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), 3000);
+        let latest;
+        try {
+            const res = await fetchFn(REGISTRY_DIST_TAGS_URL, { signal: ctrl.signal });
+            if (res.ok) {
+                const body = (await res.json());
+                latest = body.latest;
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (!latest)
+            return;
+        mkdirFn(dirname(path));
+        const cache = { checkedAt: new Date().toISOString(), latest };
+        writeFileFn(path, JSON.stringify(cache, null, 2) + "\n");
+    }
+    catch {
+        /* offline / registry unreachable — fail-silent, next invocation retries */
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.77.2",
+  "version": "2.79.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",