great-cto 2.82.1 → 2.82.3

package/board/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "great_cto",
   "id": "great_cto",
   "description": "Engineering process for solo founders and teams up to 50 engineers. Agents do architecture, code review, QA, and security. You make two decisions per feature.",
-  "version": "2.82.1",
+  "version": "2.82.3",
   "author": {
     "name": "Great CTO",
     "url": "https://github.com/avelikiy/great_cto"

package/board/packages/board/lib/alerts.mjs

@@ -171,7 +171,7 @@ function startAlertCron() {
             },
           };
           fireEmailAlert('incident.p0', dedupeKey, p0Payload);
-          addNotification('incident.p0', p0Payload);
+          addNotification('incident.p0', p0Payload, dedupeKey);
           firePushAlert('incident.p0', dedupeKey, p0Payload);
         }
       }
@@ -207,7 +207,7 @@ function startAlertCron() {
           },
         };
         fireEmailAlert('gate.blocked', dedupeKey, blockedPayload);
-        addNotification('gate.blocked', blockedPayload);
+        addNotification('gate.blocked', blockedPayload, dedupeKey);
         firePushAlert('gate.blocked', dedupeKey, blockedPayload);
       }
     } catch (e) { log.warn('cron gate.blocked failed:', e.message); }
@@ -237,7 +237,7 @@ function startAlertCron() {
             kv: { gate: g.id, agent: g.agent || 'unknown', age: `${ageHr.toFixed(1)}h` },
           };
           fireEmailAlert('gate.stale', dedupeKey, stalePayload);
-          addNotification('gate.stale', stalePayload);
+          addNotification('gate.stale', stalePayload, dedupeKey);
           firePushAlert('gate.stale', dedupeKey, stalePayload);
         }
       }
@@ -276,7 +276,7 @@ function startAlertCron() {
             },
           };
           fireEmailAlert('cost.threshold', dedupeKey, costPayload);
-          addNotification('cost.threshold', costPayload);
+          addNotification('cost.threshold', costPayload, dedupeKey);
           firePushAlert('cost.threshold', dedupeKey, costPayload);
         }
       }
@@ -317,7 +317,7 @@ function startAlertCron() {
           },
         };
         await fireEmailAlert('digest.weekly', dedupeKey, weeklyPayload);
-        addNotification('digest.weekly', weeklyPayload);
+        addNotification('digest.weekly', weeklyPayload, dedupeKey);
         await firePushAlert('digest.weekly', dedupeKey, weeklyPayload);
       }
     } catch (e) { log.warn('cron digest.weekly failed:', e.message); }
@@ -384,7 +384,7 @@ function startAlertCron() {
           kv: kvObj,
         };
         await fireEmailAlert('digest.daily', dedupeKey, dailyPayload);
-        addNotification('digest.daily', dailyPayload);
+        addNotification('digest.daily', dailyPayload, dedupeKey);
         await firePushAlert('digest.daily', dedupeKey, dailyPayload);
       }
     } catch (e) { log.warn('cron digest.daily failed:', e.message); }
@@ -423,7 +423,7 @@ function startAlertCron() {
       notify: (current, latest, dedupeKey) => {
         const payload = buildUpdatePayload(current, latest);
         fireEmailAlert('update.available', dedupeKey, payload);
-        addNotification('update.available', payload);
+        addNotification('update.available', payload, dedupeKey);
         firePushAlert('update.available', dedupeKey, payload);
       },
     }).catch(e => log.warn('cron update.available failed:', e.message));

package/board/packages/board/lib/config.mjs

@@ -29,7 +29,7 @@ const PROJECTS_FILE = process.env.GREAT_CTO_PROJECTS_FILE || path.join(GREAT_CTO
 const SHARE_ENDPOINT = 'https://greatcto.systems/r/';
 const VAPID_KEYS_FILE = path.join(GREAT_CTO_DIR, 'vapid-keys.json');
 const PUSH_SUBS_FILE = path.join(GREAT_CTO_DIR, 'push-subscriptions.json');
-const NOTIF_HISTORY_FILE = path.join(GREAT_CTO_DIR, 'notif-history.json');
+const NOTIF_HISTORY_FILE = process.env.GREAT_CTO_NOTIF_HISTORY_FILE || path.join(GREAT_CTO_DIR, 'notif-history.json');
 const VAPID_SUBJECT = 'mailto:hi@updates.greatcto.systems';
 
 export {

package/board/packages/board/lib/notifications.mjs

@@ -25,7 +25,15 @@ function saveNotifHistory() {
  * Record a notification, broadcast via SSE, and persist.
  * Called alongside fireEmailAlert / firePushAlert at every trigger point.
  */
-function addNotification(event, payload) {
+function addNotification(event, payload, dedupeKey = null) {
+  // Idempotent per dedupeKey: the alert crons tick every 5 min and a persistent
+  // condition (open P0, blocked/stale gate, cost over threshold, the daily
+  // digest during its whole UTC hour) would otherwise add a fresh in-app
+  // notification on every tick — spamming the bell. Email/push already dedupe
+  // via alerts-fired.json; this makes the in-app notification dedupe the same.
+  if (dedupeKey && notifHistory.some(n => n.dedupeKey === dedupeKey)) {
+    return null;
+  }
   const notif = {
     id: crypto.randomUUID(),
     event,
@@ -36,6 +44,7 @@ function addNotification(event, payload) {
     project: payload.project || '',
     ts: new Date().toISOString(),
     read: false,
+    ...(dedupeKey ? { dedupeKey } : {}),
   };
   notifHistory.unshift(notif);
   if (notifHistory.length > MAX_NOTIF_HISTORY) notifHistory.length = MAX_NOTIF_HISTORY;

package/board/packages/board/public/index.html

@@ -4039,14 +4039,18 @@ function renderDashboard(m) {
   const avgMin = m.avg_completion_min ?? 0;
   const cycleStat = m.cycle_time_stat === 'median_30d' ? 'Median cycle (30d)' : 'Avg cycle time';
 
-  // Honest cost model (matches share report):
-  // AI spend  = real LLM tokens from verdicts (preferred), else time-based estimate
-  // Human est = done × 4h per feature × $150/hr (industry baseline)
-  // Savings   = humanEst / aiSpend (trustworthy when AI = real tokens, independent of human rate)
+  // Honest cost model — the backend is the source of truth:
+  //   cost.savings_x  = MEASURED savings, only set when real verdict cost data
+  //                     exists. NULL for the time-based (tasks) estimate, because
+  //                     that ratio is just the hardcoded rate ratio, not a real
+  //                     measurement — showing it would fabricate a number.
+  //   cost.human_usd  = the backend's conservative human-cost estimate.
+  // The frontend must NOT recompute its own human/savings figures (that produced
+  // an inflated "×" that contradicted the API); it displays the backend fields.
   const aiSpend = realLlmUsd > 0 ? realLlmUsd : llmUsd;
-  const humanEst = done * 4 * 150;
-  const savingsX = (aiSpend > 0 && humanEst > 0)
-    ? Math.round(humanEst / aiSpend)
+  const humanEst = m.cost?.human_usd ?? 0;
+  const savingsX = (typeof planSavingsX === 'number' && planSavingsX > 1)
+    ? planSavingsX
     : null;
 
   const llmTrend = realLlmUsd > 0
@@ -4067,28 +4071,21 @@ function renderDashboard(m) {
           v: savingsX.toLocaleString(),
           sub: '×',
           label: 'Cost savings vs FTE',
-          trend: `human est. $${humanEst.toLocaleString()} (${done}× 4h × $150)`,
+          trend: humanEst > 0 ? `measured · human est. $${fmtMoney(humanEst)}` : 'measured savings',
           cls: 'green',
         }
       : {
+          // No MEASURED savings yet (no verdict cost data). Don't fabricate a
+          // multiplier from the time-based estimate — show it's not measured.
           v: '—',
           sub: '',
           label: 'Cost savings vs FTE',
-          trend: done > 0 ? 'no spend recorded yet' : 'no tasks done yet',
+          trend: aiSpend > 0
+            ? 'estimate only · run pipelines for measured savings'
+            : (done > 0 ? 'no spend recorded yet' : 'no tasks done yet'),
           cls: '',
         },
   ];
-
-  // Prefer planSavingsX when available (from PLAN-*.md) — explicit override
-  if (planSavingsX != null && planSavingsX > 0) {
-    hero[2] = {
-      v: planSavingsX,
-      sub: '×',
-      label: 'Cost savings vs FTE',
-      trend: `from PLAN-*.md figures`,
-      cls: 'green',
-    };
-  }
   document.getElementById('mp-hero').innerHTML = hero.map(s => `
     <div class="metric-card ${s.cls || ''}">
       <div class="metric-num">${s.v}${s.sub ? `<small>${s.sub}</small>` : ''}</div>

package/board/packages/cli/dist/archetypes.js

@@ -310,6 +310,22 @@ const RULES = [
                 s += 9;
             if (d.readmeKeywords.includes("fintech"))
                 s += 2;
+            // tax-prep signals — keep in sync with detect.ts tax-pack terms.
+            // Unambiguous regulatory/professional-standard terms get a strong
+            // bump; softer generic terms (irs/e-file/tax-prep) get a light one
+            // since they can appear in unrelated fixtures.
+            const kws = d.readmeKeywords;
+            const taxStrong = ["ptin", "circular-230", "form-8879", "mef",
+                "pub-4557", "section-7216"];
+            const taxSoft = ["irs", "e-file", "tax-prep", "tax-preparation"];
+            const taxStrongCount = taxStrong.filter((k) => kws.includes(k)).length;
+            const taxSoftCount = taxSoft.filter((k) => kws.includes(k)).length;
+            if (taxStrongCount >= 2)
+                s += 9;
+            else if (taxStrongCount === 1)
+                s += 6;
+            if (taxSoftCount > 0)
+                s += 1;
             return s;
         },
         reason: (d) => {
@@ -330,6 +346,15 @@ const RULES = [
                 bits.push("Flutterwave (Africa)");
             if (d.stack.includes("mercadopago"))
                 bits.push("MercadoPago (LATAM)");
+            const kws = d.readmeKeywords;
+            if (kws.includes("ptin"))
+                bits.push("PTIN mention");
+            if (kws.includes("circular-230"))
+                bits.push("Circular 230 mention");
+            if (kws.includes("form-8879"))
+                bits.push("Form 8879 mention");
+            if (kws.includes("mef"))
+                bits.push("MeF mention");
             return `fintech integration: ${bits.join(", ")} — SOX, PCI, KYC/AML compliance gates`;
         },
     },
@@ -394,6 +419,34 @@ const RULES = [
                 s += 3;
             if (d.readmeKeywords.includes("sso") || d.readmeKeywords.includes("saml"))
                 s += 3;
+            // procurement signals — keep in sync with detect.ts procurement-pack terms.
+            // "three-way-match"/"punchout"/"ofac" are unambiguous procurement/source-
+            // to-pay terms; "rfp"/"sourcing" are softer and get a lighter bump.
+            const kws = d.readmeKeywords;
+            const procurementStrong = ["purchase-order", "three-way-match", "punchout",
+                "cxml", "ofac", "requisition"];
+            const procurementSoft = ["rfp", "sourcing", "procurement", "spend-management"];
+            const procurementStrongCount = procurementStrong.filter((k) => kws.includes(k)).length;
+            const procurementSoftCount = procurementSoft.filter((k) => kws.includes(k)).length;
+            if (procurementStrongCount >= 2)
+                s += 9;
+            else if (procurementStrongCount === 1)
+                s += 6;
+            if (procurementSoftCount > 0)
+                s += 1;
+            // MSP signals — keep in sync with detect.ts msp-pack terms.
+            // "rmm"/"psa"/"credential-vault"/"msp" are unambiguous MSP terms;
+            // "msa"/"sla"/"managed-service(s)" are softer, lighter bump.
+            const mspStrong = ["rmm", "psa", "credential-vault", "msp"];
+            const mspSoft = ["msa", "sla", "managed-service", "managed-services"];
+            const mspStrongCount = mspStrong.filter((k) => kws.includes(k)).length;
+            const mspSoftCount = mspSoft.filter((k) => kws.includes(k)).length;
+            if (mspStrongCount >= 2)
+                s += 9;
+            else if (mspStrongCount === 1)
+                s += 6;
+            if (mspSoftCount > 0)
+                s += 1;
             // Stripe billing + multi-tenant signals = SaaS
             if (s > 0 && d.stack.includes("stripe"))
                 s += 1;
@@ -411,6 +464,15 @@ const RULES = [
                 bits.push("SAML lib");
             if (d.stack.includes("scim"))
                 bits.push("SCIM");
+            const kws = d.readmeKeywords;
+            if (kws.includes("three-way-match"))
+                bits.push("three-way match mention");
+            if (kws.includes("punchout"))
+                bits.push("punchout mention");
+            if (kws.includes("rmm"))
+                bits.push("RMM mention");
+            if (kws.includes("psa"))
+                bits.push("PSA mention");
             return `enterprise B2B SaaS (${bits.join(", ")}) — multi-tenant isolation + SSO + audit log + SOC2 mandatory`;
         },
     },

package/dist/archetypes.js

@@ -310,6 +310,22 @@ const RULES = [
                 s += 9;
             if (d.readmeKeywords.includes("fintech"))
                 s += 2;
+            // tax-prep signals — keep in sync with detect.ts tax-pack terms.
+            // Unambiguous regulatory/professional-standard terms get a strong
+            // bump; softer generic terms (irs/e-file/tax-prep) get a light one
+            // since they can appear in unrelated fixtures.
+            const kws = d.readmeKeywords;
+            const taxStrong = ["ptin", "circular-230", "form-8879", "mef",
+                "pub-4557", "section-7216"];
+            const taxSoft = ["irs", "e-file", "tax-prep", "tax-preparation"];
+            const taxStrongCount = taxStrong.filter((k) => kws.includes(k)).length;
+            const taxSoftCount = taxSoft.filter((k) => kws.includes(k)).length;
+            if (taxStrongCount >= 2)
+                s += 9;
+            else if (taxStrongCount === 1)
+                s += 6;
+            if (taxSoftCount > 0)
+                s += 1;
             return s;
         },
         reason: (d) => {
@@ -330,6 +346,15 @@ const RULES = [
                 bits.push("Flutterwave (Africa)");
             if (d.stack.includes("mercadopago"))
                 bits.push("MercadoPago (LATAM)");
+            const kws = d.readmeKeywords;
+            if (kws.includes("ptin"))
+                bits.push("PTIN mention");
+            if (kws.includes("circular-230"))
+                bits.push("Circular 230 mention");
+            if (kws.includes("form-8879"))
+                bits.push("Form 8879 mention");
+            if (kws.includes("mef"))
+                bits.push("MeF mention");
             return `fintech integration: ${bits.join(", ")} — SOX, PCI, KYC/AML compliance gates`;
         },
     },
@@ -394,6 +419,34 @@ const RULES = [
                 s += 3;
             if (d.readmeKeywords.includes("sso") || d.readmeKeywords.includes("saml"))
                 s += 3;
+            // procurement signals — keep in sync with detect.ts procurement-pack terms.
+            // "three-way-match"/"punchout"/"ofac" are unambiguous procurement/source-
+            // to-pay terms; "rfp"/"sourcing" are softer and get a lighter bump.
+            const kws = d.readmeKeywords;
+            const procurementStrong = ["purchase-order", "three-way-match", "punchout",
+                "cxml", "ofac", "requisition"];
+            const procurementSoft = ["rfp", "sourcing", "procurement", "spend-management"];
+            const procurementStrongCount = procurementStrong.filter((k) => kws.includes(k)).length;
+            const procurementSoftCount = procurementSoft.filter((k) => kws.includes(k)).length;
+            if (procurementStrongCount >= 2)
+                s += 9;
+            else if (procurementStrongCount === 1)
+                s += 6;
+            if (procurementSoftCount > 0)
+                s += 1;
+            // MSP signals — keep in sync with detect.ts msp-pack terms.
+            // "rmm"/"psa"/"credential-vault"/"msp" are unambiguous MSP terms;
+            // "msa"/"sla"/"managed-service(s)" are softer, lighter bump.
+            const mspStrong = ["rmm", "psa", "credential-vault", "msp"];
+            const mspSoft = ["msa", "sla", "managed-service", "managed-services"];
+            const mspStrongCount = mspStrong.filter((k) => kws.includes(k)).length;
+            const mspSoftCount = mspSoft.filter((k) => kws.includes(k)).length;
+            if (mspStrongCount >= 2)
+                s += 9;
+            else if (mspStrongCount === 1)
+                s += 6;
+            if (mspSoftCount > 0)
+                s += 1;
             // Stripe billing + multi-tenant signals = SaaS
             if (s > 0 && d.stack.includes("stripe"))
                 s += 1;
@@ -411,6 +464,15 @@ const RULES = [
                 bits.push("SAML lib");
             if (d.stack.includes("scim"))
                 bits.push("SCIM");
+            const kws = d.readmeKeywords;
+            if (kws.includes("three-way-match"))
+                bits.push("three-way match mention");
+            if (kws.includes("punchout"))
+                bits.push("punchout mention");
+            if (kws.includes("rmm"))
+                bits.push("RMM mention");
+            if (kws.includes("psa"))
+                bits.push("PSA mention");
             return `enterprise B2B SaaS (${bits.join(", ")}) — multi-tenant isolation + SSO + audit log + SOC2 mandatory`;
         },
     },

package/dist/detect.js

@@ -1158,6 +1158,19 @@ function mineReadmeKeywords(dir) {
         "policy", "underwriting", "premium", "acord", "naic", "actuarial",
         "reinsurance", "solvency", "carrier", "mga", "mgu", "tpa", "insurance",
         "insurtech", "insurer", "insured", "deductible", "coverage", "bordereau",
+        // tax-pack — keep in sync with archetypes.ts fintech score()
+        // "irs"/"e-file"/"tax-prep" deliberately soft signals: generic enough
+        // to appear in unrelated fixtures, so weighted low in the scorer.
+        "ptin", "circular-230", "form-8879", "mef", "pub-4557", "section-7216",
+        "e-file", "tax-prep", "tax-preparation", "irs",
+        // procurement-pack — keep in sync with archetypes.ts enterprise-saas score()
+        // "rfp"/"sourcing" deliberately soft: generic terms, weighted low.
+        "purchase-order", "three-way-match", "rfp", "ofac", "requisition",
+        "punchout", "cxml", "sourcing", "procurement", "spend-management",
+        // msp-pack — keep in sync with archetypes.ts enterprise-saas score()
+        // "sla" deliberately soft: generic term, weighted low.
+        "msa", "sla", "rmm", "psa", "multi-tenant", "managed-service",
+        "credential-vault", "msp", "managed-services",
     ];
     for (const term of packTerms) {
         if (text.includes(term))

package/dist/update-check.js

@@ -134,7 +134,7 @@ export function isCacheFresh(cache, now = Date.now(), freshMs = CACHE_FRESH_MS)
     const checkedAtMs = Date.parse(cache.checkedAt);
     if (Number.isNaN(checkedAtMs))
         return false;
-    return now - checkedAtMs < freshMs;
+    return now - checkedAtMs <= freshMs;
 }
 /** Pure function: does `latest` represent a newer version than `current`? */
 export function isNewerVersion(current, latest) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.82.1",
+  "version": "2.82.3",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",