great-cto 2.92.0 → 2.93.0

package/board/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "great_cto",
   "id": "great_cto",
   "description": "Engineering process for solo founders and teams up to 50 engineers. Agents do architecture, code review, QA, and security. You make two decisions per feature.",
-  "version": "2.92.0",
+  "version": "2.93.0",
   "author": {
     "name": "Great CTO",
     "url": "https://github.com/avelikiy/great_cto"
@@ -56,7 +56,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); if [ -n \"$PLUGIN_DIR\" ] && [ -f \"${PLUGIN_DIR}/shared/orchestrator.toml\" ]; then mkdir -p shared; cp \"${PLUGIN_DIR}/shared/orchestrator.toml\" shared/orchestrator.toml 2>/dev/null || true; cp \"${PLUGIN_DIR}/shared/pipeline.toml\" shared/pipeline.toml 2>/dev/null || true; fi",
+            "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); if [ -f .claude-plugin/plugin.json ] && grep -q '\"name\": *\"great_cto\"' .claude-plugin/plugin.json 2>/dev/null; then : ; elif [ -n \"$PLUGIN_DIR\" ] && [ -f \"${PLUGIN_DIR}/shared/orchestrator.toml\" ]; then mkdir -p shared; cp \"${PLUGIN_DIR}/shared/orchestrator.toml\" shared/orchestrator.toml 2>/dev/null || true; cp \"${PLUGIN_DIR}/shared/pipeline.toml\" shared/pipeline.toml 2>/dev/null || true; fi",
             "timeout": 5,
             "statusMessage": "Refreshing orchestrator contract..."
           },
@@ -262,6 +262,16 @@
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/pipeline-stall-guard.mjs\" 2>/dev/null || true"
+          }
+        ]
+      }
     ]
   }
 }

package/board/packages/board/lib/fleet.mjs

@@ -17,7 +17,15 @@ import { readVerdicts } from './verdicts.mjs';
 // frontmatter, to avoid pipeline-wide migration). Founder may flip to
 // frontmatter-driven later — encapsulated in this function only.
 
-const AGENTS_DIR = path.join(os.homedir(), '.claude', 'agents');
+// The agents directory, overridable for tests.
+//
+// getAgentsFleet and getAgentProfile read the real ~/.claude/agents, which left
+// them on the integration path and untested — and the untested part is where the
+// classification bug lived that put 40 of 69 agents in one bucket. An env
+// override is enough to exercise them against a fixture; mocking `fs` would test
+// the mock.
+const AGENTS_DIR = process.env.GREAT_CTO_AGENTS_DIR
+  || path.join(os.homedir(), '.claude', 'agents');
 
 function deriveDomain(slug) {
   const s = slug.toLowerCase();

package/board/packages/board/lib/routes.mjs

@@ -19,6 +19,7 @@ import { getMetrics } from './metrics.mjs';
 import { readVerdicts } from './verdicts.mjs';
 import { getAgentsFleet, getAgentProfile, retireAgent, restoreAgent, appendDecisionLog, readDecisionsLog } from './fleet.mjs';
 import { getResume, getShareState, toggleShare } from './share.mjs';
+import { listSessions, readSession, editedFiles, searchSessions } from './transcripts.mjs';
 
 // ── HTTP router ────────────────────────────────────────────────────────────────
 // dispatch(req, res, url, cwd, projInfo) handles every /api/* route plus /api/sse.
@@ -855,6 +856,53 @@ async function dispatch(req, res, url, cwd) {
     return true;
   }
 
+  // ── session transcripts ───────────────────────────────────────────────
+  //
+  // The board reports outcomes. These four report HOW an outcome was reached,
+  // which is the only thing that separates a weak agent from a broken harness —
+  // a distinction this repo got wrong three times in one week by reading a score
+  // without reading the run.
+  //
+  // Read-only by construction: no writes, no index, no cache. A transcript is
+  // evidence, and a tool that edits evidence is not one.
+
+  if (pathname === '/api/sessions') {
+    const sessions = listSessions(cwd);
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify({ project: cwd, count: sessions.length,
+      // The absolute path stays on the server. A browser has no use for it and
+      // it names the operator's home directory.
+      sessions: sessions.map(({ file, ...rest }) => rest) }));
+    return true;
+  }
+
+  if (pathname.startsWith('/api/sessions/') && pathname.endsWith('/edits')) {
+    const id = pathname.slice('/api/sessions/'.length, -'/edits'.length);
+    const s = listSessions(cwd).find((x) => x.id === id);
+    if (!s) { res.writeHead(404, { 'Content-Type': 'application/json' }); res.end('{"error":"no such session"}'); return true; }
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify({ session: id, files: editedFiles(s.file) }));
+    return true;
+  }
+
+  if (pathname.startsWith('/api/sessions/')) {
+    // The id comes from the URL and is used to pick from a list the server
+    // built — never to build a path. A traversal in the id matches nothing.
+    const id = pathname.slice('/api/sessions/'.length);
+    const s = listSessions(cwd).find((x) => x.id === id);
+    if (!s) { res.writeHead(404, { 'Content-Type': 'application/json' }); res.end('{"error":"no such session"}'); return true; }
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify({ session: id, title: s.title, modified: s.modified, turns: readSession(s.file) }));
+    return true;
+  }
+
+  if (pathname === '/api/session-search') {
+    const q = url.searchParams.get('q') || '';
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(searchSessions(cwd, q)));
+    return true;
+  }
+
   // Build version — so the board shows which great_cto version it's running.
   if (pathname === '/api/version') {
     res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });

package/board/packages/board/lib/transcripts.mjs

@@ -0,0 +1,198 @@
+// Session transcripts — what the agent actually did, as opposed to what it
+// concluded.
+//
+// The board reports outcomes: verdicts, gates, cost, tasks. It has never touched
+// the 2 GB of session transcripts sitting in ~/.claude/projects, which are the
+// only record of HOW an outcome was reached — the tool calls, the retries, the
+// edits, the turn where it went wrong.
+//
+// The value of that record was demonstrated the hard way this week. Three
+// separate times a low eval score was read as an agent gap and turned out to be
+// the harness: a token cap that truncated every answer, a one-shot actor that
+// could not look anything up, a fixture with no approved gate. Each was found by
+// reading what the agent did, and each cost a day of the wrong repair first.
+//
+// Deliberately narrow, and deliberately read-only:
+//
+//   - one format, ours. agentsview parses fifty; we have Claude Code's JSONL and
+//     no reason to guess at the others.
+//   - no index, no database. A session file is read when someone opens it. The
+//     board is zero-dependency and stays that way.
+//   - nothing is written back. A transcript is evidence; a tool that edits
+//     evidence is not one.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+
+/** Claude Code's per-project session directory, keyed by a slugified cwd. */
+export function projectsRoot() {
+  return path.join(os.homedir(), '.claude', 'projects');
+}
+
+/**
+ * cwd → the directory name Claude Code derives from it.
+ *
+ * Every character outside [A-Za-z0-9-] becomes a hyphen, underscores included:
+ * `/Users/x/development/Personal/great_cto` is stored as
+ * `-Users-x-development-Personal-great-cto`. Deriving this from the observed
+ * directory names rather than guessing, because a slug that is nearly right
+ * silently lists zero sessions and looks like a project with no history.
+ */
+export function slugForCwd(cwd) {
+  return String(cwd || '').replace(/[^A-Za-z0-9-]/g, '-');
+}
+
+function readJsonl(file, { limit = Infinity } = {}) {
+  let text;
+  try { text = fs.readFileSync(file, 'utf8'); } catch { return []; }
+  const out = [];
+  for (const line of text.split('\n')) {
+    if (out.length >= limit) break;
+    const t = line.trim();
+    if (!t || t[0] !== '{') continue;
+    // A truncated append is the normal state of a file being written to right
+    // now. Skipping the line is right; failing the read is not.
+    try { out.push(JSON.parse(t)); } catch { /* partial write */ }
+  }
+  return out;
+}
+
+/**
+ * Sessions for a project, newest first.
+ *
+ * Metadata only — each entry costs one stat and a bounded head-read, so listing
+ * a project with a hundred sessions does not read a hundred megabytes.
+ */
+export function listSessions(cwd, { root = projectsRoot() } = {}) {
+  const dir = path.join(root, slugForCwd(cwd));
+  let files;
+  try { files = fs.readdirSync(dir).filter((f) => f.endsWith('.jsonl')); } catch { return []; }
+
+  return files.map((f) => {
+    const full = path.join(dir, f);
+    let stat;
+    try { stat = fs.statSync(full); } catch { return null; }
+
+    // The title lives in a `custom-title` record that can appear anywhere, and
+    // rewriting it appends a new one — so the LAST is current. Read a bounded
+    // head and accept not finding it rather than scanning a 40 MB file for a
+    // label.
+    const head = readJsonl(full, { limit: 400 });
+    const titles = head.filter((r) => r.type === 'custom-title' && r.customTitle);
+    const firstUser = head.find((r) => r.type === 'user' && !r.isCompactSummary);
+
+    return {
+      id: f.replace(/\.jsonl$/, ''),
+      file: full,
+      title: titles.length ? titles[titles.length - 1].customTitle : null,
+      // Falling back to the opening prompt: a session with no title is still
+      // recognisable by what it was asked to do.
+      opened_with: firstUser ? messageText(firstUser).slice(0, 120) : null,
+      size_bytes: stat.size,
+      modified: stat.mtime.toISOString(),
+    };
+  }).filter(Boolean).sort((a, b) => b.modified.localeCompare(a.modified));
+}
+
+/** A message record → plain text, whatever content shape it carries. */
+export function messageText(rec) {
+  const c = rec?.message?.content;
+  if (typeof c === 'string') return c;
+  if (!Array.isArray(c)) return '';
+  return c.filter((b) => b?.type === 'text').map((b) => b.text || '').join('\n').trim();
+}
+
+/** Tool calls in an assistant record, as {name, input}. */
+export function toolCalls(rec) {
+  const c = rec?.message?.content;
+  if (!Array.isArray(c)) return [];
+  return c.filter((b) => b?.type === 'tool_use').map((b) => ({ name: b.name, input: b.input ?? {} }));
+}
+
+/**
+ * One session as a readable turn list.
+ *
+ * Bookkeeping records — `mode`, `queue-operation`, `last-prompt`, `custom-title`
+ * — are dropped: they describe the client's state, not the work. `system` is
+ * kept, because a compaction or an error is part of how the session went.
+ */
+export function readSession(file, { limit = 2000 } = {}) {
+  const KEEP = new Set(['user', 'assistant', 'system']);
+  const turns = [];
+  for (const rec of readJsonl(file)) {
+    if (!KEEP.has(rec.type)) continue;
+    const tools = toolCalls(rec);
+    const text = messageText(rec);
+    if (!text && !tools.length && rec.type !== 'system') continue;
+    turns.push({
+      role: rec.type,
+      ts: rec.timestamp ?? null,
+      text,
+      tools: tools.map((t) => t.name),
+      // The whole input is not carried — a file write's content can be
+      // megabytes, and the panel wants to show what was called, not replay it.
+      tool_detail: tools.map((t) => ({ name: t.name, target: t.input?.file_path ?? t.input?.path ?? t.input?.command ?? null })),
+      subtype: rec.subtype ?? null,
+    });
+    if (turns.length >= limit) break;
+  }
+  return turns;
+}
+
+/**
+ * Files this session edited, newest first.
+ *
+ * Read from the Edit/Write tool calls rather than from git, so it shows what the
+ * agent touched even when nothing was committed — which is exactly the case
+ * where a reader is trying to work out what happened.
+ */
+export function editedFiles(file) {
+  const EDIT = new Set(['Edit', 'Write', 'NotebookEdit', 'MultiEdit']);
+  const seen = new Map();
+  for (const rec of readJsonl(file)) {
+    if (rec.type !== 'assistant') continue;
+    for (const t of toolCalls(rec)) {
+      if (!EDIT.has(t.name)) continue;
+      const p = t.input?.file_path ?? t.input?.path;
+      if (!p) continue;
+      const prev = seen.get(p);
+      seen.set(p, { path: p, tool: t.name, edits: (prev?.edits ?? 0) + 1, last: rec.timestamp ?? prev?.last ?? null });
+    }
+  }
+  return [...seen.values()].sort((a, b) => String(b.last).localeCompare(String(a.last)));
+}
+
+/**
+ * Search a project's transcripts for a string.
+ *
+ * Plain substring, case-insensitive, capped. No index and no embedding: the
+ * question this answers is "where did I see that", and grep answers it at a
+ * scale of gigabytes without a database to keep in sync.
+ */
+export function searchSessions(cwd, query, { root = projectsRoot(), limit = 50 } = {}) {
+  const q = String(query || '').trim().toLowerCase();
+  if (q.length < 3) return { query: q, hits: [], note: 'a query under 3 characters matches everything' };
+
+  const hits = [];
+  for (const s of listSessions(cwd, { root })) {
+    for (const rec of readJsonl(s.file)) {
+      if (hits.length >= limit) break;
+      const text = messageText(rec);
+      if (!text) continue;
+      const at = text.toLowerCase().indexOf(q);
+      if (at === -1) continue;
+      hits.push({
+        session: s.id,
+        title: s.title,
+        role: rec.type,
+        ts: rec.timestamp ?? null,
+        // A window around the match, not the whole turn — a turn can be a
+        // thousand lines and the reader wants to know whether to open it.
+        excerpt: text.slice(Math.max(0, at - 60), at + q.length + 120).replace(/\s+/g, ' ').trim(),
+      });
+    }
+    if (hits.length >= limit) break;
+  }
+  return { query: q, hits, truncated: hits.length >= limit };
+}

package/board/packages/board/public/index.html

@@ -2194,6 +2194,11 @@ button { font-family: inherit; cursor: pointer; }
         <span>Memory</span>
         <span class="count" id="nav-memory-count">0</span>
       </div>
+      <div class="nav-item" data-tab="sessions" onclick="switchTab('sessions', this)">
+        <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01"/></svg>
+        <span>Sessions</span>
+        <span class="count" id="nav-sessions-count">0</span>
+      </div>
       <div class="nav-item" data-tab="logs" onclick="switchTab('logs', this)">
         <svg class="icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/><line x1="10" y1="9" x2="8" y2="9"/></svg>
         <span>Logs</span>
@@ -2464,6 +2469,19 @@ button { font-family: inherit; cursor: pointer; }
     </div>
 
     <!-- Memory -->
+    <!-- Sessions: what the agent DID, as opposed to what it concluded.
+         Every other panel reports an outcome. Three times this week a low eval
+         score was read as an agent gap and turned out to be the harness, and
+         each was found by reading the run rather than the number. -->
+    <div class="panel" id="panel-sessions">
+      <div class="panel-head">
+        <h2>Sessions</h2>
+        <input id="session-q" class="input" placeholder="search transcripts…" style="max-width:280px"
+               onkeydown="if(event.key==='Enter')searchTranscripts()">
+      </div>
+      <div id="sessions-body" class="muted">Loading…</div>
+    </div>
+
     <div class="panel" id="panel-memory">
       <div class="memory-page">
         <div class="memory-side">
@@ -3284,6 +3302,104 @@ function mdToHtml(md) {
   });
 }
 
+// ── Sessions ────────────────────────────────────────────────────────────────
+//
+// Every other panel answers "what happened". This one answers "how", which is
+// the only thing that separates a weak agent from a broken harness — a
+// distinction this repo got wrong three times in one week by reading a score
+// without reading the run.
+
+const fmtMB = (b) => b >= 1e6 ? (b / 1e6).toFixed(1) + ' MB' : Math.round(b / 1e3) + ' KB';
+const ago = (iso) => {
+  const h = (Date.now() - new Date(iso)) / 36e5;
+  if (!Number.isFinite(h)) return '';
+  return h < 1 ? `${Math.round(h * 60)}m ago` : h < 48 ? `${Math.round(h)}h ago` : `${Math.round(h / 24)}d ago`;
+};
+
+async function loadSessions() {
+  const body = document.getElementById('sessions-body');
+  const d = await api(`/api/sessions${pqs()}`);
+  // Never leave the panel on "Loading…" — an endpoint that failed must say so,
+  // because a spinner and an empty project look identical to the reader.
+  if (!d) { body.innerHTML = '<div class="muted">Could not read sessions.</div>'; return; }
+  const c = document.getElementById('nav-sessions-count'); if (c) c.textContent = d.count ?? 0;
+  if (!d.sessions?.length) {
+    body.innerHTML = '<div class="muted">No transcripts for this project yet.</div>';
+    return;
+  }
+  body.innerHTML = d.sessions.map(s => `
+    <div class="card" style="margin-bottom:8px">
+      <div style="display:flex;justify-content:space-between;gap:12px;align-items:baseline">
+        <strong>${esc(s.title || s.opened_with || s.id)}</strong>
+        <span class="muted" style="white-space:nowrap">${ago(s.modified)} · ${fmtMB(s.size_bytes)}</span>
+      </div>
+      <div style="margin-top:6px">
+        <button class="btn-sm" onclick="openSession('${esc(s.id)}')">transcript</button>
+        <button class="btn-sm" onclick="openEdits('${esc(s.id)}')">edits</button>
+      </div>
+      <div id="sess-${esc(s.id)}" style="margin-top:8px"></div>
+    </div>`).join('');
+}
+
+async function openEdits(id) {
+  const slot = document.getElementById(`sess-${id}`);
+  slot.innerHTML = '<span class="muted">Loading…</span>';
+  const d = await api(`/api/sessions/${encodeURIComponent(id)}/edits${pqs()}`);
+  if (!d?.files) { slot.innerHTML = '<span class="muted">Could not read edits.</span>'; return; }
+  if (!d.files.length) { slot.innerHTML = '<span class="muted">No files edited in this session.</span>'; return; }
+  slot.innerHTML = `<table class="tbl"><tbody>${d.files.map(f => `
+    <tr><td style="width:3em;text-align:right" class="muted">${f.edits}×</td>
+        <td style="width:5em" class="muted">${esc(f.tool)}</td>
+        <td><code>${esc(f.path)}</code></td></tr>`).join('')}</tbody></table>`;
+}
+
+async function openSession(id) {
+  const slot = document.getElementById(`sess-${id}`);
+  slot.innerHTML = '<span class="muted">Loading…</span>';
+  const d = await api(`/api/sessions/${encodeURIComponent(id)}${pqs()}`);
+  if (!d?.turns) { slot.innerHTML = '<span class="muted">Could not read transcript.</span>'; return; }
+  // A session runs to thousands of turns. Showing the tail is what a reader
+  // wants — the question is almost always "what happened at the end".
+  const turns = d.turns.slice(-60);
+  slot.innerHTML =
+    `<div class="muted" style="margin-bottom:6px">last ${turns.length} of ${d.turns.length} turns</div>` +
+    `<div style="max-height:420px;overflow:auto;border-left:2px solid var(--border);padding-left:10px">` +
+    turns.map(t => {
+      const tools = t.tool_detail?.length
+        ? `<div class="muted" style="font-size:.85em">${t.tool_detail.map(x =>
+            `${esc(x.name)}${x.target ? ' → ' + esc(String(x.target).slice(0, 70)) : ''}`).join(' · ')}</div>`
+        : '';
+      const text = (t.text || '').slice(0, 400);
+      return `<div style="margin-bottom:10px">
+        <span class="muted" style="font-size:.8em">${esc(t.role)}${t.subtype ? '/' + esc(t.subtype) : ''} ${t.ts ? ago(t.ts) : ''}</span>
+        ${text ? `<div>${esc(text)}${(t.text || '').length > 400 ? '…' : ''}</div>` : ''}
+        ${tools}
+      </div>`;
+    }).join('') + '</div>';
+}
+
+async function searchTranscripts() {
+  const q = document.getElementById('session-q').value.trim();
+  const body = document.getElementById('sessions-body');
+  if (q.length < 3) { loadSessions(); return; }
+  body.innerHTML = '<div class="muted">Searching…</div>';
+  const d = await api(`/api/session-search${pqs()}&q=${encodeURIComponent(q)}`);
+  if (!d) { body.innerHTML = '<div class="muted">Search failed.</div>'; return; }
+  if (!d.hits?.length) {
+    body.innerHTML = `<div class="muted">No match for “${esc(q)}”.${d.note ? ' ' + esc(d.note) : ''}
+      <button class="btn-sm" onclick="loadSessions()">back</button></div>`;
+    return;
+  }
+  body.innerHTML =
+    `<div class="muted" style="margin-bottom:8px">${d.hits.length} match(es)${d.truncated ? ', capped' : ''}
+      <button class="btn-sm" onclick="loadSessions()">back</button></div>` +
+    d.hits.map(h => `
+      <div class="card" style="margin-bottom:6px">
+        <div class="muted" style="font-size:.8em">${esc(h.title || h.session)} · ${esc(h.role)} · ${h.ts ? ago(h.ts) : ''}</div>
+        <div>${esc(h.excerpt)}</div>
+      </div>`).join('');
+}
+
 async function loadMemory() {
   const d = await api(`/api/memory${pqs()}`);
   memoryData = d || { layers: [], patterns: [] };
@@ -4592,7 +4708,7 @@ function switchTab(id, el) {
   // crumb — `labels` used to be referenced here but is only ever a function-local in
   // this file, so this threw ReferenceError on every tab switch and skipped the per-tab
   // loaders below (e.g. logs stuck on "Loading…"). Use a local label map.
-  const TAB_LABELS = { dashboard: 'Board', inbox: 'Inbox', tasks: 'Tasks', agents: 'Agents', memory: 'Memory', logs: 'Logs', notifications: 'Notifications', metrics: 'Metrics' };
+  const TAB_LABELS = { dashboard: 'Board', inbox: 'Inbox', tasks: 'Tasks', agents: 'Agents', memory: 'Memory', sessions: 'Sessions', logs: 'Logs', notifications: 'Notifications', metrics: 'Metrics' };
   const crumb = document.getElementById('crumb-here'); if (crumb) crumb.textContent = TAB_LABELS[id] || 'Board';
   if (id === 'dashboard' || id === 'agents') {
     api(`/api/metrics${pqs()}`).then(m => { if (m) { metrics = m; renderDashboard(m); } });
@@ -4601,6 +4717,7 @@ function switchTab(id, el) {
   }
   if (id === 'inbox') refreshInbox();
   if (id === 'memory') loadMemory();
+  if (id === 'sessions') loadSessions();
   if (id === 'logs') refreshLogs();
   if (id === 'notifications') loadNotifications();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.92.0",
+  "version": "2.93.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",