great-cto 3.22.0 → 3.24.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.22.0",
+  "version": "3.24.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"
@@ -55,7 +55,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); if [ -f .claude-plugin/plugin.json ] && grep -q '\"name\": *\"great_cto\"' .claude-plugin/plugin.json 2>/dev/null; then : ; elif [ -n \"$PLUGIN_DIR\" ] && [ -f \"${PLUGIN_DIR}/shared/orchestrator.toml\" ]; then mkdir -p shared; cp \"${PLUGIN_DIR}/shared/orchestrator.toml\" shared/orchestrator.toml 2>/dev/null || true; cp \"${PLUGIN_DIR}/shared/pipeline.toml\" shared/pipeline.toml 2>/dev/null || true; fi",
+            "command": "PLUGIN_DIR=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); if [ -f .claude-plugin/plugin.json ] && grep -qE '\"name\": *\"great[_-]cto\"' .claude-plugin/plugin.json 2>/dev/null; then : ; elif [ -n \"$PLUGIN_DIR\" ] && [ -f \"${PLUGIN_DIR}/shared/orchestrator.toml\" ]; then mkdir -p shared; cp \"${PLUGIN_DIR}/shared/orchestrator.toml\" shared/orchestrator.toml 2>/dev/null || true; cp \"${PLUGIN_DIR}/shared/pipeline.toml\" shared/pipeline.toml 2>/dev/null || true; fi",
             "timeout": 5,
             "statusMessage": "Refreshing orchestrator contract..."
           },

package/board/packages/board/public/index.html

@@ -772,7 +772,9 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .card-footer > * { flex-shrink: 0; }
 .card-time {
   margin-left: auto;
-  font-family: var(--mono); font-size: var(--fs-caption);
+  /* Explicit, because the weight is inherited from an ancestor while the family
+     is switched here. Geist Mono stops at 500; anything above is synthetic. */
+  font-family: var(--mono); font-weight: 500; font-size: var(--fs-caption);
   color: var(--text3);
 }
 
@@ -1341,13 +1343,27 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   max-width: 880px;
   margin: 0 auto;
 }
-.memory-doc h1 { font-family: var(--display); font-weight: 600; font-size: 28px; letter-spacing: -0.02em; margin: 0 0 14px; color: var(--text); }
-.memory-doc h2 { font-family: var(--display); font-weight: 600; font-size: 20px; margin: 28px 0 10px; color: var(--text); }
+/* 500, not 600: --display is Geist Mono and the vendored face's weight axis
+   ends at 500. Asking for 600 does not get a bolder cut — the browser paints a
+   synthetic bold, which is a smeared stroke rather than a designed one, and
+   tests/lib/rendered-contrast.test.mjs fails on exactly that. The tell is that
+   600 and 700 measure identically: a real axis moves, a synthetic stroke does
+   not. Both headings are fixed together; the test only caught the h1 because
+   the h2 happened not to be on screen. */
+    .memory-doc h1 { font-family: var(--display); font-weight: 500; font-size: 28px; letter-spacing: -0.02em; margin: 0 0 14px; color: var(--text); }
+.memory-doc h2 { font-family: var(--display); font-weight: 500; font-size: 20px; margin: 28px 0 10px; color: var(--text); }
 .memory-doc h3 { font-family: var(--sans); font-weight: 600; font-size: var(--fs-title-s); margin: 18px 0 8px; color: var(--text); }
 .memory-doc p { font-size: var(--fs-base); line-height: 1.65; color: var(--text2); margin: 0 0 10px; }
 .memory-doc ul, .memory-doc ol { padding-left: 22px; margin: 0 0 12px; color: var(--text2); }
 .memory-doc li { line-height: 1.6; font-size: var(--fs-base); }
-.memory-doc code {
+/* An explicit weight, because inheritance crosses the family boundary. A
+   heading is sans at 600 — legitimate — and `code` inside it switches the family
+   to Geist Mono while KEEPING the inherited 600. That face's axis ends at 500,
+   so the browser paints a synthetic bold. No CSS rule sets a mono weight above
+   500 anywhere in this file; the offending value arrives from a parent, which
+   is why grepping for it found nothing. */
+    .memory-doc code {
+  font-weight: 500;
   font-family: var(--mono); font-size: var(--fs-small);
   background: var(--bg-muted);
   padding: 1px 6px; border-radius: 0;
@@ -1546,7 +1562,10 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   padding: 12px 12px 10px;
 }
 .pl-gate .gate-glyph { font-size: var(--fs-small); line-height: 1; flex-shrink: 0; filter: grayscale(1); opacity: 0.6; }
-.pl-gate .pl-name { font-weight: 600; }
+/* 500: .pl-name is mono (see .pl-stage .pl-name) and Geist Mono's axis ends
+   there. 600 buys a synthetic bold, not a bolder cut. The .gate-glyph inside it
+   inherits this, which is why it was failing too. */
+.pl-gate .pl-name { font-weight: 500; }
 .pl-gate.active {
   border-left-color: var(--status-blocked);
   background: color-mix(in srgb, var(--status-blocked) 8%, var(--surface-translucent));
@@ -1664,7 +1683,7 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   border-bottom: 1px solid var(--border);
   font-size: var(--fs-small); white-space: nowrap;
 }
-.cost-table th { font-family: var(--mono); font-size: var(--fs-eyebrow); letter-spacing: 0.08em; text-transform: uppercase; color: var(--text2); }
+.cost-table th { font-family: var(--mono); font-weight: 500; font-size: var(--fs-eyebrow); letter-spacing: 0.08em; text-transform: uppercase; color: var(--text2); }
 .cost-table td.num { font-family: var(--mono); font-variant-numeric: tabular-nums; text-align: right; }
 .cost-axis {
   display: flex; justify-content: space-between;
@@ -2082,10 +2101,11 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
   background: var(--bg-card); color: var(--text); min-width: 26ch;
 }
 .budgets-table { width: 100%; border-collapse: collapse; font-size: var(--fs-body); }
-.budgets-table th {
-  text-align: left; font-family: var(--mono); font-size: var(--fs-eyebrow);
+.
+  text-align: left; font-family: var(--mono); font-weight: 500; font-size: var(--fs-eyebrow);
   letter-spacing: 0.08em; text-transform: uppercase; color: var(--text2);
   padding: 0 12px 8px 0; border-bottom: 1px solid var(--border);
+id var(--border);
 }
 .budgets-table td { padding: 10px 12px 10px 0; border-bottom: 1px solid var(--border); vertical-align: middle; }
 /* A row has to answer three questions: what is this agent, what does it cost,
@@ -4190,7 +4210,7 @@ function renderInboxList(rootId, items, countId, opts = {}) {
       // Gates (the showApprove list) get the exact date+time the decision has been
       // waiting since; other rows carry their age in the right-hand column instead.
       (opts.showApprove || t.is_gate === true) && t.updated_at
-        ? `<span title="${esc(fmtDate(t.updated_at))}" style="color:var(--status-gate);font-weight:600">⏳ ${fmtDT(t.updated_at)}</span>`
+        ? `<span title="${esc(fmtDate(t.updated_at))}" style="color:var(--status-gate);font-weight:500">⏳ ${fmtDT(t.updated_at)}</span>`
         : '',
     ].filter(Boolean).join(' · ');
     // 48h is this board's own staleness line — the "Stale (in progress > 48h)"
@@ -6708,7 +6728,7 @@ function cardHTML(t) {
     ? `<span class="card-time">${relTime(t.updated_at)}</span>`
     // A gate is a human decision — show exactly WHEN it's been waiting since (date + time).
     : (isGate && (t.updated_at || t.created_at))
-      ? `<span class="card-time" title="${esc(fmtDate(t.updated_at || t.created_at))}" style="color:var(--status-gate);font-weight:600">⏳ ${fmtDT(t.updated_at || t.created_at)}</span>` : '';
+      ? `<span class="card-time" title="${esc(fmtDate(t.updated_at || t.created_at))}" style="color:var(--status-gate);font-weight:500">⏳ ${fmtDT(t.updated_at || t.created_at)}</span>` : '';
   const descPreview = t.description ? `<div class="card-desc">${esc(t.description.slice(0, 110))}${t.description.length > 110 ? '…' : ''}</div>` : '';
   const statusColor = { backlog:'var(--text3)', in_progress:'var(--status-progress)', done:'var(--status-done)', blocked:'var(--status-blocked)', gate:'var(--status-gate)' };
   const statusDotColor = statusColor[t.status] || 'var(--text3)';

package/board/scripts/lib/gate-reversibility.mjs

@@ -31,6 +31,12 @@ export const CATEGORIES = Object.freeze({
   // Different currency — sunk work rather than an external effect — so it is
   // named separately instead of being folded in.
   'sunk-work': 'reversing it means redoing every stage that ran after it',
+  // Also not one of ADR-009's four, and added for `agent-posture.mjs`, which
+  // reuses this vocabulary rather than inventing a second one for the same axis.
+  // A leaked credential is not undone by reverting anything: a key that reached
+  // 605 transcripts stayed valid until it was revoked, and revocation was the
+  // only fix. Distinct currency again — so, named, not folded in.
+  'unrevocable-disclosure': 'a secret that has been read cannot be un-read; only revocation ends it',
 });
 
 /**

package/dist/adapt.js

@@ -322,6 +322,31 @@ dirty-commits: false
  *
  * @param skillDir - absolute path to ~/.codex/skills/great_cto (used to build hook commands)
  */
+/**
+ * hooks.json for Codex.
+ *
+ * Codex implements our hook contract exactly — same events, same wire format,
+ * and `permissionDecision` takes `allow | deny | ask`, the words we already
+ * write. No translation layer is needed; see
+ * docs/analysis/2026-09-05-codex-phase0-findings.md.
+ *
+ * What needed care is the shell wrapper. Every command here was written as
+ * `node "…" 2>/dev/null || true`, which swallows the exit code AND the reason.
+ * On secret-scan — a BLOCKING guard — that produced a guard that cannot block
+ * and cannot say why: it would have reported clean on every write.
+ *
+ * So the wrapper is now split by intent, and the test pins both halves:
+ *
+ * MATCHERS carry both hosts' tool names. Codex writes through `apply_patch` and
+ * runs commands through `shell`; the Claude Code names are `edit`/`write`/
+ * `str_replace_editor`. This was found by running it: Codex wrote a file
+ * containing an API key and secret-scan never fired — the hook was correct, it
+ * was never called. A matcher that matches nothing looks exactly like a guard
+ * that passed.
+ *   blocking  (secret-scan)              bare, so a non-zero exit reaches Codex
+ *   advisory  (format-check, tool-failure) keeps `|| true` — a formatter that
+ *                                         dies must not stop the user's write
+ */
 export function getCodexHooksJson(skillDir) {
     const s = skillDir; // shorthand
     return JSON.stringify({
@@ -341,15 +366,15 @@ export function getCodexHooksJson(skillDir) {
                 ]
             },
             {
-                "matcher": "edit|write|str_replace_editor|computer",
+                "matcher": "edit|write|str_replace_editor|computer|apply_patch",
                 "hooks": [
-                    { "command": `node "${s}/scripts/hooks/secret-scan.mjs" 2>/dev/null || true`, "timeout": 8 }
+                    { "command": `node "${s}/scripts/hooks/secret-scan.mjs"`, "timeout": 8 }
                 ]
             }
         ],
         "PostToolUse": [
             {
-                "matcher": "edit|write|str_replace_editor",
+                "matcher": "edit|write|str_replace_editor|apply_patch",
                 "hooks": [
                     { "command": `node "${s}/scripts/hooks/format-check.mjs" 2>/dev/null; true`, "timeout": 12, "async": true },
                     { "command": `node "${s}/scripts/hooks/tool-failure.mjs" 2>/dev/null || true`, "timeout": 3, "async": true }

package/dist/codex.js

@@ -0,0 +1,60 @@
+// Installing great_cto for OpenAI Codex.
+//
+// The first version of this wrote hook scripts into `~/.codex/skills/great_cto/`,
+// emitted a TOML fragment for the user to merge by hand, and set
+// `[features] hooks = true` alongside `[hooks_files]`. Phase 0 checked every one
+// of those against a real codex-cli 0.153.4
+// (docs/analysis/2026-09-05-codex-phase0-findings.md):
+//
+//   ~/.codex/skills/   does not exist on a working install
+//   [hooks_files]      is used by no shipped plugin
+//   hooks on Codex     unverified — the config key parses, and that is all
+//
+// None of it was covered by a test, so it had shipped as a working feature while
+// writing to a path nothing reads.
+//
+// Codex ships `codex plugin marketplace add`, taking a local or Git source, and
+// that path was verified end to end: the plugin reports `installed, enabled
+// 3.23.0` with all 40 skills present. So this emits the supported commands and,
+// as importantly, says what does not come with them.
+/**
+ * What installing for Codex means, decided separately from doing it.
+ *
+ * Pure so the decision can be tested without touching a real Codex install —
+ * the previous version was untestable by construction and therefore untested.
+ */
+export function codexInstallPlan({ repoDir, codexOnPath }) {
+    if (!codexOnPath) {
+        // Refuse rather than write half of it. Config for a CLI that is not present
+        // leaves the user with files and no way to use them, which is how the old
+        // path failed by construction.
+        return {
+            ok: false,
+            why: "codex is not on PATH — install it first: npm i -g @openai/codex",
+            commands: [],
+            supported: [],
+            notSupported: [],
+        };
+    }
+    return {
+        ok: true,
+        why: "",
+        commands: [
+            `codex plugin marketplace add ${repoDir}`,
+            `codex plugin add great-cto@great-cto`,
+        ],
+        // Verified present after install, not assumed.
+        supported: [
+            "skills — all of them, the same tree Claude Code reads",
+            "the MCP server (great_cto), resolved from npm",
+        ],
+        // Checked across every shipped Codex plugin: no manifest declares any of
+        // these. Saying "installed" without saying this would promise a pipeline the
+        // host cannot run.
+        notSupported: [
+            "hooks — no plugin surface; the gate chain and secret-scan do not carry over",
+            "slash commands — no plugin surface",
+            "role agents — Codex plugins carry interface metadata, not agent roles",
+        ],
+    };
+}

package/dist/main.js

@@ -701,101 +701,56 @@ ${bold("Links:")}
 `);
 }
 async function runInitCodex(args) {
-    const { homedir } = await import("node:os");
-    const home = homedir();
+    const { codexInstallPlan } = await import("./codex.js");
+    const { execFileSync, spawnSync } = await import("node:child_process");
     log(bold("great-cto · Codex host install"));
     log("");
-    log(`Installing great_cto for ${cyan("OpenAI Codex")} (Desktop + CLI).`);
-    log(`This writes hook, MCP, and agent config to your Codex skill directory.`);
+    // Is the host actually there? The previous version of this function wrote
+    // hook scripts and a config fragment without checking, into
+    // `~/.codex/skills/great_cto/` — a directory a working Codex install does not
+    // have. It reported success either way.
+    let codexOnPath = false;
+    try {
+        execFileSync("codex", ["--version"], { stdio: "ignore", timeout: 15000 });
+        codexOnPath = true;
+    }
+    catch {
+        codexOnPath = false;
+    }
+    const plan = codexInstallPlan({ repoDir: args.dir, codexOnPath });
+    if (!plan.ok) {
+        error(plan.why);
+        return 1;
+    }
+    log(`This registers ${cyan(args.dir)} as a Codex plugin marketplace and installs from it.`);
+    log("");
+    log(bold("Carries over:"));
+    for (const s2 of plan.supported)
+        log(`  ${green("✓")} ${s2}`);
+    log("");
+    // Printed on every run, not buried in docs. An install that lists only what it
+    // gives promises a pipeline this host cannot run.
+    log(bold("Does NOT carry over on Codex:"));
+    for (const s2 of plan.notSupported)
+        log(`  ${yellow("—")} ${s2}`);
     log("");
     if (args.dryRun) {
-        log(yellow("dry-run: showing what would be written."));
-        log(`  would write: ${home}/.codex/skills/great_cto/hooks.json`);
-        log(`  would write: ${home}/.codex/skills/great_cto/scripts/  (hook .mjs files)`);
-        log(`  would update: .codex/great_cto.toml  (merge into ~/.codex/config.toml)`);
+        log(yellow("dry-run: these commands would run."));
+        for (const c of plan.commands)
+            log(`  ${dim(c)}`);
         return 0;
     }
-    const { mkdirSync, copyFileSync, existsSync, writeFileSync } = await import("node:fs");
-    const { join, dirname } = await import("node:path");
-    const { fileURLToPath } = await import("node:url");
-    // ── 1. locate the plugin source ──────────────────────────
-    // Works whether invoked via npx (global cache) or a local build.
-    // - npx run: dist/main.js → dist/ → ../ → package root → scripts/hooks/
-    // - dev run from packages/cli/: same as above
-    // - repo dev with ts-node: src/main.ts → src/ → ../ → packages/cli/ → ../../scripts/hooks/
-    const here = dirname(fileURLToPath(import.meta.url));
-    const hooksSearchPaths = [
-        join(here, "..", "scripts", "hooks"), // npm install: dist/../scripts/hooks
-        join(here, "..", "..", "scripts", "hooks"), // monorepo: packages/cli/dist/../../scripts
-        join(here, "..", "..", "..", "scripts", "hooks"), // ts-node: src/../../../scripts
-    ];
-    const hooksDir = hooksSearchPaths.find(p => existsSync(p));
-    if (!hooksDir) {
-        error("Could not locate scripts/hooks/. Try: npx great-cto@latest --host codex");
-        return 1;
+    for (const c of plan.commands) {
+        log(dim(`  $ ${c}`));
+        const parts = c.split(" ");
+        const r = spawnSync(parts[0], parts.slice(1), { stdio: "inherit", timeout: 120000 });
+        if (r.status !== 0) {
+            error(`command failed: ${c}`);
+            return 1;
+        }
     }
-    // ── 2. install skill dir ──────────────────────────────────
-    const skillDir = join(home, ".codex", "skills", "great_cto");
-    const skillScriptsDir = join(skillDir, "scripts", "hooks");
-    mkdirSync(skillScriptsDir, { recursive: true });
-    log(dim(`  skill dir: ${skillDir}`));
-    // Copy hook scripts
-    const HOOKS_TO_COPY = [
-        "quota-check.mjs",
-        "secret-scan.mjs",
-        "cost-guard.mjs",
-        "orchestrator-check.mjs",
-        "format-check.mjs",
-        "tool-failure.mjs",
-        "summary-enforce.mjs",
-    ];
-    let copied = 0;
-    for (const hook of HOOKS_TO_COPY) {
-        const src = join(hooksDir, hook);
-        const dst = join(skillScriptsDir, hook);
-        if (existsSync(src)) {
-            copyFileSync(src, dst);
-            copied++;
-        }
-    }
-    log(`  ${green("✓")} ${copied} hook scripts → ${skillScriptsDir}`);
-    // Write hooks.json into the skill dir
-    const { getCodexHooksJson } = await import("./adapt.js");
-    const hooksJson = getCodexHooksJson(skillDir);
-    writeFileSync(join(skillDir, "hooks.json"), hooksJson);
-    log(`  ${green("✓")} wrote ~/.codex/skills/great_cto/hooks.json`);
-    // ── 3. write project-scoped config fragment ───────────────
-    const configFrag = join(args.dir, ".codex", "great_cto.toml");
-    mkdirSync(dirname(configFrag), { recursive: true });
-    writeFileSync(configFrag, [
-        `# great_cto Codex integration — generated ${new Date().toISOString().slice(0, 10)}`,
-        `# Add these sections to ~/.codex/config.toml`,
-        ``,
-        `[features]`,
-        `hooks = true`,
-        ``,
-        `[mcp_servers.great_cto]`,
-        `command = "npx"`,
-        `args = ["great-cto@latest", "mcp"]`,
-        `startup_timeout_sec = 60`,
-        ``,
-        `[mcp_servers.great_cto.env]`,
-        `CODEX_SKILL_DIR = "${skillDir}"`,
-        ``,
-        `[hooks_files]`,
-        `paths = ["${join(skillDir, "hooks.json")}"]`,
-    ].join("\n") + "\n");
-    log(`  ${green("✓")} wrote .codex/great_cto.toml`);
-    log("");
-    log(bold("Next steps:"));
-    log(`  1. Merge ${cyan(".codex/great_cto.toml")} sections into ${cyan("~/.codex/config.toml")}`);
-    log(`  2. Add ${cyan(args.dir)} to trusted projects in config.toml if not already:`);
-    log(`     ${dim(`[projects."${args.dir}"]`)}`);
-    log(`     ${dim(`trust_level = "trusted"`)}`);
-    log(`  3. Restart Codex Desktop / CLI to activate hooks and MCP server.`);
-    log(`  4. Verify: run ${cyan("great-cto mcp")} in a terminal — should list great_cto tools.`);
     log("");
-    log(`${green("✓")} Codex host install complete.`);
+    log(`${green("✓")} installed. Verify with: ${cyan("codex plugin list")}`);
     return 0;
 }
 async function runInit(args) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.22.0",
+  "version": "3.24.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",