great-cto 3.26.2 → 3.26.4

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.26.2",
+  "version": "3.26.4",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/lib/fleet.mjs

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import { postureOf } from '../../../scripts/lib/agent-posture.mjs';
 import os from 'os';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { readFileSafe } from './util.mjs';
@@ -128,12 +129,34 @@ function getAgentsFleet(projectCwd) {
   const LLM_RATE_PER_HR   = parseFloat(process.env.GREATCTO_LLM_RATE_PER_HR || '0.30');
   const DEFAULT_TASK_MIN  = 30;
 
+/**
+ * The agent's tool grant, in the language of consequence.
+ *
+ * FOUR states, because three of them are not "no grant": an unreadable agent
+ * file, a file with no `tools:` line, a grant that is entirely routine, and a
+ * grant that holds something expensive to undo. The board rendered all of them
+ * identically before, because it never saw any of them.
+ */
+function posture(toolsLine, fileReadable) {
+  if (!fileReadable) return { state: 'unreadable', expensive: [], scopedInNameOnly: [], why: 'the agent file could not be read' };
+  if (toolsLine == null) return { state: 'undeclared', expensive: [], scopedInNameOnly: [], why: 'the agent declares no tools: line' };
+  const r = postureOf(toolsLine);
+  return {
+    state: r.unknownTools.length ? 'unclassified' : r.expensive.length ? 'expensive' : 'routine',
+    expensive: r.expensive,
+    scopedInNameOnly: r.scopedInNameOnly,
+    unknownTools: r.unknownTools,
+    why: r.unknownTools.length ? `unclassified grant(s): ${r.unknownTools.join(', ')}` : '',
+  };
+}
+
   for (const f of files) {
     const slug = f.replace(/^great_cto-/, '').replace(/\.md$/, '');
     const fp = path.join(AGENTS_DIR, f);
     const raw = readFileSafe(fp) || '';
     const descM = raw.match(/^description:\s*"?([^"\n]+)"?/m);
     const modelM = raw.match(/^model:\s*(\S+)/m);
+    const toolsM = raw.match(/^tools:\s*(.*)$/m);
     const colorM = raw.match(/^color:\s*(\S+)/m);
 
     const vs = byAgent.get(slug) || [];
@@ -155,6 +178,11 @@ function getAgentsFleet(projectCwd) {
     // Estimated cost — DEFAULT_TASK_MIN per verdict (no real timing data here).
     const estLlmUsd   = (vs30d.length * DEFAULT_TASK_MIN / 60) * LLM_RATE_PER_HR;
     const estHumanUsd = (vs30d.length * DEFAULT_TASK_MIN / 60) * HUMAN_RATE_PER_HR;
+    // NOT a measurement. Both sides are runs x DEFAULT_TASK_MIN x a rate, so this
+    // ratio is HUMAN_RATE/LLM_RATE for every agent that ran at all — 500 by
+    // construction. metrics.mjs nulls its equivalent for exactly this reason;
+    // this one shipped as a per-agent number and read like one. Kept, because
+    // removing a field breaks the board, but labelled at the source.
     const savingsX = estLlmUsd > 0 ? Math.round(estHumanUsd / estLlmUsd) : null;
     const realLlmUsd = vs30d.reduce((s, v) => s + (v.cost_usd || 0), 0);
 
@@ -167,7 +195,18 @@ function getAgentsFleet(projectCwd) {
     agents.push({
       slug,
       description: descM?.[1]?.trim() || '',
-      model: modelM?.[1]?.trim() || 'sonnet',
+      // THREE states, not a default. `model: modelM || 'sonnet'` reported every
+      // agent with no `model:` line as pinned to sonnet, so "pinned to sonnet"
+      // and "not pinned at all" were the same string — and an unreadable agent
+      // file produced the same answer a third time. The fleet cannot show what
+      // it cannot distinguish.
+      model: raw ? (modelM?.[1]?.trim() ?? null) : null,
+      model_state: !raw ? 'unreadable' : modelM ? 'pinned' : 'undeclared',
+      // The tool grant, named in the language of consequence rather than listed.
+      // `/api/agents-installed` did not read `tools:` at all, so the board had
+      // nowhere to get it — scripts/lib/agent-posture.mjs has classified these
+      // since 3.24.0 and nothing was consuming it.
+      posture: posture(toolsM?.[1] ?? null, Boolean(raw)),
       color: colorM?.[1]?.trim() || null,
       domain: deriveDomain(slug),
       runs_total: vs.length,
@@ -182,6 +221,9 @@ function getAgentsFleet(projectCwd) {
       human_usd_30d_est: Math.round(estHumanUsd),
       llm_usd_30d_real: realLlmUsd > 0 ? Math.round(realLlmUsd * 100) / 100 : null,
       savings_x: savingsX,
+      // 'ratio' = the rate ratio, identical for every agent. 'measured' would
+      // require per-run timing, which no path produces today.
+      savings_source: savingsX == null ? null : 'ratio',
       health,
       retired: isRetired(slug),
       // Four states, and only `exceeded` can hold a dispatch — see

package/board/packages/board/lib/routes.mjs

@@ -1518,14 +1518,26 @@ async function dispatch(req, res, url, cwd) {
     const tasks = getTasks(cwd);
     const nowMs = Date.now();
     const STUCK_H = 48;
-    const stuck = tasks
-      .filter(t => t.status === 'in_progress')
+    // `stuck` was ALWAYS EMPTY and had been since it was written. It read
+    // `t.startedAt`, a field no code path in this repository produces — a task
+    // carries created_at / updated_at / closed_at and nothing else. Every row
+    // got `age_h: null` and was removed by the filter below, so the panel
+    // reported "nothing is stuck" about a question it never asked. There are
+    // seven in-progress tasks here as this is written.
+    //
+    // `updated_at` is the honest proxy: in progress, and unchanged for STUCK_H.
+    // A task whose age cannot be determined is COUNTED, not dropped — an
+    // unmeasurable task is not a healthy one.
+    const inProgress = tasks.filter(t => t.status === 'in_progress');
+    let stuckUnmeasurable = 0;
+    const stuck = inProgress
       .map(t => {
-        const startedAt = t.startedAt ? new Date(t.startedAt).getTime() : null;
-        const ageH = startedAt ? (nowMs - startedAt) / 3600000 : null;
-        return { id: t.id, title: t.title, agent: t.agent, age_h: ageH ? Math.round(ageH) : null };
+        const since = t.updated_at || t.created_at || null;
+        const ms = since ? new Date(since).getTime() : NaN;
+        if (!Number.isFinite(ms)) { stuckUnmeasurable += 1; return null; }
+        return { id: t.id, title: t.title, agent: t.agent, age_h: Math.round((nowMs - ms) / 3600000), since };
       })
-      .filter(t => t.age_h !== null && t.age_h > STUCK_H);
+      .filter(t => t && t.age_h > STUCK_H);
 
     // Per-agent budgets from PROJECT.md
     const projectMdPath = path.join(cwd, '.great_cto', 'PROJECT.md');
@@ -1583,7 +1595,8 @@ async function dispatch(req, res, url, cwd) {
     // line the parser could not read is reported rather than dropped, because a
     // budget silently ignored is a limit its author believes they have.
     res.end(JSON.stringify({
-      stuck, budgets, goal_ancestry: goalAncestry, tool_failure_rate_1h: toolFailureRate1h,
+      stuck, stuck_in_progress: inProgress.length, stuck_unmeasurable: stuckUnmeasurable,
+      budgets, goal_ancestry: goalAncestry, tool_failure_rate_1h: toolFailureRate1h,
       budgets_deprecated_key: budgetsDeprecatedKey,
       budgets_malformed: budgetsMalformed,
       // Three states, not two: read / absent / unreadable. Without these, a

package/board/packages/board/public/index.html

@@ -577,6 +577,8 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 }
 .live-dot { width: 6px; height: 6px; border-radius: 50%; background: var(--status-review); }
 .live-dot.error { background: var(--status-blocked); }
+  /* Neither live nor failed: the handshake has not resolved. Three states. */
+  .live-dot.connecting { background: var(--text3); animation: none; }
 .live-dot.pulse { animation: pulse 2s infinite; }
 @keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.4; } }
 
@@ -3131,8 +3133,12 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
       </div>
     </nav>
     <div class="sidebar-footer">
-      <span class="live-dot pulse" id="live-dot"></span>
-      <span id="live-label">live · synced just now</span>
+      <!-- Ships in the CONNECTING state. This markup used to say "live · synced
+           just now" before any connection existed, so from first paint until the
+           SSE handshake resolved — or forever, if neither handler ever fired —
+           the footer asserted a sync that had not happened. -->
+      <span class="live-dot connecting" id="live-dot"></span>
+      <span id="live-label">connecting…</span>
     </div>
   </aside>
 
@@ -7206,8 +7212,25 @@ function renderDashboard(m) {
     // how often work bounced. '—' when nothing was accepted in the window — an
     // honest gap, not a zero.
     { v: acc.cost_per_accepted != null ? `$${acc.cost_per_accepted.toFixed(2)}` : absent('none', 'nothing was accepted in this window'), sub: '', label: acc.accepted ? `Cost / accepted (${acc.accepted})` : 'Cost / accepted' },
-    { v: acc.rework_rounds ?? 0, sub: '', label: 'Rework rounds', cls: acc.rework_rounds ? 'amber' : 'green' },
-    { v: m.security?.blocked ?? 0, sub: '', label: 'Open security blocks', cls: m.security?.blocked ? 'red' : 'green' },
+    // `?? 0` here painted a GREEN ZERO over a question nobody asked. The tile one
+    // line above goes out of its way to avoid exactly this, and these two did not:
+    // a project whose acceptance data is missing showed "0 rework rounds" in
+    // green, and — worse — a project where security has NEVER BEEN SCANNED showed
+    // "0 open security blocks" in green, which is a passing security scan that
+    // did not happen. That is this board's governing defect rendered in its most
+    // reassuring colour.
+    {
+      v: acc.rework_rounds != null ? acc.rework_rounds : absent('uncomputable', 'no accepted work in this window, so rework cannot be counted'),
+      sub: '', label: 'Rework rounds',
+      cls: acc.rework_rounds == null ? '' : acc.rework_rounds ? 'amber' : 'green',
+    },
+    {
+      v: m.security?.blocked != null ? m.security.blocked : absent('uncomputable', 'no security scan has run — this is not a clean result'),
+      sub: '', label: 'Open security blocks',
+      // No colour when unmeasured. Green would say "safe"; red would say
+      // "unsafe"; neither is known.
+      cls: m.security?.blocked == null ? '' : m.security.blocked ? 'red' : 'green',
+    },
     { v: m.tasks?.in_progress ?? 0, sub: '', label: 'In progress', cls: 'amber' },
   ];
   document.getElementById('mp-secondary').innerHTML = secondary.map(s => `

package/board/scripts/lib/agent-posture.mjs

@@ -0,0 +1,266 @@
+/**
+ * agent-posture — what does this agent's tool grant actually LET IT DO?
+ *
+ * ADR-009 ends with an instruction nobody had a way to follow: "Ask at design
+ * time, when the capability is added — not after the incident." The question it
+ * asks is about consequence — is this expensive to undo? — while every agent
+ * file answers a different question, in a different language: which tools are on
+ * the `tools:` line. Reviewing the second does not answer the first. `Bash` and
+ * `Bash(node:*)` sit two characters apart and read as careful and careless; in
+ * consequence they are the same grant.
+ *
+ * So this names the grant in the language of the decision. Vocabulary shape
+ * borrowed from OpenFirma's capability postures (`credential.read`,
+ * `communication.external.send`, `code.destructive`) — the idea only; that
+ * project is GPL-3.0 and this one is MIT, so nothing was copied.
+ *
+ * NOTHING here decides anything, exactly as in `gate-reversibility.mjs`, whose
+ * ADR-009 categories it reuses rather than inventing a second vocabulary for the
+ * same axis. It classifies, so a reviewer can see the grant they are approving.
+ */
+
+import { CATEGORIES } from './gate-reversibility.mjs';
+
+/**
+ * The postures. Each cites the ADR-009 category that makes it expensive, or
+ * `null` when the repair is simply to do the thing again.
+ */
+export const POSTURES = Object.freeze({
+  'code.read': {
+    category: null,
+    means: 'read files in the working tree',
+  },
+  'code.write': {
+    category: null,
+    means: 'create or modify files — the repair is another edit',
+  },
+  'code.destructive': {
+    category: 'destroys-evidence',
+    means: 'delete files, rewrite history, or overwrite work that is not in the index',
+  },
+  'credential.read': {
+    category: 'unrevocable-disclosure',
+    means: 'reach secrets on disk or in the environment',
+  },
+  'communication.external.send': {
+    category: 'escapes-the-machine',
+    means: 'send data off this machine — a push, a publish, a request body, a URL',
+  },
+  'network.fetch': {
+    category: null,
+    means: 'pull from the network; nothing of the user\'s leaves except the request',
+  },
+  'process.spawn': {
+    category: null,
+    means: 'start a process or another agent, which then holds its own grant',
+  },
+  payments: {
+    category: 'costs-money',
+    means: 'spend money — paid API capacity or provisioned infrastructure',
+  },
+});
+
+/**
+ * A shell is a shell. Every posture an unrestricted `Bash` confers, in one list,
+ * so the interpreters below cannot drift away from it.
+ */
+const FULL_SHELL = Object.freeze([
+  'code.read', 'code.write', 'code.destructive',
+  'credential.read', 'communication.external.send', 'network.fetch', 'process.spawn',
+]);
+
+/**
+ * Bash sub-grants, by the command they scope to.
+ *
+ * `full: true` marks the ones that scope to a name but not to a capability — an
+ * interpreter, or a command that runs other commands. `Bash(node:*)` is
+ * `node -e '<anything>'`; `Bash(find:*)` is `find . -exec <anything>`;
+ * `Bash(xargs:*)` and `Bash(awk:*)` likewise. These read as restrictions and are
+ * not, which is the reason this file exists.
+ */
+const BASH_SCOPES = Object.freeze({
+  // Scoped in name only — a full shell wearing a command name.
+  node:    { full: true, why: 'node -e runs arbitrary JavaScript, including child_process' },
+  python3: { full: true, why: 'python3 -c runs arbitrary Python, including os.system' },
+  python:  { full: true, why: 'python -c runs arbitrary Python, including os.system' },
+  xargs:   { full: true, why: 'xargs exists to run other commands' },
+  find:    { full: true, why: 'find -exec and -delete run other commands and remove files' },
+  awk:     { full: true, why: 'awk has system() and can redirect print into a file' },
+  sh:      { full: true, why: 'a shell' },
+  bash:    { full: true, why: 'a shell' },
+  zsh:     { full: true, why: 'a shell' },
+  env:     { full: true, why: 'env runs the command that follows it' },
+  eval:    { full: true, why: 'eval runs the string that follows it' },
+
+  // Genuinely narrower.
+  git:    { postures: ['code.read', 'code.write', 'code.destructive', 'communication.external.send'],
+            why: 'push sends the tree to a remote; checkout -- and reset --hard destroy uncommitted work' },
+  npm:    { postures: ['code.read', 'code.write', 'network.fetch', 'communication.external.send', 'process.spawn'],
+            why: 'install runs lifecycle scripts; publish escapes the machine' },
+  bd:     { postures: ['code.read', 'code.write', 'communication.external.send'],
+            why: 'bd sync pushes the task store to its remote' },
+  cat:    { postures: ['code.read', 'credential.read'],
+            why: 'the file it reads may be ~/.great_cto/secrets.env' },
+  source: { postures: ['code.read', 'credential.read'],
+            why: 'sourcing an env file puts its secrets in the environment' },
+  sort:   { postures: ['code.read', 'code.write'], why: 'sort -o writes' },
+  tee:    { postures: ['code.read', 'code.write'], why: 'writes what it reads' },
+  rm:     { postures: ['code.destructive'], why: 'removes files' },
+
+  ls:     { postures: ['code.read'] },
+  grep:   { postures: ['code.read'] },
+  wc:     { postures: ['code.read'] },
+  head:   { postures: ['code.read'] },
+  tail:   { postures: ['code.read'] },
+  date:   { postures: ['code.read'] },
+  echo:   { postures: ['code.read'] },
+  printf: { postures: ['code.read'] },
+  export: { postures: ['code.read'] },
+  mkdir:  { postures: ['code.write'] },
+  touch:  { postures: ['code.write'] },
+});
+
+/** Non-Bash tools. */
+const TOOL_POSTURES = Object.freeze({
+  Read: ['code.read'],
+  Glob: ['code.read'],
+  Grep: ['code.read'],
+  Write: ['code.write'],
+  Edit: ['code.write'],
+  NotebookEdit: ['code.write'],
+  // A URL is a channel. A fetch of `https://evil/?leak=<secret>` is a send, and
+  // an agent that can read a file and reach the network can move it.
+  WebFetch: ['network.fetch', 'communication.external.send'],
+  WebSearch: ['network.fetch', 'communication.external.send'],
+  Agent: ['process.spawn'],
+  Task: ['process.spawn'],
+});
+
+/** MCP and beta tools, matched by prefix — the list of these grows monthly. */
+const PREFIX_POSTURES = Object.freeze([
+  [/^advisor_/,   ['network.fetch', 'communication.external.send', 'payments']],
+  [/^memory_/,    ['code.read', 'code.write']],
+  [/^mcp__great_cto_llm_router__/, ['network.fetch', 'communication.external.send', 'payments']],
+  [/^mcp__grafana__/, ['network.fetch']],
+]);
+
+/**
+ * Split a `tools:` frontmatter value into tokens. `Bash(git:*)` contains a comma
+ * in no case we ship, but the split is on commas outside parentheses anyway, so
+ * a future `Bash(a:*, b:*)` does not silently become two broken tokens.
+ */
+export function splitTools(line) {
+  const out = [];
+  let depth = 0; let cur = '';
+  for (const ch of String(line ?? '')) {
+    if (ch === '(') depth++;
+    if (ch === ')') depth--;
+    if (ch === ',' && depth === 0) { out.push(cur.trim()); cur = ''; continue; }
+    cur += ch;
+  }
+  if (cur.trim()) out.push(cur.trim());
+  return out.filter(Boolean);
+}
+
+/**
+ * @returns {{postures:string[], unknown:boolean, fullShell:boolean, why:string}}
+ *
+ * THREE states for the tool itself, and `unknown` is the one that earns its
+ * keep: a tool this table has never heard of grants `unknown`, never nothing.
+ * A grant nobody classified must not read as a grant that was classified and
+ * found harmless.
+ */
+export function postureOfTool(tool) {
+  const t = String(tool ?? '').trim();
+  if (!t) return { postures: [], unknown: true, fullShell: false, why: 'no tool given' };
+
+  if (t === '*' || t === 'All tools') {
+    return { postures: [...FULL_SHELL, 'payments'], unknown: false, fullShell: true, why: 'every tool' };
+  }
+  if (t === 'Bash') {
+    return { postures: [...FULL_SHELL], unknown: false, fullShell: true, why: 'unrestricted shell' };
+  }
+
+  const scoped = /^Bash\(([^:)]+)/.exec(t);
+  if (scoped) {
+    const cmd = scoped[1].trim();
+    const hit = BASH_SCOPES[cmd];
+    if (!hit) {
+      return {
+        postures: [], unknown: true, fullShell: false,
+        why: `Bash scope '${cmd}' is not in the table — treat as unjudged, not as narrow. Add it to agent-posture.mjs.`,
+      };
+    }
+    if (hit.full) {
+      return { postures: [...FULL_SHELL], unknown: false, fullShell: true, why: hit.why };
+    }
+    return { postures: [...hit.postures], unknown: false, fullShell: false, why: hit.why ?? '' };
+  }
+
+  if (TOOL_POSTURES[t]) {
+    return { postures: [...TOOL_POSTURES[t]], unknown: false, fullShell: false, why: '' };
+  }
+  for (const [re, postures] of PREFIX_POSTURES) {
+    if (re.test(t)) return { postures: [...postures], unknown: false, fullShell: false, why: '' };
+  }
+  return {
+    postures: [], unknown: true, fullShell: false,
+    why: `'${t}' is not in the table — treat as unjudged, not as harmless. Add it to agent-posture.mjs.`,
+  };
+}
+
+/**
+ * The posture of a whole `tools:` line.
+ *
+ * @returns {{postures:string[], expensive:string[], unknownTools:string[],
+ *            fullShellVia:string[], scopedInNameOnly:string[]}}
+ */
+export function postureOf(toolsLine) {
+  const tools = splitTools(toolsLine);
+  const postures = new Set();
+  const unknownTools = [];
+  const fullShellVia = [];
+  const scopedInNameOnly = [];
+
+  for (const t of tools) {
+    const r = postureOfTool(t);
+    if (r.unknown) { unknownTools.push(t); continue; }
+    for (const p of r.postures) postures.add(p);
+    if (r.fullShell) {
+      fullShellVia.push(t);
+      // `Bash` is honest about being a shell. `Bash(node:*)` is not.
+      if (t !== 'Bash' && t !== '*' && t !== 'All tools') scopedInNameOnly.push(t);
+    }
+  }
+
+  const ordered = Object.keys(POSTURES).filter((p) => postures.has(p));
+  return {
+    postures: ordered,
+    expensive: ordered.filter((p) => POSTURES[p].category),
+    unknownTools,
+    fullShellVia,
+    scopedInNameOnly,
+  };
+}
+
+/** One line for a human reviewing a grant, in their words. */
+export function describePosture(r) {
+  const parts = [];
+  if (r.expensive.length) {
+    parts.push(`expensive: ${r.expensive.map((p) => `${p} (${CATEGORIES[POSTURES[p].category]})`).join('; ')}`);
+  } else if (r.postures.length) {
+    parts.push(`routine: ${r.postures.join(', ')}`);
+  }
+  if (r.scopedInNameOnly.length) {
+    parts.push(`scoped in name only: ${r.scopedInNameOnly.join(', ')} — a full shell`);
+  }
+  if (r.unknownTools.length) {
+    parts.push(`NOT CLASSIFIED: ${r.unknownTools.join(', ')} — unjudged, not harmless`);
+  }
+  return parts.join(' · ') || 'no tools granted';
+}
+
+/** Every posture name, for a surface that wants a legend. */
+export function knownPostures() {
+  return Object.keys(POSTURES);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.26.2",
+  "version": "3.26.4",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",