great-cto 3.26.2 → 3.27.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.26.2",
+  "version": "3.27.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/lib/fleet.mjs

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import { postureOf } from '../../../scripts/lib/agent-posture.mjs';
 import os from 'os';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { readFileSafe } from './util.mjs';
@@ -128,12 +129,34 @@ function getAgentsFleet(projectCwd) {
   const LLM_RATE_PER_HR   = parseFloat(process.env.GREATCTO_LLM_RATE_PER_HR || '0.30');
   const DEFAULT_TASK_MIN  = 30;
 
+/**
+ * The agent's tool grant, in the language of consequence.
+ *
+ * FOUR states, because three of them are not "no grant": an unreadable agent
+ * file, a file with no `tools:` line, a grant that is entirely routine, and a
+ * grant that holds something expensive to undo. The board rendered all of them
+ * identically before, because it never saw any of them.
+ */
+function posture(toolsLine, fileReadable) {
+  if (!fileReadable) return { state: 'unreadable', expensive: [], scopedInNameOnly: [], why: 'the agent file could not be read' };
+  if (toolsLine == null) return { state: 'undeclared', expensive: [], scopedInNameOnly: [], why: 'the agent declares no tools: line' };
+  const r = postureOf(toolsLine);
+  return {
+    state: r.unknownTools.length ? 'unclassified' : r.expensive.length ? 'expensive' : 'routine',
+    expensive: r.expensive,
+    scopedInNameOnly: r.scopedInNameOnly,
+    unknownTools: r.unknownTools,
+    why: r.unknownTools.length ? `unclassified grant(s): ${r.unknownTools.join(', ')}` : '',
+  };
+}
+
   for (const f of files) {
     const slug = f.replace(/^great_cto-/, '').replace(/\.md$/, '');
     const fp = path.join(AGENTS_DIR, f);
     const raw = readFileSafe(fp) || '';
     const descM = raw.match(/^description:\s*"?([^"\n]+)"?/m);
     const modelM = raw.match(/^model:\s*(\S+)/m);
+    const toolsM = raw.match(/^tools:\s*(.*)$/m);
     const colorM = raw.match(/^color:\s*(\S+)/m);
 
     const vs = byAgent.get(slug) || [];
@@ -155,6 +178,11 @@ function getAgentsFleet(projectCwd) {
     // Estimated cost — DEFAULT_TASK_MIN per verdict (no real timing data here).
     const estLlmUsd   = (vs30d.length * DEFAULT_TASK_MIN / 60) * LLM_RATE_PER_HR;
     const estHumanUsd = (vs30d.length * DEFAULT_TASK_MIN / 60) * HUMAN_RATE_PER_HR;
+    // NOT a measurement. Both sides are runs x DEFAULT_TASK_MIN x a rate, so this
+    // ratio is HUMAN_RATE/LLM_RATE for every agent that ran at all — 500 by
+    // construction. metrics.mjs nulls its equivalent for exactly this reason;
+    // this one shipped as a per-agent number and read like one. Kept, because
+    // removing a field breaks the board, but labelled at the source.
     const savingsX = estLlmUsd > 0 ? Math.round(estHumanUsd / estLlmUsd) : null;
     const realLlmUsd = vs30d.reduce((s, v) => s + (v.cost_usd || 0), 0);
 
@@ -167,7 +195,18 @@ function getAgentsFleet(projectCwd) {
     agents.push({
       slug,
       description: descM?.[1]?.trim() || '',
-      model: modelM?.[1]?.trim() || 'sonnet',
+      // THREE states, not a default. `model: modelM || 'sonnet'` reported every
+      // agent with no `model:` line as pinned to sonnet, so "pinned to sonnet"
+      // and "not pinned at all" were the same string — and an unreadable agent
+      // file produced the same answer a third time. The fleet cannot show what
+      // it cannot distinguish.
+      model: raw ? (modelM?.[1]?.trim() ?? null) : null,
+      model_state: !raw ? 'unreadable' : modelM ? 'pinned' : 'undeclared',
+      // The tool grant, named in the language of consequence rather than listed.
+      // `/api/agents-installed` did not read `tools:` at all, so the board had
+      // nowhere to get it — scripts/lib/agent-posture.mjs has classified these
+      // since 3.24.0 and nothing was consuming it.
+      posture: posture(toolsM?.[1] ?? null, Boolean(raw)),
       color: colorM?.[1]?.trim() || null,
       domain: deriveDomain(slug),
       runs_total: vs.length,
@@ -182,6 +221,9 @@ function getAgentsFleet(projectCwd) {
       human_usd_30d_est: Math.round(estHumanUsd),
       llm_usd_30d_real: realLlmUsd > 0 ? Math.round(realLlmUsd * 100) / 100 : null,
       savings_x: savingsX,
+      // 'ratio' = the rate ratio, identical for every agent. 'measured' would
+      // require per-run timing, which no path produces today.
+      savings_source: savingsX == null ? null : 'ratio',
       health,
       retired: isRetired(slug),
       // Four states, and only `exceeded` can hold a dispatch — see

package/board/packages/board/lib/routes.mjs

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import { execFileSync } from 'child_process';
 import os from 'os';
 import {
   getVapidKeys,
@@ -27,6 +28,7 @@ import { upsertCapability, capabilitiesFromProjectMd } from '../../../scripts/li
 import { getAgentsFleet, getAgentProfile, retireAgent, restoreAgent, appendDecisionLog, readDecisionsLog } from './fleet.mjs';
 import { getResume, getShareState, toggleShare } from './share.mjs';
 import { listSessions, readSession, editedFiles, searchSessions } from './transcripts.mjs';
+import { recordView, summarizeViews } from './view-counter.mjs';
 
 // ── HTTP router ────────────────────────────────────────────────────────────────
 // dispatch(req, res, url, cwd, projInfo) handles every /api/* route plus /api/sse.
@@ -174,6 +176,65 @@ async function dispatch(req, res, url, cwd) {
     return true;
   }
 
+  // GET /api/views?since=<ISO>[&project=<name>]
+  //
+  // BRD-R9 (great_cto-ki1x.15): the only source for the K2/K3 kill-criteria in
+  // docs/product/BRIEF-board-redesign-2026-09.md and the 2026-09-20 kanban
+  // deep-link review already logged in .great_cto/decisions.md. Three states,
+  // not two — see lib/view-counter.mjs — mirroring the choice already made
+  // for /api/harnesses' evidence log just below: a line that fails to parse
+  // is counted in `unreadable_lines`, not silently dropped, and does not by
+  // itself flip the whole read to `unreadable`.
+  if (pathname === '/api/views' && req.method === 'GET') {
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    const since = url.searchParams.get('since') || null;
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(summarizeViews({ root: c, since })));
+    return true;
+  }
+
+  // POST /api/view  { view: 'decisions'|'ledger'|'fleet'|'harness'|'settings'|'kanban' }
+  //
+  // One line per top-level view open, appended to the resolved project's own
+  // `.great_cto/view-counter.log` — never sent anywhere (docs/PRIVACY.md:
+  // telemetry is opt-in and off by default; this is not telemetry, it is a
+  // local file). Guarded by origin like every other state-changing POST on
+  // this server (the board listens on 127.0.0.1, and a page the user happens
+  // to be visiting can still issue a simple cross-origin POST to localhost).
+  //
+  // Called once from switchTab() when the redesigned tabs land
+  // (great_cto-ki1x.5 / .13) — see that task's dispatch note for the exact line.
+  if (pathname === '/api/view' && req.method === 'POST') {
+    if (!originAllowed(req)) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'origin not allowed' }));
+      return true;
+    }
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    let body = '';
+    req.on('data', (ch) => { body += ch; if (body.length > 1024) req.destroy(); });
+    req.on('end', () => {
+      let parsed;
+      try { parsed = JSON.parse(body || '{}'); }
+      catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'invalid_json', message: String(e.message || e) }));
+        return;
+      }
+      const view = String(parsed.view || '');
+      try {
+        recordView({ root: c, view });
+      } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: String(e.message || e) }));
+        return;
+      }
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, view }));
+    });
+    return true;
+  }
+
   // ── /api/notifications — email alerts via greatcto.systems/notify relay ──
   // No API keys to manage — user enters only their email + verifies via
   // 6-digit code sent by our Cloudflare Worker. The Worker rate-limits to
@@ -598,6 +659,14 @@ async function dispatch(req, res, url, cwd) {
   // Inbox — what needs your attention right now
   if (pathname === '/api/inbox') {
     const inbox = getInbox(cwd);
+    // BRD-R3: the Decisions row shows both reviewers. The second opinion is a
+    // fact about the TREE, not about a gate — every pending gate on this tree
+    // shares it — so it is resolved once: the newest cross-review line whose
+    // `sha` is the current HEAD. Four states, none of which may read as a
+    // verdict: `not-run` (capability none / undeclared / unavailable),
+    // `unmeasured` (declared, no line for this sha), `unreadable` (only
+    // pre-join-key lines exist), `ok` (a paired verdict).
+    const second_opinion = secondOpinionForTree(cwd);
     // What is waiting on the person in their OTHER projects. The headline and
     // the badge are about the person, and the person is not scoped to `cwd`.
     // If the registry itself cannot be walked, say so — `unreadable` is not
@@ -606,7 +675,7 @@ async function dispatch(req, res, url, cwd) {
     try { elsewhere = inboxElsewhere(listProjects(), cwd, { readInbox: getInbox }); }
     catch (e) { elsewhere = { state: 'unreadable', why: String(e?.message || e) }; }
     res.writeHead(200, verdictHeaders(cwd, { 'Content-Type': 'application/json' }));
-    res.end(JSON.stringify({ ...inbox, elsewhere }));
+    res.end(JSON.stringify({ ...inbox, elsewhere, second_opinion }));
     return true;
   }
 
@@ -1518,14 +1587,26 @@ async function dispatch(req, res, url, cwd) {
     const tasks = getTasks(cwd);
     const nowMs = Date.now();
     const STUCK_H = 48;
-    const stuck = tasks
-      .filter(t => t.status === 'in_progress')
+    // `stuck` was ALWAYS EMPTY and had been since it was written. It read
+    // `t.startedAt`, a field no code path in this repository produces — a task
+    // carries created_at / updated_at / closed_at and nothing else. Every row
+    // got `age_h: null` and was removed by the filter below, so the panel
+    // reported "nothing is stuck" about a question it never asked. There are
+    // seven in-progress tasks here as this is written.
+    //
+    // `updated_at` is the honest proxy: in progress, and unchanged for STUCK_H.
+    // A task whose age cannot be determined is COUNTED, not dropped — an
+    // unmeasurable task is not a healthy one.
+    const inProgress = tasks.filter(t => t.status === 'in_progress');
+    let stuckUnmeasurable = 0;
+    const stuck = inProgress
       .map(t => {
-        const startedAt = t.startedAt ? new Date(t.startedAt).getTime() : null;
-        const ageH = startedAt ? (nowMs - startedAt) / 3600000 : null;
-        return { id: t.id, title: t.title, agent: t.agent, age_h: ageH ? Math.round(ageH) : null };
+        const since = t.updated_at || t.created_at || null;
+        const ms = since ? new Date(since).getTime() : NaN;
+        if (!Number.isFinite(ms)) { stuckUnmeasurable += 1; return null; }
+        return { id: t.id, title: t.title, agent: t.agent, age_h: Math.round((nowMs - ms) / 3600000), since };
       })
-      .filter(t => t.age_h !== null && t.age_h > STUCK_H);
+      .filter(t => t && t.age_h > STUCK_H);
 
     // Per-agent budgets from PROJECT.md
     const projectMdPath = path.join(cwd, '.great_cto', 'PROJECT.md');
@@ -1583,7 +1664,8 @@ async function dispatch(req, res, url, cwd) {
     // line the parser could not read is reported rather than dropped, because a
     // budget silently ignored is a limit its author believes they have.
     res.end(JSON.stringify({
-      stuck, budgets, goal_ancestry: goalAncestry, tool_failure_rate_1h: toolFailureRate1h,
+      stuck, stuck_in_progress: inProgress.length, stuck_unmeasurable: stuckUnmeasurable,
+      budgets, goal_ancestry: goalAncestry, tool_failure_rate_1h: toolFailureRate1h,
       budgets_deprecated_key: budgetsDeprecatedKey,
       budgets_malformed: budgetsMalformed,
       // Three states, not two: read / absent / unreadable. Without these, a
@@ -1627,11 +1709,29 @@ async function dispatch(req, res, url, cwd) {
       }
       evidence = evidence.slice(-20).reverse();
     } catch (e) { logState = e.code === 'ENOENT' ? 'absent' : 'unreadable'; }
+
+    // BRD-R2: a parsed row without a usable `sha` (BRD-R1's join key, additive
+    // since a2f5d4e7 — scripts/lib/cross-model-review.mjs) cannot be paired
+    // with the tree it reviewed. A verdict you cannot pair with a tree is not
+    // a verdict about this tree, so it renders `unreadable` here — distinct
+    // from `ok`/`skipped`/`BLOCK`, and from the whole-log `unreadable` state
+    // above (that one means "could not read the file"; this one means "read
+    // the line fine, but it predates the field"). `sha` must be a non-empty
+    // string: missing, `null`, or `''` all mean "not supplied". Verdict/cost
+    // are nulled in the response so neither renders as a real result; the
+    // original line is kept under `raw` so nothing is lost.
+    evidence = evidence.map((r) => (
+      typeof r.sha === 'string' && r.sha !== ''
+        ? r
+        : { ...r, state: 'unreadable', verdict: null, cost: null, raw: r }
+    ));
+
     const reviewed = evidence.filter((r) => r.state === 'ok');
     const summary = {
       runs: evidence.length,
       reviewed: reviewed.length,
-      skipped: evidence.filter((r) => r.state !== 'ok').length,
+      skipped: evidence.filter((r) => r.state !== 'ok' && r.state !== 'unreadable').length,
+      unreadable: evidence.filter((r) => r.state === 'unreadable').length,
       blocked: reviewed.filter((r) => r.verdict === 'BLOCK').length,
       unreadable_lines: unreadable,
     };
@@ -1844,4 +1944,42 @@ async function dispatch(req, res, url, cwd) {
   return false;
 }
 
+
+/**
+ * The second opinion as it applies to the tree at HEAD — what the Decisions
+ * row's Codex cell shows. Pure over the two files it reads (PROJECT.md and
+ * cross-review.log) plus `git rev-parse HEAD`; every failure is a state, never
+ * a throw, because "could not tell" is data for the row, not a reason to lose
+ * the inbox.
+ */
+export function secondOpinionForTree(c) {
+  let projectMd = null;
+  try { projectMd = fs.readFileSync(path.join(c, '.great_cto', 'PROJECT.md'), 'utf8'); } catch { projectMd = null; }
+  let declared = null;
+  try { declared = projectMd == null ? null : capabilitiesFromProjectMd(projectMd).map.second_opinion; } catch { declared = null; }
+  const tool = declared?.tool ?? null;
+  const declaredState = declared?.state ?? (projectMd == null ? 'no-project-md' : 'undeclared');
+  let head = null;
+  try { head = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: c, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null; } catch { head = null; }
+  const base = { declared: declaredState, tool, head, verdict: null, findings: null, p0: null, sha: null, ts: null };
+  if (declaredState !== 'declared' || !tool) {
+    return { ...base, state: 'not-run', why: declaredState === 'none' ? 'second_opinion: none — deliberately off' : 'no second opinion declared in PROJECT.md' };
+  }
+  let lines = [];
+  try { lines = fs.readFileSync(path.join(c, '.great_cto', 'cross-review.log'), 'utf8').trim().split('\n').filter(Boolean); }
+  catch { return { ...base, state: 'unmeasured', why: `declared (${tool}), no review has been written yet` }; }
+  const rows = [];
+  for (const line of lines) { try { rows.push(JSON.parse(line)); } catch { /* counted by /api/harnesses; not a verdict either way */ } }
+  const paired = rows.filter((r) => typeof r.sha === 'string' && r.sha !== '' && head && (r.sha === head || head.startsWith(r.sha) || r.sha.startsWith(head)) && r.state === 'ok');
+  if (paired.length) {
+    const r = paired[paired.length - 1];
+    return { ...base, state: 'ok', verdict: r.verdict ?? null, findings: r.findings ?? null, p0: r.p0 ?? null, sha: r.sha, ts: r.ts ?? null, why: '' };
+  }
+  const anyKeyed = rows.some((r) => typeof r.sha === 'string' && r.sha !== '');
+  if (!anyKeyed && rows.length) {
+    return { ...base, state: 'unreadable', why: `${rows.length} review line(s) predate the join key — none can be paired with this tree` };
+  }
+  return { ...base, state: 'unmeasured', why: `declared (${tool}), no review line for ${head ? head.slice(0, 8) : 'this tree'}` };
+}
+
 export { dispatch };

package/board/packages/board/lib/view-counter.mjs

@@ -0,0 +1,122 @@
+// BRD-R9 (great_cto-ki1x.15): a local, per-view request counter.
+//
+// Why this exists: every JTBD claim in the board redesign brief
+// (docs/product/BRIEF-board-redesign-2026-09.md) is otherwise an assumption.
+// This file is the one source the K2/K3 kill-criteria read from — Decisions
+// opened <5 days in a 14-day window → pivot; Fleet opened <4 times in 60 days
+// → delete — plus the 2026-09-20 kanban deep-link review already logged in
+// .great_cto/decisions.md.
+//
+// What this is NOT: telemetry. docs/PRIVACY.md requires telemetry to be
+// opt-in and off by default; this counter makes no network call, has no
+// endpoint that leaves the machine, and writes to a file under the caller's
+// OWN `.great_cto/` (project-scoped, same rule as decisionsLogPath in
+// fleet.mjs / ADR-008 — never a global/home-dir file another project's
+// agents could read).
+//
+// Kept pure on purpose (`root` and `at` are both injected): a test builds a
+// temp root and a fixed clock instead of touching the real filesystem or
+// wall clock, and the HTTP route in routes.mjs is the only caller that
+// supplies real values.
+import fs from 'fs';
+import path from 'path';
+
+// The only view names the redesigned IA renders (BRD-R8): Decisions, Ledger,
+// Fleet, Harness, Settings, plus the demoted-to-deep-link `kanban`. Anything
+// else is rejected outright, before any filesystem write — an unknown view
+// name written to this file would silently corrupt the K2/K3 counts it
+// exists to protect.
+const VALID_VIEWS = ['decisions', 'ledger', 'fleet', 'harness', 'settings', 'kanban'];
+
+function logFilePath(root) {
+  return path.join(root, '.great_cto', 'view-counter.log');
+}
+
+/**
+ * Append one line — `{"ts":<ISO>,"view":<name>}` — to `.great_cto/view-counter.log`.
+ * Append-only: never truncates, never rewrites a prior line. Creates the
+ * `.great_cto/` directory on first use.
+ *
+ * @param {{root:string, view:string, at?:Date}} args
+ * @throws if `view` is not one of VALID_VIEWS — nothing is written in that case.
+ */
+function recordView({ root, view, at = new Date() }) {
+  if (!VALID_VIEWS.includes(view)) {
+    throw new Error(`recordView: unknown view "${view}" — expected one of ${VALID_VIEWS.join(', ')}`);
+  }
+  const file = logFilePath(root);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.appendFileSync(file, JSON.stringify({ ts: at.toISOString(), view }) + '\n');
+}
+
+/**
+ * Summarize opens per view since `since` (inclusive; null/omitted = all time).
+ *
+ * Three states, not two (this repository's rule, e.g. routes.mjs `/api/harnesses`
+ * evidence log): a file that was never written is `absent` — DIFFERENT from
+ * `ok` with real zeros, which means "measured, and there were none". A file
+ * that exists but cannot even be opened (permission error, or a directory
+ * sitting where the file should be) is `unreadable`, carrying `why`.
+ *
+ * Within `ok`, an individual line that fails JSON.parse (or is missing a
+ * recognized `view`/`ts`) does NOT flip the file to `unreadable` — it is
+ * counted in `unreadable_lines` and skipped, same as the existing
+ * cross-review.log parser in routes.mjs: "unparseable lines are counted, not
+ * dropped, so a corrupted log does not read as a quiet one."
+ *
+ * @param {{root:string, since?:string|null}} args
+ * @returns {{state:'absent'}
+ *          |{state:'unreadable', why:string}
+ *          |{state:'ok', since:string|null, views:Record<string,{opens:number,days_with_opens:number,first:string|null,last:string|null}>, unreadable_lines:number}}
+ */
+function summarizeViews({ root, since = null }) {
+  const file = logFilePath(root);
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (e) {
+    if (e && e.code === 'ENOENT') return { state: 'absent' };
+    return { state: 'unreadable', why: String(e?.message || e) };
+  }
+
+  const sinceMs = since ? new Date(since).getTime() : -Infinity;
+  const views = {};
+  const daysSeen = {};
+  for (const v of VALID_VIEWS) {
+    views[v] = { opens: 0, days_with_opens: 0, first: null, last: null };
+    daysSeen[v] = new Set();
+  }
+
+  let unreadableLines = 0;
+  for (const line of raw.split('\n')) {
+    if (!line.trim()) continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      unreadableLines += 1;
+      continue;
+    }
+    if (!row || typeof row.view !== 'string' || !VALID_VIEWS.includes(row.view) || typeof row.ts !== 'string') {
+      unreadableLines += 1;
+      continue;
+    }
+    const ms = new Date(row.ts).getTime();
+    if (!Number.isFinite(ms)) {
+      unreadableLines += 1;
+      continue;
+    }
+    if (ms < sinceMs) continue; // outside the requested window — filtered, not unreadable
+
+    const bucket = views[row.view];
+    bucket.opens += 1;
+    if (bucket.first == null || ms < new Date(bucket.first).getTime()) bucket.first = row.ts;
+    if (bucket.last == null || ms > new Date(bucket.last).getTime()) bucket.last = row.ts;
+    daysSeen[row.view].add(row.ts.slice(0, 10)); // YYYY-MM-DD, UTC by construction (toISOString)
+  }
+  for (const v of VALID_VIEWS) views[v].days_with_opens = daysSeen[v].size;
+
+  return { state: 'ok', since: since ?? null, views, unreadable_lines: unreadableLines };
+}
+
+export { recordView, summarizeViews, VALID_VIEWS };