great-cto 3.26.4 → 3.27.1

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.26.4",
+  "version": "3.27.1",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/lib/routes.mjs

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import { execFileSync } from 'child_process';
 import os from 'os';
 import {
   getVapidKeys,
@@ -27,6 +28,7 @@ import { upsertCapability, capabilitiesFromProjectMd } from '../../../scripts/li
 import { getAgentsFleet, getAgentProfile, retireAgent, restoreAgent, appendDecisionLog, readDecisionsLog } from './fleet.mjs';
 import { getResume, getShareState, toggleShare } from './share.mjs';
 import { listSessions, readSession, editedFiles, searchSessions } from './transcripts.mjs';
+import { recordView, summarizeViews } from './view-counter.mjs';
 
 // ── HTTP router ────────────────────────────────────────────────────────────────
 // dispatch(req, res, url, cwd, projInfo) handles every /api/* route plus /api/sse.
@@ -174,6 +176,65 @@ async function dispatch(req, res, url, cwd) {
     return true;
   }
 
+  // GET /api/views?since=<ISO>[&project=<name>]
+  //
+  // BRD-R9 (great_cto-ki1x.15): the only source for the K2/K3 kill-criteria in
+  // docs/product/BRIEF-board-redesign-2026-09.md and the 2026-09-20 kanban
+  // deep-link review already logged in .great_cto/decisions.md. Three states,
+  // not two — see lib/view-counter.mjs — mirroring the choice already made
+  // for /api/harnesses' evidence log just below: a line that fails to parse
+  // is counted in `unreadable_lines`, not silently dropped, and does not by
+  // itself flip the whole read to `unreadable`.
+  if (pathname === '/api/views' && req.method === 'GET') {
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    const since = url.searchParams.get('since') || null;
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify(summarizeViews({ root: c, since })));
+    return true;
+  }
+
+  // POST /api/view  { view: 'decisions'|'ledger'|'fleet'|'harness'|'settings'|'kanban' }
+  //
+  // One line per top-level view open, appended to the resolved project's own
+  // `.great_cto/view-counter.log` — never sent anywhere (docs/PRIVACY.md:
+  // telemetry is opt-in and off by default; this is not telemetry, it is a
+  // local file). Guarded by origin like every other state-changing POST on
+  // this server (the board listens on 127.0.0.1, and a page the user happens
+  // to be visiting can still issue a simple cross-origin POST to localhost).
+  //
+  // Called once from switchTab() when the redesigned tabs land
+  // (great_cto-ki1x.5 / .13) — see that task's dispatch note for the exact line.
+  if (pathname === '/api/view' && req.method === 'POST') {
+    if (!originAllowed(req)) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'origin not allowed' }));
+      return true;
+    }
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    let body = '';
+    req.on('data', (ch) => { body += ch; if (body.length > 1024) req.destroy(); });
+    req.on('end', () => {
+      let parsed;
+      try { parsed = JSON.parse(body || '{}'); }
+      catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'invalid_json', message: String(e.message || e) }));
+        return;
+      }
+      const view = String(parsed.view || '');
+      try {
+        recordView({ root: c, view });
+      } catch (e) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: String(e.message || e) }));
+        return;
+      }
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, view }));
+    });
+    return true;
+  }
+
   // ── /api/notifications — email alerts via greatcto.systems/notify relay ──
   // No API keys to manage — user enters only their email + verifies via
   // 6-digit code sent by our Cloudflare Worker. The Worker rate-limits to
@@ -598,6 +659,14 @@ async function dispatch(req, res, url, cwd) {
   // Inbox — what needs your attention right now
   if (pathname === '/api/inbox') {
     const inbox = getInbox(cwd);
+    // BRD-R3: the Decisions row shows both reviewers. The second opinion is a
+    // fact about the TREE, not about a gate — every pending gate on this tree
+    // shares it — so it is resolved once: the newest cross-review line whose
+    // `sha` is the current HEAD. Four states, none of which may read as a
+    // verdict: `not-run` (capability none / undeclared / unavailable),
+    // `unmeasured` (declared, no line for this sha), `unreadable` (only
+    // pre-join-key lines exist), `ok` (a paired verdict).
+    const second_opinion = secondOpinionForTree(cwd);
     // What is waiting on the person in their OTHER projects. The headline and
     // the badge are about the person, and the person is not scoped to `cwd`.
     // If the registry itself cannot be walked, say so — `unreadable` is not
@@ -606,7 +675,7 @@ async function dispatch(req, res, url, cwd) {
     try { elsewhere = inboxElsewhere(listProjects(), cwd, { readInbox: getInbox }); }
     catch (e) { elsewhere = { state: 'unreadable', why: String(e?.message || e) }; }
     res.writeHead(200, verdictHeaders(cwd, { 'Content-Type': 'application/json' }));
-    res.end(JSON.stringify({ ...inbox, elsewhere }));
+    res.end(JSON.stringify({ ...inbox, elsewhere, second_opinion }));
     return true;
   }
 
@@ -1640,11 +1709,29 @@ async function dispatch(req, res, url, cwd) {
       }
       evidence = evidence.slice(-20).reverse();
     } catch (e) { logState = e.code === 'ENOENT' ? 'absent' : 'unreadable'; }
+
+    // BRD-R2: a parsed row without a usable `sha` (BRD-R1's join key, additive
+    // since a2f5d4e7 — scripts/lib/cross-model-review.mjs) cannot be paired
+    // with the tree it reviewed. A verdict you cannot pair with a tree is not
+    // a verdict about this tree, so it renders `unreadable` here — distinct
+    // from `ok`/`skipped`/`BLOCK`, and from the whole-log `unreadable` state
+    // above (that one means "could not read the file"; this one means "read
+    // the line fine, but it predates the field"). `sha` must be a non-empty
+    // string: missing, `null`, or `''` all mean "not supplied". Verdict/cost
+    // are nulled in the response so neither renders as a real result; the
+    // original line is kept under `raw` so nothing is lost.
+    evidence = evidence.map((r) => (
+      typeof r.sha === 'string' && r.sha !== ''
+        ? r
+        : { ...r, state: 'unreadable', verdict: null, cost: null, raw: r }
+    ));
+
     const reviewed = evidence.filter((r) => r.state === 'ok');
     const summary = {
       runs: evidence.length,
       reviewed: reviewed.length,
-      skipped: evidence.filter((r) => r.state !== 'ok').length,
+      skipped: evidence.filter((r) => r.state !== 'ok' && r.state !== 'unreadable').length,
+      unreadable: evidence.filter((r) => r.state === 'unreadable').length,
       blocked: reviewed.filter((r) => r.verdict === 'BLOCK').length,
       unreadable_lines: unreadable,
     };
@@ -1857,4 +1944,42 @@ async function dispatch(req, res, url, cwd) {
   return false;
 }
 
+
+/**
+ * The second opinion as it applies to the tree at HEAD — what the Decisions
+ * row's Codex cell shows. Pure over the two files it reads (PROJECT.md and
+ * cross-review.log) plus `git rev-parse HEAD`; every failure is a state, never
+ * a throw, because "could not tell" is data for the row, not a reason to lose
+ * the inbox.
+ */
+export function secondOpinionForTree(c) {
+  let projectMd = null;
+  try { projectMd = fs.readFileSync(path.join(c, '.great_cto', 'PROJECT.md'), 'utf8'); } catch { projectMd = null; }
+  let declared = null;
+  try { declared = projectMd == null ? null : capabilitiesFromProjectMd(projectMd).map.second_opinion; } catch { declared = null; }
+  const tool = declared?.tool ?? null;
+  const declaredState = declared?.state ?? (projectMd == null ? 'no-project-md' : 'undeclared');
+  let head = null;
+  try { head = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: c, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim() || null; } catch { head = null; }
+  const base = { declared: declaredState, tool, head, verdict: null, findings: null, p0: null, sha: null, ts: null };
+  if (declaredState !== 'declared' || !tool) {
+    return { ...base, state: 'not-run', why: declaredState === 'none' ? 'second_opinion: none — deliberately off' : 'no second opinion declared in PROJECT.md' };
+  }
+  let lines = [];
+  try { lines = fs.readFileSync(path.join(c, '.great_cto', 'cross-review.log'), 'utf8').trim().split('\n').filter(Boolean); }
+  catch { return { ...base, state: 'unmeasured', why: `declared (${tool}), no review has been written yet` }; }
+  const rows = [];
+  for (const line of lines) { try { rows.push(JSON.parse(line)); } catch { /* counted by /api/harnesses; not a verdict either way */ } }
+  const paired = rows.filter((r) => typeof r.sha === 'string' && r.sha !== '' && head && (r.sha === head || head.startsWith(r.sha) || r.sha.startsWith(head)) && r.state === 'ok');
+  if (paired.length) {
+    const r = paired[paired.length - 1];
+    return { ...base, state: 'ok', verdict: r.verdict ?? null, findings: r.findings ?? null, p0: r.p0 ?? null, sha: r.sha, ts: r.ts ?? null, why: '' };
+  }
+  const anyKeyed = rows.some((r) => typeof r.sha === 'string' && r.sha !== '');
+  if (!anyKeyed && rows.length) {
+    return { ...base, state: 'unreadable', why: `${rows.length} review line(s) predate the join key — none can be paired with this tree` };
+  }
+  return { ...base, state: 'unmeasured', why: `declared (${tool}), no review line for ${head ? head.slice(0, 8) : 'this tree'}` };
+}
+
 export { dispatch };

package/board/packages/board/lib/view-counter.mjs

@@ -0,0 +1,122 @@
+// BRD-R9 (great_cto-ki1x.15): a local, per-view request counter.
+//
+// Why this exists: every JTBD claim in the board redesign brief
+// (docs/product/BRIEF-board-redesign-2026-09.md) is otherwise an assumption.
+// This file is the one source the K2/K3 kill-criteria read from — Decisions
+// opened <5 days in a 14-day window → pivot; Fleet opened <4 times in 60 days
+// → delete — plus the 2026-09-20 kanban deep-link review already logged in
+// .great_cto/decisions.md.
+//
+// What this is NOT: telemetry. docs/PRIVACY.md requires telemetry to be
+// opt-in and off by default; this counter makes no network call, has no
+// endpoint that leaves the machine, and writes to a file under the caller's
+// OWN `.great_cto/` (project-scoped, same rule as decisionsLogPath in
+// fleet.mjs / ADR-008 — never a global/home-dir file another project's
+// agents could read).
+//
+// Kept pure on purpose (`root` and `at` are both injected): a test builds a
+// temp root and a fixed clock instead of touching the real filesystem or
+// wall clock, and the HTTP route in routes.mjs is the only caller that
+// supplies real values.
+import fs from 'fs';
+import path from 'path';
+
+// The only view names the redesigned IA renders (BRD-R8): Decisions, Ledger,
+// Fleet, Harness, Settings, plus the demoted-to-deep-link `kanban`. Anything
+// else is rejected outright, before any filesystem write — an unknown view
+// name written to this file would silently corrupt the K2/K3 counts it
+// exists to protect.
+const VALID_VIEWS = ['decisions', 'ledger', 'fleet', 'harness', 'settings', 'kanban'];
+
+function logFilePath(root) {
+  return path.join(root, '.great_cto', 'view-counter.log');
+}
+
+/**
+ * Append one line — `{"ts":<ISO>,"view":<name>}` — to `.great_cto/view-counter.log`.
+ * Append-only: never truncates, never rewrites a prior line. Creates the
+ * `.great_cto/` directory on first use.
+ *
+ * @param {{root:string, view:string, at?:Date}} args
+ * @throws if `view` is not one of VALID_VIEWS — nothing is written in that case.
+ */
+function recordView({ root, view, at = new Date() }) {
+  if (!VALID_VIEWS.includes(view)) {
+    throw new Error(`recordView: unknown view "${view}" — expected one of ${VALID_VIEWS.join(', ')}`);
+  }
+  const file = logFilePath(root);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.appendFileSync(file, JSON.stringify({ ts: at.toISOString(), view }) + '\n');
+}
+
+/**
+ * Summarize opens per view since `since` (inclusive; null/omitted = all time).
+ *
+ * Three states, not two (this repository's rule, e.g. routes.mjs `/api/harnesses`
+ * evidence log): a file that was never written is `absent` — DIFFERENT from
+ * `ok` with real zeros, which means "measured, and there were none". A file
+ * that exists but cannot even be opened (permission error, or a directory
+ * sitting where the file should be) is `unreadable`, carrying `why`.
+ *
+ * Within `ok`, an individual line that fails JSON.parse (or is missing a
+ * recognized `view`/`ts`) does NOT flip the file to `unreadable` — it is
+ * counted in `unreadable_lines` and skipped, same as the existing
+ * cross-review.log parser in routes.mjs: "unparseable lines are counted, not
+ * dropped, so a corrupted log does not read as a quiet one."
+ *
+ * @param {{root:string, since?:string|null}} args
+ * @returns {{state:'absent'}
+ *          |{state:'unreadable', why:string}
+ *          |{state:'ok', since:string|null, views:Record<string,{opens:number,days_with_opens:number,first:string|null,last:string|null}>, unreadable_lines:number}}
+ */
+function summarizeViews({ root, since = null }) {
+  const file = logFilePath(root);
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch (e) {
+    if (e && e.code === 'ENOENT') return { state: 'absent' };
+    return { state: 'unreadable', why: String(e?.message || e) };
+  }
+
+  const sinceMs = since ? new Date(since).getTime() : -Infinity;
+  const views = {};
+  const daysSeen = {};
+  for (const v of VALID_VIEWS) {
+    views[v] = { opens: 0, days_with_opens: 0, first: null, last: null };
+    daysSeen[v] = new Set();
+  }
+
+  let unreadableLines = 0;
+  for (const line of raw.split('\n')) {
+    if (!line.trim()) continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      unreadableLines += 1;
+      continue;
+    }
+    if (!row || typeof row.view !== 'string' || !VALID_VIEWS.includes(row.view) || typeof row.ts !== 'string') {
+      unreadableLines += 1;
+      continue;
+    }
+    const ms = new Date(row.ts).getTime();
+    if (!Number.isFinite(ms)) {
+      unreadableLines += 1;
+      continue;
+    }
+    if (ms < sinceMs) continue; // outside the requested window — filtered, not unreadable
+
+    const bucket = views[row.view];
+    bucket.opens += 1;
+    if (bucket.first == null || ms < new Date(bucket.first).getTime()) bucket.first = row.ts;
+    if (bucket.last == null || ms > new Date(bucket.last).getTime()) bucket.last = row.ts;
+    daysSeen[row.view].add(row.ts.slice(0, 10)); // YYYY-MM-DD, UTC by construction (toISOString)
+  }
+  for (const v of VALID_VIEWS) views[v].days_with_opens = daysSeen[v].size;
+
+  return { state: 'ok', since: since ?? null, views, unreadable_lines: unreadableLines };
+}
+
+export { recordView, summarizeViews, VALID_VIEWS };