great-cto 3.31.0 → 3.32.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 70 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.31.0",
+  "version": "3.32.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"
@@ -251,6 +251,11 @@
             "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-end.mjs\" 2>/dev/null; true",
             "timeout": 8,
             "statusMessage": "Saving session summary..."
+          },
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-status.mjs\" 2>/dev/null; true",
+            "timeout": 5
           }
         ]
       }
@@ -273,6 +278,11 @@
             "type": "command",
             "command": "[ -n \"$GREAT_CTO_CLASS_TELEMETRY\" ] && { PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/classify-telemetry.mjs\" 2>/dev/null; }; true",
             "timeout": 3
+          },
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-status.mjs\" 2>/dev/null; true",
+            "timeout": 5
           }
         ]
       }
@@ -309,6 +319,23 @@
             "type": "command",
             "async": true,
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/register-project.mjs\" 2>/dev/null || true"
+          },
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-status.mjs\" 2>/dev/null; true",
+            "timeout": 5
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/session-status.mjs\" 2>/dev/null; true",
+            "timeout": 5
           }
         ]
       }

package/board/packages/board/lib/routes.mjs

@@ -14,6 +14,7 @@ import { autoRegisterProject, listProjects, resolveProjectCwd, resolveProjectInf
 import { readVerdictsWithHealth } from './verdicts.mjs';
 import { agentUsage, usageSnapshot } from '../../../scripts/lib/agent-usage.mjs';
 import { reviewerStatus } from '../../../scripts/lib/required-reviewers.mjs';
+import { readSessionStatus } from '../../../scripts/lib/session-status.mjs';
 import { readScores, summarizeScores } from '../../../scripts/lib/scores.mjs';
 import { status as routerKeyStatus, writeKey as writeRouterKey, verifyKey as verifyRouterKey } from '../../../scripts/lib/router-key.mjs';
 
@@ -1470,6 +1471,15 @@ async function dispatch(req, res, url, cwd) {
 
   // Domain reviewers this project's PROJECT.md requires (archetype, packs,
   // compliance), each with whether a verdict exists — the list gate:ship refuses on.
+  // Sessions in this project that wait for a person — written by the
+  // Notification / Stop / UserPromptSubmit hooks (scripts/lib/session-status.mjs).
+  if (pathname === '/api/session-status') {
+    const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
+    res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+    res.end(JSON.stringify({ sessions: c ? readSessionStatus(c) : [] }));
+    return true;
+  }
+
   if (pathname === '/api/required-reviewers') {
     const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
     res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });

package/board/packages/board/public/index.html

@@ -1696,6 +1696,15 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .pl-stage.pl-compact .pl-name { color: var(--text2); }
 .pl-stage.active { flex: 2; }
 /* Idle-focus all-clear card (shown when nothing needs a decision). */
+/* A session stopped on a permission prompt or an unanswered wait — the one piece
+   of session status the operator can act on, so it is styled like a decision. */
+.session-blocked {
+  padding: 6px 10px;
+  margin-bottom: 4px;
+  border-left: 3px solid var(--status-blocked);
+  background: var(--bg-elevated);
+}
+
 .inbox-allclear {
   display: flex; align-items: center; gap: 14px;
   padding: 22px 22px; margin-top: 4px;
@@ -3399,6 +3408,10 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
              two speaking states render into #inbox-receipt-foot at the bottom of
              this page (see refreshReceipt). -->
         <div id="inbox-receipt" style="display:none;margin:6px 0 2px;font-size:var(--fs-small)"></div>
+        <!-- Sessions stopped on the operator: a permission prompt, or idle waiting for
+             an answer (Notification hook → .great_cto/status/). The one piece of
+             status that IS a decision, so it sits above the status disclosure. -->
+        <div id="inbox-sessions" style="display:none;margin:6px 0 10px;font-size:var(--fs-small)"></div>
         <!-- Everything below is STATUS, and status is not a decision.
 
              Six of the seven blocks on this screen were read-only: a pipeline rail,
@@ -4673,7 +4686,28 @@ function renderInboxList(rootId, items, countId, opts = {}) {
   }).join('');
 }
 
+// Sessions waiting on a person (scripts/lib/session-status.mjs). `blocked` is a
+// prompt or an unanswered wait and gets a row; `waiting` (turn ended) is what every
+// open session is between turns, so it is one muted count, not a row each.
+async function refreshSessionStatus() {
+  const el = document.getElementById('inbox-sessions');
+  if (!el) return;
+  const r = await api(`/api/session-status${pqs()}`);
+  const rows = (r && Array.isArray(r.sessions)) ? r.sessions : [];
+  const blocked = rows.filter((x) => x.state === 'blocked');
+  const waiting = rows.filter((x) => x.state === 'waiting').length;
+  if (!blocked.length && !waiting) { el.style.display = 'none'; el.innerHTML = ''; return; }
+  el.style.display = '';
+  el.innerHTML = blocked.map((x) => `<div class="session-blocked">
+      <strong>⏸ session ${esc(String(x.session).slice(0, 8))} waits for you</strong>
+      <span class="muted">· ${esc(agoStr(x.since))}${x.kind ? ` · ${esc(x.kind)}` : ''}</span><br>
+      <span>${esc(x.reason || 'waiting for input')}</span>
+    </div>`).join('')
+    + (waiting ? `<div class="muted" title="these sessions finished their turn; the next message is yours">${waiting} session${waiting === 1 ? '' : 's'} finished a turn and wait for your next message</div>` : '');
+}
+
 async function refreshInbox() {
+  refreshSessionStatus();
   // Tiers first: the gate rows are rendered from this same call, and a row drawn
   // before the tiers arrive would silently claim every gate is waiting.
   await refreshGateTiers();

package/board/scripts/lib/agent-posture.mjs

@@ -134,6 +134,9 @@ const TOOL_POSTURES = Object.freeze({
   WebSearch: ['network.fetch', 'communication.external.send'],
   Agent: ['process.spawn'],
   Task: ['process.spawn'],
+  // Loads a skill's text into the agent's context. It grants no tool the agent does
+  // not already hold: the skill runs with the agent's own grants.
+  Skill: ['code.read'],
 });
 
 /** MCP and beta tools, matched by prefix — the list of these grows monthly. */

package/board/scripts/lib/session-status.mjs

@@ -0,0 +1,91 @@
+/**
+ * session-status — which sessions in this project are waiting for a person.
+ *
+ * Nothing showed it. On the projects measured on 2026-09-21 the operator was the
+ * approval loop (1,181 "делай" in 5,126 messages), and the board could not say
+ * which session was sitting on a permission prompt or had finished its turn and
+ * was waiting for an answer. Idea from fynnfluegge/agtx (Apache-2.0), which drives
+ * its board from the same hook events; the code here is written for this project.
+ *
+ * Three hook events write one small file per session, `.great_cto/status/<id>.json`:
+ *
+ *   Notification      → blocked  (a permission prompt, or idle waiting for input;
+ *                                 the notification's own message is the reason)
+ *   Stop              → waiting  (the turn ended; the next move is the operator's)
+ *   UserPromptSubmit  → working
+ *   SessionEnd        → the file is removed
+ *
+ * A hook only fires on the transitions it is told about, so a state can go stale:
+ * a permission granted fires no event. The reader therefore checks the session's
+ * transcript — if it was written after the blocked/waiting moment, the session has
+ * moved on and is reported as working. A `working` with a silent transcript for
+ * five minutes is `unknown`, not working (agtx uses the same bound).
+ */
+import { mkdirSync, writeFileSync, readFileSync, readdirSync, statSync, rmSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+
+export const STALE_WORKING_MS = 5 * 60 * 1000;
+export const MOVED_ON_SLACK_MS = 2000;
+export const DROP_AFTER_MS = 24 * 60 * 60 * 1000;
+
+const EVENT_STATE = { Notification: 'blocked', Stop: 'waiting', UserPromptSubmit: 'working' };
+
+const safeId = (id) => String(id || '').replace(/[^A-Za-z0-9_-]/g, '').slice(0, 64);
+
+/** Apply one hook payload. Returns what was written, or null when nothing applies. */
+export function recordHookEvent(payload, { now = Date.now() } = {}) {
+  const cwd = payload?.cwd || process.cwd();
+  const id = safeId(payload?.session_id);
+  if (!id) return null;
+  const dir = join(cwd, '.great_cto', 'status');
+  const file = join(dir, `${id}.json`);
+  const event = payload?.hook_event_name;
+  if (event === 'SessionEnd') { rmSync(file, { force: true }); return { removed: true }; }
+  const state = EVENT_STATE[event];
+  if (!state) return null;
+  try { statSync(join(cwd, '.great_cto')); } catch { return null; } // not a great_cto project
+  const rec = {
+    session: id,
+    state,
+    since: new Date(now).toISOString(),
+    transcript: payload.transcript_path || null,
+  };
+  if (state === 'blocked') {
+    rec.reason = String(payload.message || 'waiting for you').slice(0, 300);
+    if (payload.notification_type) rec.kind = String(payload.notification_type).slice(0, 40);
+  }
+  mkdirSync(dir, { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(rec));
+  renameSync(tmp, file);
+  return rec;
+}
+
+/**
+ * The effective state of every session with a status file.
+ * @returns {{session:string, state:'blocked'|'waiting'|'working'|'unknown', reason?:string, kind?:string, since:string}[]}
+ */
+export function readSessionStatus(projectDir, { now = Date.now() } = {}) {
+  const dir = join(projectDir, '.great_cto', 'status');
+  let files = [];
+  try { files = readdirSync(dir).filter((f) => f.endsWith('.json')); } catch { return []; }
+  const out = [];
+  for (const f of files) {
+    let rec;
+    try { rec = JSON.parse(readFileSync(join(dir, f), 'utf8')); } catch { continue; }
+    const since = Date.parse(rec.since);
+    if (!Number.isFinite(since) || now - since > DROP_AFTER_MS) continue;
+    let moved = null;
+    if (rec.transcript) {
+      try { moved = statSync(rec.transcript).mtimeMs; } catch { moved = null; }
+    }
+    let state = rec.state;
+    if ((state === 'blocked' || state === 'waiting') && moved !== null && moved > since + MOVED_ON_SLACK_MS) state = 'working';
+    if (state === 'working' && now - Math.max(since, moved || 0) > STALE_WORKING_MS) state = 'unknown';
+    const row = { session: rec.session, state, since: rec.since };
+    if (state === 'blocked') { row.reason = rec.reason; if (rec.kind) row.kind = rec.kind; }
+    out.push(row);
+  }
+  const rank = { blocked: 0, waiting: 1, working: 2, unknown: 3 };
+  return out.sort((a, b) => rank[a.state] - rank[b.state] || (a.since < b.since ? -1 : 1));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.31.0",
+  "version": "3.32.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",