great-cto 3.40.1 → 3.42.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 71 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.40.1",
+  "version": "3.42.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"
@@ -162,6 +162,12 @@
             "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | awk -F'/plugins/cache/' '{split($NF,p,\"/\"); print p[3], $0}' | sort -V | tail -1 | cut -d' ' -f2- | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/destructive-guard.mjs\"; EXIT=$?; if [ $EXIT -eq 2 ]; then exit 2; fi; exit 0",
             "timeout": 5,
             "statusMessage": "Destructive-command check..."
+          },
+          {
+            "type": "command",
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | awk -F'/plugins/cache/' '{split($NF,p,\"/\"); print p[3], $0}' | sort -V | tail -1 | cut -d' ' -f2- | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/frozen-gates-guard.mjs\"; EXIT=$?; if [ $EXIT -eq 2 ]; then exit 2; fi; exit 0",
+            "timeout": 5,
+            "statusMessage": "Checking for writes to frozen gates..."
           }
         ]
       },
@@ -191,6 +197,12 @@
             "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | awk -F'/plugins/cache/' '{split($NF,p,\"/\"); print p[3], $0}' | sort -V | tail -1 | cut -d' ' -f2- | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/edit-scope-guard.mjs\" 2>&1; EXIT=$?; if [ $EXIT -eq 2 ]; then exit 2; fi; exit 0",
             "timeout": 5,
             "statusMessage": "Checking edit scope..."
+          },
+          {
+            "type": "command",
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; PLUGIN_DIR=${CLAUDE_PLUGIN_ROOT:-$(ls -d ~/.claude/plugins/cache/*/great_cto/*/ 2>/dev/null | awk -F'/plugins/cache/' '{split($NF,p,\"/\"); print p[3], $0}' | sort -V | tail -1 | cut -d' ' -f2- | sed 's|/$||')}; node \"${PLUGIN_DIR}/scripts/hooks/edit-impact.mjs\" 2>/dev/null; exit 0",
+            "timeout": 5,
+            "statusMessage": "Finding what depends on this file..."
           }
         ]
       }

package/dist/codex.js

@@ -48,12 +48,13 @@ export function codexInstallPlan({ repoDir, codexOnPath }) {
             "skills — all of them, the same tree Claude Code reads",
             "the MCP server (great_cto), resolved from npm",
             "the controlled role pipeline — run `npx --yes great-cto codex-host doctor` then `npx --yes great-cto codex-host start`",
+            "six safety guards as Codex plugin hooks (destructive commands, gate bypasses, a neighbour session's work, secrets in files, frozen gates, weakened checks) — Codex asks you to review them once on the next interactive `codex` start; they do not run until you do",
         ],
-        // Checked across every shipped Codex plugin: no manifest declares any of
-        // these. Saying "installed" without saying this would promise a pipeline the
-        // host cannot run.
+        // Codex runs plugin hooks (verified 2026-09-28, codex-cli 0.153.4) but has no
+        // plugin surface for commands or role agents. Saying "installed" without saying
+        // this would promise a pipeline the host cannot run.
         notSupported: [
-            "native hooks — no plugin surface; ordinary Codex sessions do not inherit controller gates or secret-scan",
+            "the rest of the Claude Code hooks — pipeline dispatch, cost guard, write log, format and type checks — only the safety guards are ported",
             "slash commands — no plugin surface",
             "native role agents — Codex plugins carry interface metadata; controlled roles run only through `npx --yes great-cto codex-host`",
         ],

package/dist/main.js

@@ -68,6 +68,8 @@ function parseArgs(argv) {
         noLlm: false,
         host: null,
         upgradeSelf: false,
+        purgeData: false,
+        projects: false,
         positional: [],
     };
     const rest = [];
@@ -133,6 +135,12 @@ function parseArgs(argv) {
             args.command = "report";
         else if (a === "upgrade")
             args.command = "upgrade";
+        else if (a === "uninstall")
+            args.command = "uninstall";
+        else if (a === "--purge-data")
+            args.purgeData = true;
+        else if (a === "--projects")
+            args.projects = true;
         else if (a === "--self")
             args.upgradeSelf = true;
         else if (a === "task") {
@@ -608,6 +616,109 @@ async function runBoardUninstallDaemon(args) {
     log(`  ${green("✓")} board daemon removed. (A running board keeps running — stop it with a new \`board\` or reboot.)`);
     return 0;
 }
+/**
+ * `great-cto uninstall` — plan by default, act on --yes. See uninstall.ts for what
+ * counts as an artefact, as user data and as host-owned; this function adds the two
+ * steps that need the platform: stopping the board and unloading its service.
+ */
+async function runUninstall(args) {
+    const { planUninstall, applyUninstall } = await import("./uninstall.js");
+    const { spawnSync } = await import("node:child_process");
+    const home = homedir();
+    const spec = daemonSpec(process.platform, { nodePath: process.execPath, cliPath: cliEntryPath(), port: args.boardPort, home });
+    let psText = "";
+    try {
+        psText = execFileSync("ps", ["eww", "-A", "-o", "command="], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 });
+    }
+    catch { /* no ps: nothing is known live */ }
+    // The nightly loop's agent is written by scripts/nightly-loop.sh (a maintainer tool), not by an install — but it is ours.
+    const nightly = process.platform === "darwin" ? join(home, "Library", "LaunchAgents", "systems.greatcto.nightly-loop.plist") : "";
+    const plan = planUninstall({ home, psText, daemonUnitPaths: [spec.unitPath, nightly].filter(Boolean), includeProjects: args.projects });
+    const short = (p) => p.replace(home, "~");
+    const group = (title, items) => {
+        if (!items.length)
+            return;
+        log(`  ${bold(title)} ${dim(`(${items.length})`)}`);
+        for (const i of items.slice(0, 8))
+            log(`    ${short(i)}`);
+        if (items.length > 8)
+            log(dim(`    … and ${items.length - 8} more`));
+    };
+    log(`${bold("great-cto uninstall")} ${args.yes ? "" : dim("— plan only; nothing is changed without --yes")}`);
+    log("");
+    log(green("Removes") + dim(" — what an install wrote"));
+    group("plugin versions", plan.pluginVersions);
+    group("agents (marked great_cto-managed)", plan.agents);
+    group("commands (marked great_cto-managed)", plan.commands);
+    if (plan.settingsKeys.length)
+        log(`  ${bold("~/.claude/settings.json")} enabledPlugins: ${plan.settingsKeys.join(", ")} ${dim("(backed up first)")}`);
+    if (plan.installedKeys.length)
+        log(`  ${bold("installed_plugins.json")}: ${plan.installedKeys.join(", ")} ${dim("(backed up first)")}`);
+    group("background services", plan.daemonUnits);
+    log(`  ${bold("board")} ${dim("— the running board process, if any, is stopped")}`);
+    const welcomed = plan.caches.filter((c) => /\/\.welcomed-/.test(c));
+    group("caches in ~/.great_cto (clones, registries, runtime files)", [
+        ...(welcomed.length ? [`~/.great_cto/.welcomed-* (${welcomed.length} markers)`] : []),
+        ...plan.caches.filter((c) => !welcomed.includes(c)),
+    ]);
+    group("pre-push hooks init wrote into projects", plan.projectHooks);
+    const nothing = !plan.pluginVersions.length && !plan.agents.length && !plan.commands.length && !plan.settingsKeys.length
+        && !plan.installedKeys.length && !plan.daemonUnits.length && !plan.caches.length && !plan.projectHooks.length;
+    if (nothing)
+        log(dim("  nothing installed by great_cto was found"));
+    log("");
+    log(yellow("Keeps") + dim(" — yours, or used by something else"));
+    if (plan.keptVersions.length)
+        for (const k of plan.keptVersions)
+            log(`  ${short(k.dir)} ${dim(`— ${k.why}`)}`);
+    if (plan.userData.length) {
+        const named = ["lessons.md", "decisions.md", "verdicts", "global-patterns", "cost-history.log", "secrets.env"]
+            .filter((n) => plan.userData.some((d) => d.endsWith(`/${n}`)));
+        log(`  ~/.great_cto ${dim(`— ${plan.userData.length} entries of your data${named.length ? `: ${named.join(", ")}` : ""}`)}`);
+        log(dim(`    --purge-data moves it to ~/.great_cto.removed-<date> (reversible; nothing is deleted)`));
+    }
+    if (plan.projects.length)
+        log(`  ${plan.projects.length} project(s)' .great_cto/ ${dim("— project records; delete per project if you want")}`);
+    if (!args.projects && plan.projects.length)
+        log(dim(`    --projects also removes the pre-push hooks great_cto installed in them`));
+    if (plan.companions.length)
+        log(`  ${plan.companions.join(", ")} ${dim("— companion plugins other tools may use; disable with `claude plugin disable <name>`")}`);
+    log("");
+    log(cyan("Yours to run") + dim(" — owned by the host, not edited from here"));
+    if (plan.settingsKeys.includes("great_cto@great-cto") || plan.marketplaces.length)
+        log(`  claude plugin uninstall great_cto@great-cto`);
+    for (const m of plan.marketplaces)
+        log(`  claude plugin marketplace remove ${m}`);
+    try {
+        execFileSync("codex", ["--version"], { stdio: "ignore" });
+        log(`  codex plugin remove great-cto@great-cto   ${dim("# if you installed it for Codex")}`);
+    }
+    catch { /* no codex */ }
+    log(`  npm uninstall -g great-cto   ${dim("# last: this command is running from it")}`);
+    if (!args.yes) {
+        log("");
+        log(`Nothing changed. Run ${bold("great-cto uninstall --yes")} to remove the list above.`);
+        return 0;
+    }
+    await killExistingBoard();
+    await killExistingBoard("console");
+    for (const cmd of spec.uninstallCmds)
+        spawnSync(cmd[0], cmd.slice(1), { stdio: "ignore" });
+    if (nightly && plan.daemonUnits.includes(nightly))
+        spawnSync("launchctl", ["unload", "-w", nightly], { stdio: "ignore" });
+    const r = applyUninstall(plan, { purgeData: args.purgeData });
+    log("");
+    success(`removed ${r.removed.length} item(s)`);
+    for (const b of r.backups)
+        log(dim(`  backup: ${short(b)}`));
+    if (r.movedData)
+        log(`  ~/.great_cto moved to ${short(r.movedData)} ${dim("— delete it yourself once you are sure")}`);
+    for (const f of r.failed)
+        warn(`could not remove ${short(f)}`);
+    if (plan.keptVersions.length)
+        warn(`${plan.keptVersions.length} plugin version(s) kept — a running session uses them; run uninstall again after closing it`);
+    return r.failed.length ? 1 : 0;
+}
 function printHelp() {
     log(`${bold("great-cto")} — one-command install for the great_cto Claude Code plugin
 
@@ -624,6 +735,7 @@ ${bold("Usage:")}
   npx great-cto serve [--port 3142]
   npx great-cto upgrade [superpowers|beads]  Re-clone companions to latest tag + re-apply overlays
   npx great-cto upgrade --self                Upgrade the great-cto CLI itself, in place
+  npx great-cto uninstall [--yes]             Show what great_cto installed; --yes removes it (your data stays)
   npx great-cto help
   npx great-cto version
 
@@ -660,6 +772,10 @@ ${bold("Upgrade:")}
   great-cto upgrade superpowers  Upgrade superpowers only
   great-cto upgrade beads        Upgrade beads only
   great-cto upgrade --self       Upgrade the great-cto CLI itself (also: upgrade self)
+  great-cto uninstall            Plan: what would be removed, what is kept (changes nothing)
+  great-cto uninstall --yes      Remove plugin, agents, commands, board service, caches
+      --purge-data               Also move ~/.great_cto aside (reversible, never deleted)
+      --projects                 Also remove the pre-push hooks init wrote into your projects
   ${dim("(Safe to run any time — idempotent if already on latest)")}
 
 ${bold("CI gate:")}
@@ -1526,6 +1642,15 @@ async function main() {
             await finish(2);
         }
     }
+    if (args.command === "uninstall") {
+        try {
+            await finish(await runUninstall(args));
+        }
+        catch (e) {
+            error(e.message);
+            await finish(2);
+        }
+    }
     if (args.command === "upgrade") {
         try {
             const code = await runUpgrade(rawArgv, args);

package/dist/uninstall.js

@@ -0,0 +1,214 @@
+// `great-cto uninstall` — remove what great_cto installed, keep what the user made.
+//
+// Plan first, act on --yes (ADR-009: expensive to undo means a human decision,
+// and "delete things under ~" is the textbook case). The plan is a pure function of
+// the filesystem so tests run it against a temporary HOME.
+//
+// Three classes, never mixed:
+//   artefacts  — what an install wrote: plugin versions, managed agents/commands,
+//                plugin keys in settings, the board service, clones and caches.
+//                Removed on --yes.
+//   user data  — ~/.great_cto lessons, decisions, verdicts, cost history, secrets.
+//                Kept. --purge-data MOVES the directory aside (reversible), it does
+//                not delete it: secrets.env may hold the only copy of a key.
+//   host-owned — marketplace registrations, the npm package running this code,
+//                companion plugins other tools may use. Listed with the command
+//                that removes them; not edited from here.
+import { existsSync, readdirSync, readFileSync, writeFileSync, copyFileSync, renameSync, rmSync, statSync, rmdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
+/** Appended to every agent and command great_cto installs (scripts/lib/sync-managed.mjs). */
+export const MANAGED_MARKER = "<!-- great_cto-managed -->";
+/** The first comment line of the pre-push hook `init` copies into a project. */
+export const PRE_PUSH_HEADER = "# pre-push.sh — block pushes that contain private project name leaks";
+export const PLUGIN_KEYS = ["great_cto@local", "great_cto@great-cto"];
+const COMPANION_KEYS = ["superpowers@local", "beads@local"];
+/** Re-creatable: git clones, registries, copies, update/quota caches, runtime files. */
+const CACHE_ENTRIES = [
+    "catalog", "anthropic-skills", "personal-skills", "skills-registry.json",
+    "update-check.json", ".last-version-check", "quota-cache.json",
+    "SKILL.md", "ARCHETYPES.md", "env.sh",
+    "board.pid", "console.pid", "board.log", "board.err", "worker.lock", "leash-proxy.pid",
+];
+const CACHE_PREFIXES = [".welcomed-"];
+const readJson = (p) => {
+    try {
+        return JSON.parse(readFileSync(p, "utf8"));
+    }
+    catch {
+        return null;
+    }
+};
+const ls = (d) => { try {
+    return readdirSync(d);
+}
+catch {
+    return [];
+} };
+const isDir = (p) => { try {
+    return statSync(p).isDirectory();
+}
+catch {
+    return false;
+} };
+const norm = (p) => p.replace(/\/+$/, "");
+/** Plugin roots named in process environments (`ps eww` output) — the same rule as prune-versions.mjs. */
+export function liveRootsFromPs(text) {
+    const out = [];
+    for (const m of String(text ?? "").matchAll(/CLAUDE_PLUGIN_ROOT=(.+?)(?=\s+[A-Za-z_][A-Za-z0-9_]*=|\s*$)/gm)) {
+        const root = norm(m[1]);
+        if (!out.includes(root))
+            out.push(root);
+    }
+    return out;
+}
+/** Where git reads hooks from: core.hooksPath wins over .git/hooks. Null when not a repository. */
+function gitHooksDir(projectDir) {
+    const git = (args) => {
+        try {
+            return execFileSync("git", args, { cwd: projectDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        }
+        catch {
+            return "";
+        }
+    };
+    const top = git(["rev-parse", "--show-toplevel"]);
+    if (!top)
+        return null;
+    const configured = git(["config", "--get", "core.hooksPath"]);
+    if (configured)
+        return resolve(top, configured);
+    const common = git(["rev-parse", "--git-common-dir"]);
+    return join(common ? resolve(top, common) : join(top, ".git"), "hooks");
+}
+export function planUninstall(o) {
+    const { home } = o;
+    const claude = join(home, ".claude");
+    const gdir = join(home, ".great_cto");
+    const live = liveRootsFromPs(o.psText ?? "");
+    const pluginVersions = [];
+    const keptVersions = [];
+    const cache = join(claude, "plugins", "cache");
+    for (const market of ls(cache)) {
+        const root = join(cache, market, "great_cto");
+        for (const v of ls(root)) {
+            const dir = join(root, v);
+            if (!isDir(dir))
+                continue;
+            if (live.some((r) => norm(r) === dir || norm(r).startsWith(dir + "/"))) {
+                keptVersions.push({ dir, why: "a running Claude Code session loads it — close that session and run uninstall again" });
+            }
+            else
+                pluginVersions.push(dir);
+        }
+    }
+    const marked = (d, pick) => ls(d).filter((f) => f.endsWith(".md") && pick(f)).map((f) => join(d, f))
+        .filter((p) => { try {
+        return readFileSync(p, "utf8").includes(MANAGED_MARKER);
+    }
+    catch {
+        return false;
+    } });
+    const agents = marked(join(claude, "agents"), () => true);
+    const commands = marked(join(claude, "commands"), () => true);
+    const settings = readJson(join(claude, "settings.json"));
+    const enabled = (settings?.enabledPlugins ?? {});
+    const settingsKeys = PLUGIN_KEYS.filter((k) => k in enabled);
+    const companions = COMPANION_KEYS.filter((k) => k in enabled);
+    const installed = readJson(join(claude, "plugins", "installed_plugins.json"));
+    const installedPlugins = (installed?.plugins ?? {});
+    const installedKeys = PLUGIN_KEYS.filter((k) => k in installedPlugins);
+    const known = readJson(join(claude, "plugins", "known_marketplaces.json")) ?? {};
+    const marketplaces = Object.keys(known).filter((k) => /great[-_]cto/i.test(k));
+    const daemonUnits = (o.daemonUnitPaths ?? []).filter((p) => p && existsSync(p));
+    const caches = [];
+    const userData = [];
+    for (const e of ls(gdir)) {
+        const isCache = CACHE_ENTRIES.includes(e) || CACHE_PREFIXES.some((p) => e.startsWith(p));
+        (isCache ? caches : userData).push(join(gdir, e));
+    }
+    const reg = readJson(join(gdir, "projects.json"));
+    const projects = Array.isArray(reg?.projects)
+        ? reg.projects.map((p) => p.path).filter((p) => typeof p === "string" && existsSync(p))
+        : [];
+    const projectHooks = [];
+    if (o.includeProjects) {
+        for (const p of projects) {
+            const dir = gitHooksDir(p);
+            const hook = dir ? join(dir, "pre-push") : "";
+            try {
+                if (hook && readFileSync(hook, "utf8").includes(PRE_PUSH_HEADER))
+                    projectHooks.push(hook);
+            }
+            catch { /* none */ }
+        }
+    }
+    return { home, pluginVersions, keptVersions, agents, commands, settingsKeys, installedKeys, daemonUnits,
+        caches, projectHooks, userData, projects, companions, marketplaces };
+}
+/** Drop keys from one object inside a JSON file: backup, then write to a temp file and rename. */
+function dropKeys(file, field, keys, stamp) {
+    if (!keys.length || !existsSync(file))
+        return null;
+    const data = readJson(file);
+    if (!data)
+        return null; // unparseable: not ours to rewrite
+    const obj = (data[field] ?? {});
+    for (const k of keys)
+        delete obj[k];
+    data[field] = obj;
+    const backup = `${file}.bak-${stamp}`;
+    copyFileSync(file, backup);
+    const tmp = `${file}.tmp-${stamp}`;
+    writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", "utf8");
+    renameSync(tmp, file);
+    return backup;
+}
+/** Carry out a plan. Board processes and service unloads are the caller's (they need the platform). */
+export function applyUninstall(plan, o = {}) {
+    const stamp = o.stamp ?? new Date().toISOString().replace(/[:.]/g, "-");
+    const removed = [];
+    const failed = [];
+    const backups = [];
+    const rm = (p) => { try {
+        rmSync(p, { recursive: true, force: true });
+        removed.push(p);
+    }
+    catch {
+        failed.push(p);
+    } };
+    for (const p of [...plan.agents, ...plan.commands, ...plan.pluginVersions, ...plan.daemonUnits, ...plan.projectHooks])
+        rm(p);
+    // `<market>/great_cto/` and then `<market>/` itself, each only when emptied: a market
+    // that still holds a live version, or another plugin, is not empty.
+    for (const dir of new Set(plan.pluginVersions.map((v) => resolve(v, "..")))) {
+        for (const d of [dir, resolve(dir, "..")]) {
+            try {
+                if (ls(d).length === 0)
+                    rmdirSync(d);
+            }
+            catch { /* keep */ }
+        }
+    }
+    const claude = join(plan.home, ".claude");
+    const b1 = dropKeys(join(claude, "settings.json"), "enabledPlugins", plan.settingsKeys, stamp);
+    const b2 = dropKeys(join(claude, "plugins", "installed_plugins.json"), "plugins", plan.installedKeys, stamp);
+    for (const b of [b1, b2])
+        if (b)
+            backups.push(b);
+    for (const p of plan.caches)
+        rm(p);
+    let movedData = null;
+    const gdir = join(plan.home, ".great_cto");
+    if (o.purgeData && existsSync(gdir)) {
+        const aside = `${gdir}.removed-${stamp}`;
+        try {
+            renameSync(gdir, aside);
+            movedData = aside;
+        }
+        catch {
+            failed.push(gdir);
+        }
+    }
+    return { removed, backups, movedData, failed };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.40.1",
+  "version": "3.42.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",