great-cto 3.45.0 → 3.46.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 71 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.45.0",
+  "version": "3.46.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/dist/codex.js

@@ -48,7 +48,7 @@ export function codexInstallPlan({ repoDir, codexOnPath }) {
             "skills — all of them, the same tree Claude Code reads",
             "the MCP server (great_cto), resolved from npm",
             "the controlled role pipeline — run `npx --yes great-cto codex-host doctor` then `npx --yes great-cto codex-host start`",
-            "six safety guards as Codex plugin hooks (destructive commands, gate bypasses, a neighbour session's work, secrets in files, frozen gates, weakened checks) and two hints that never block (edit-impact, lesson-tripwire) — Codex asks you to review them once on the next interactive `codex` start; they do not run until you do",
+            "six safety guards as Codex plugin hooks (destructive commands, gate bypasses, a neighbour session's work, secrets in files, frozen gates, weakened checks) and two hints that never block (edit-impact, lesson-tripwire) — Codex asks you to review them once on the next interactive `codex` start; they do not run until you do. Codex does not update great_cto by itself — `great-cto upgrade` (or `great-cto upgrade codex`) does",
         ],
         // Codex runs plugin hooks (verified 2026-09-28, codex-cli 0.153.4) but has no
         // plugin surface for commands or role agents. Saying "installed" without saying
@@ -60,3 +60,92 @@ export function codexInstallPlan({ repoDir, codexOnPath }) {
         ],
     };
 }
+// ── Keeping the Codex install current ────────────────────────────────────────
+//
+// Codex installs great_cto from a Git marketplace snapshot and never refreshes it on
+// its own. `release.sh` and `install-local` update the Claude Code plugin only, so on
+// the maintainer's machine Codex sat at 3.37.0 while 3.45.0 shipped — every Codex
+// guard released in between (3.42–3.45) had never reached it. Measured 2026-09-30:
+// `codex plugin marketplace upgrade great-cto` refreshes the snapshot AND the installed
+// plugin cache in one step. `great-cto upgrade` now runs it when Codex has the
+// great-cto marketplace configured.
+import { existsSync as fsExists, readdirSync, readFileSync as fsRead } from "node:fs";
+import { homedir as home } from "node:os";
+import { join as pjoin } from "node:path";
+import { execFileSync } from "node:child_process";
+/** A usable `codex` binary: PATH first, then nvm installs, then the desktop app. Null when none. */
+export function findCodexBinary(env = process.env, h = home()) {
+    for (const dir of String(env.PATH || "").split(":")) {
+        if (dir && fsExists(pjoin(dir, "codex")))
+            return pjoin(dir, "codex");
+    }
+    // A shell that did not load nvm (a conda base, a login shell without .nvmrc) cannot
+    // see an npm-installed codex; look where nvm puts it.
+    const nvm = pjoin(h, ".nvm", "versions", "node");
+    let versions = [];
+    try {
+        versions = readdirSync(nvm).sort().reverse();
+    }
+    catch { /* no nvm */ }
+    for (const v of versions) {
+        const p = pjoin(nvm, v, "bin", "codex");
+        if (fsExists(p))
+            return p;
+    }
+    const app = "/Applications/Codex.app/Contents/Resources/codex";
+    return fsExists(app) ? app : null;
+}
+/** Does Codex have great_cto's marketplace configured? Read from its config.toml. */
+export function codexHasGreatCtoMarketplace(codexHome = pjoin(home(), ".codex")) {
+    try {
+        return /^\s*\[marketplaces\.(?:"great-cto"|great-cto)\]\s*$/m.test(fsRead(pjoin(codexHome, "config.toml"), "utf8"));
+    }
+    catch {
+        return false;
+    }
+}
+/** The newest great_cto version in Codex's plugin cache, or null. */
+export function installedCodexVersion(codexHome = pjoin(home(), ".codex")) {
+    const cache = pjoin(codexHome, "plugins", "cache");
+    let markets = [];
+    try {
+        markets = readdirSync(cache);
+    }
+    catch {
+        return null;
+    }
+    const versions = [];
+    for (const m of markets) {
+        try {
+            versions.push(...readdirSync(pjoin(cache, m, "great-cto")).filter((v) => /^\d+\.\d+\.\d+/.test(v)));
+        }
+        catch { /* not this market */ }
+    }
+    const key = (v) => v.split(".").map((n) => parseInt(n, 10) || 0);
+    versions.sort((a, b) => { const x = key(a), y = key(b); for (let i = 0; i < 3; i++)
+        if (x[i] !== y[i])
+            return x[i] - y[i]; return 0; });
+    return versions.at(-1) ?? null;
+}
+/** Refresh great_cto in Codex. Skips, with the reason, when Codex or the marketplace is absent. */
+export function upgradeCodexPlugin(opts = {}) {
+    const codexHome = opts.codexHome ?? pjoin(home(), ".codex");
+    if (!codexHasGreatCtoMarketplace(codexHome)) {
+        return { status: "skipped", fromVersion: null, toVersion: null, reason: "great_cto is not installed for Codex" };
+    }
+    const from = installedCodexVersion(codexHome);
+    const bin = opts.bin === undefined ? findCodexBinary() : opts.bin;
+    if (!bin) {
+        return { status: "skipped", fromVersion: from, toVersion: from, reason: "codex not found on PATH or under ~/.nvm — run: codex plugin marketplace upgrade great-cto" };
+    }
+    try {
+        execFileSync(bin, ["plugin", "marketplace", "upgrade", "great-cto"], {
+            stdio: ["ignore", "pipe", "pipe"], timeout: 180_000, env: { ...process.env, CODEX_HOME: codexHome },
+        });
+    }
+    catch (e) {
+        return { status: "failed", fromVersion: from, toVersion: from, reason: String(e.message).split("\n")[0] };
+    }
+    const to = installedCodexVersion(codexHome);
+    return { status: to && to !== from ? "upgraded" : "already_latest", fromVersion: from, toVersion: to };
+}

package/dist/main.js

@@ -772,6 +772,7 @@ ${bold("Upgrade:")}
   great-cto upgrade superpowers  Upgrade superpowers only
   great-cto upgrade beads        Upgrade beads only
   great-cto upgrade --self       Upgrade the great-cto CLI itself (also: upgrade self)
+  great-cto upgrade codex        Refresh great_cto in Codex (also part of plain upgrade)
   great-cto uninstall            Plan: what would be removed, what is kept (changes nothing)
   great-cto uninstall --yes      Remove plugin, agents, commands, board service, caches
       --purge-data               Also move ~/.great_cto aside (reversible, never deleted)
@@ -1435,6 +1436,9 @@ async function runUpgrade(rawArgv, args) {
     // Optional positional: great-cto upgrade [plugin-name]
     const pluginArg = firstArgAfterUpgrade;
     const targetPlugin = pluginArg && !pluginArg.startsWith("--") ? pluginArg : undefined;
+    // `great-cto upgrade codex` refreshes only the Codex install.
+    if (targetPlugin === "codex")
+        return reportCodexUpgrade();
     let results;
     if (targetPlugin) {
         const plugin = COMPANION_PLUGINS.find((p) => p.name === targetPlugin);
@@ -1458,6 +1462,28 @@ async function runUpgrade(rawArgv, args) {
             warn(`${r.name} skipped — ${r.reason ?? "unknown reason"}`);
         }
     }
+    // Codex keeps its own snapshot of great_cto and never refreshes it; without this
+    // step every Codex guard shipped after the first install stays out of reach.
+    if (!targetPlugin)
+        await reportCodexUpgrade();
+    return 0;
+}
+async function reportCodexUpgrade() {
+    const { upgradeCodexPlugin } = await import("./codex.js");
+    const r = upgradeCodexPlugin();
+    if (r.status === "upgraded") {
+        success(`codex: great_cto ${r.fromVersion ?? "—"} → ${r.toVersion} — new or changed hooks need one review at the next \`codex\` start`);
+    }
+    else if (r.status === "already_latest") {
+        log(`  ${dim(`codex: great_cto ${r.toVersion} already at latest`)}`);
+    }
+    else if (r.status === "failed") {
+        warn(`codex: upgrade failed — ${r.reason}`);
+        return 1;
+    }
+    else if (r.reason && r.reason !== "great_cto is not installed for Codex") {
+        warn(`codex: ${r.reason}`);
+    }
     return 0;
 }
 async function main() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.45.0",
+  "version": "3.46.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",