great-cto 3.62.1 → 3.62.3

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.62.1",
+  "version": "3.62.3",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/fixtures/fake-bd-controlled.mjs

@@ -16,6 +16,10 @@ if (process.argv.includes('--descendant')) {
   fs.writeFileSync(marker('worker'), String(process.ppid));
   if (process.env.FAKE_BD_CONTROL_MODE === 'fail') {
     process.exit(1);
+  } else if (['gate-receipt', 'gate-receipt-race'].includes(process.env.FAKE_BD_CONTROL_MODE)) {
+    const tasks = [{ id: 'FIXTURE-GATE', title: 'gate:ship', labels: ['gate'], status: 'open', priority: 0 }];
+    if (process.env.FAKE_BD_CONTROL_MODE === 'gate-receipt-race') tasks.push({ id: 'NEW-GATE', title: 'gate:plan', labels: ['gate'], status: 'open', priority: 0 });
+    process.stdout.write(JSON.stringify(tasks), () => process.exit(0));
   } else if (['hang', 'leader-exit'].includes(process.env.FAKE_BD_CONTROL_MODE)) {
     process.on('SIGTERM', () => {});
     spawn(process.execPath, [new URL(import.meta.url).pathname, '--descendant'], { stdio: 'inherit' });

package/board/packages/board/fixtures/held-receipt-git.mjs

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// A fixed Git-read fixture. It never reads operator stores or invokes a shell.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+const root = process.env.GCTO_RECEIPT_CONTROL_ROOT, binary = process.env.GCTO_RECEIPT_REAL_GIT;
+if (!root || !path.isAbsolute(root) || !binary || !path.isAbsolute(binary)) process.exit(2);
+const args = process.argv.slice(2);
+const run = () => {
+  const result = spawnSync(binary, args, { stdio: ['ignore', 'pipe', 'pipe'], timeout: 5000 });
+  if (result.stdout) process.stdout.write(result.stdout);
+  if (result.stderr) process.stderr.write(result.stderr);
+  process.exit(result.status ?? 1);
+};
+if (args.includes('hash-object') || args.includes('--show-object-format') ||
+    (args.includes('rev-parse') && args.includes('HEAD') && fs.existsSync(path.join(root, 'hold-head')))) {
+  fs.appendFileSync(path.join(root, 'git-held'), `${process.pid}\n`);
+  const timer = setInterval(() => {
+    if (fs.existsSync(path.join(root, 'git-release'))) { clearInterval(timer); run(); }
+  }, 25);
+} else run();

package/board/packages/board/lib/bd-read-worker.mjs

@@ -3,8 +3,10 @@
 import { fork, spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 const entry = fileURLToPath(import.meta.url);
-export function spawnBdRead(binary, { readDeadlineMs = 20250, ...options }) {
-  return fork(entry, [binary, String(readDeadlineMs)], { ...options, silent: true });
+export function spawnBdRead(binary, { readDeadlineMs = 20250, commandArgs, ...options }) {
+  const args = [binary, String(readDeadlineMs)];
+  if (commandArgs !== undefined) args.push(JSON.stringify(commandArgs));
+  return fork(entry, args, { ...options, silent: true });
 }
 if (process.argv[1] === entry) {
   const grouped = process.platform !== 'win32';
@@ -48,7 +50,11 @@ if (process.argv[1] === entry) {
     catch { killOwnedGroup(); }
   }
   try {
-    child = spawn(process.argv[2], ['list', '--json', '--all', '--include-gates'], {
+    const args = process.argv[4] === undefined
+      ? ['list', '--json', '--all', '--include-gates'] : JSON.parse(process.argv[4]);
+    if (!Array.isArray(args) || args.length > 8 || args.some(arg => typeof arg !== 'string' || arg.includes('\0'))
+        || JSON.stringify(args).length > 4096) throw Error('Invalid read command arguments');
+    child = spawn(process.argv[2], args, {
       stdio: ['ignore', 'pipe', 'pipe']
     });
     child.stdout.pipe(process.stdout, { end: false });

package/board/packages/board/lib/gate-tokens.mjs

@@ -19,6 +19,7 @@ import fs from 'fs';
 import path from 'path';
 import { randomUUID } from 'crypto';
 import { treeReceipt, receiptHash, compareReceipts } from '../../../scripts/lib/receipt.mjs';
+import { readBindingReceipt } from './receipt-read.mjs';
 
 export const TOKENS_FILE = 'gate-tokens.json';
 export const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
@@ -36,6 +37,30 @@ export function tokenTtlMs(env = process.env) {
 }
 
 const storePath = (cwd) => path.join(cwd, '.great_cto', TOKENS_FILE);
+// One board owns its HTTP listener. Fence awaited projections against that
+// board's decision lifecycle; this is not a distributed multi-board lock.
+const decisions = new Map();
+function decisionState(cwd) {
+  let key;
+  try { key = fs.realpathSync(cwd); } catch { return null; }
+  if (!decisions.has(key)) decisions.set(key, { generation: randomUUID(), active: false });
+  return decisions.get(key);
+}
+export function approvalSnapshot(cwd) {
+  const state = decisionState(cwd);
+  return state ? { generation: state.generation, active: state.active } : { generation: null, active: true };
+}
+function snapshotFresh(cwd, snapshot) {
+  const state = decisionState(cwd);
+  return state && snapshot && !snapshot.active && !state.active && snapshot.generation === state.generation;
+}
+export function beginGateDecision(cwd) {
+  const state = decisionState(cwd);
+  if (!state || state.active) return null;
+  state.active = true; state.generation = randomUUID();
+  let ended = false;
+  return () => { if (!ended) { ended = true; state.active = false; state.generation = randomUUID(); } };
+}
 
 /** @returns {{state:'none'|'ok'|'unreadable', tokens:object, why?:string}} */
 export function readTokens(cwd) {
@@ -77,7 +102,7 @@ export function bindingReceipt(cwd) {
  * @param {{id:string, gate?:string, guarded?:boolean}[]} gates
  * @returns {{state:'ok'|'unreadable', tokens:Record<string,string>, why?:string}}
  */
-export function issueTokens(cwd, gates, { now = Date.now(), env = process.env } = {}) {
+export function issueTokens(cwd, gates, { now = Date.now(), env = process.env, readReceipt = bindingReceipt } = {}) {
   const store = readTokens(cwd);
   if (store.state === 'unreadable') return { state: 'unreadable', tokens: {}, why: store.why };
   const ttl = tokenTtlMs(env);
@@ -90,7 +115,7 @@ export function issueTokens(cwd, gates, { now = Date.now(), env = process.env }
     else toMint.push(g);
   }
   if (toMint.length) {
-    const receipt = bindingReceipt(cwd);
+    const receipt = readReceipt(cwd);
     const hash = receiptHash(receipt);
     for (const g of toMint) {
       next[g.id] = {
@@ -104,6 +129,29 @@ export function issueTokens(cwd, gates, { now = Date.now(), env = process.env }
   return { state: 'ok', tokens: Object.fromEntries(Object.entries(next).map(([id, e]) => [id, e.token])) };
 }
 
+export async function issueTokensAsync(cwd, gates, { env = process.env, readReceipt = readBindingReceipt, snapshot = approvalSnapshot(cwd) } = {}) {
+  const stale = () => ({ state: 'unreadable', tokens: {}, why: 'Gate decisions changed during this snapshot; reload the inbox' });
+  if (!snapshotFresh(cwd, snapshot)) return stale();
+  const store = readTokens(cwd), now = Date.now(), ttl = tokenTtlMs(env);
+  if (store.state === 'unreadable') return { state: 'unreadable', tokens: {}, why: store.why };
+  const needsReceipt = (gates || []).some(g => g?.id &&
+    (!store.tokens[g.id] || typeof store.tokens[g.id].token !== 'string' || !Number.isFinite(store.tokens[g.id].firstSeenAt) || now - store.tokens[g.id].firstSeenAt > ttl));
+  try {
+    const receipt = needsReceipt ? await readReceipt(cwd) : undefined;
+    if (!snapshotFresh(cwd, snapshot)) return stale();
+    const current = readTokens(cwd);
+    // Also refuse disappearance/replacement of an existing token by another
+    // store writer. Concurrent mint-only consumers remain safe to coalesce.
+    if (Object.entries(store.tokens).some(([id, entry]) => current.tokens[id]?.token !== entry?.token)) return stale();
+    // Reread the store after await: another consumer may already have minted
+    // these tokens, or corruption may have appeared. Never replace that state.
+    return issueTokens(cwd, gates, { now: Date.now(), env, readReceipt: () => {
+      if (!needsReceipt) throw Error('Receipt no longer available');
+      return receipt;
+    } });
+  } catch { return { state: 'unreadable', tokens: {}, why: 'Approval receipt is unavailable; retry' }; }
+}
+
 /**
  * Is `token` the live token for gate `id`?
  * @returns {{ok:true, entry:object} | {ok:false, status:number, outcome:string, why:string}}
@@ -143,6 +191,9 @@ export function checkBinding(cwd, entry) {
 
 /** Single use: drop the gate's token once it has been decided. */
 export function consumeToken(cwd, id) {
+  const state = decisionState(cwd);
+  if (!state) return;
+  state.generation = randomUUID();
   const store = readTokens(cwd);
   if (store.state !== 'ok' || !(id in store.tokens)) return;
   const next = { ...store.tokens };

package/board/packages/board/lib/receipt-read-worker.mjs

@@ -0,0 +1,37 @@
+// Invoked only by the independent read supervisor, never by an HTTP argument.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { treeReceipt, latestApproval, compareReceipts, mergeBase } from '../../../scripts/lib/receipt.mjs';
+import { secondOpinionForTree } from '../../../scripts/lib/second-opinion-for-tree.mjs';
+const entry = fileURLToPath(import.meta.url);
+export const receiptReadEntry = entry;
+if (process.argv[1] === entry) {
+  try {
+    const mode = process.argv[2] || 'binding';
+    if (!['binding', 'approval', 'second-opinion'].includes(mode) || process.argv.length > 3) throw Error('Invalid evidence operation');
+    let receipt;
+    if (mode === 'second-opinion') {
+      receipt = secondOpinionForTree(process.cwd());
+    } else if (mode === 'approval') {
+      const approval = latestApproval(process.cwd());
+      if (!approval?.receipt) {
+        receipt = { state: 'no-receipt', why: 'no approving verdict carries a receipt yet', agent: approval?.agent || null, ts: approval?.ts || null };
+      } else {
+        const current = treeReceipt(process.cwd(), { base: approval.receipt.base || mergeBase(process.cwd()), hashFilesInProcess: true });
+        receipt = { ...compareReceipts(approval.receipt, current, { cwd: process.cwd() }), agent: approval.agent, ts: approval.ts };
+      }
+    } else {
+      let dir = process.cwd(), gitMetadata = false;
+      for (;;) {
+        try { fs.lstatSync(path.join(dir, '.git')); gitMetadata = true; break; } catch (e) { if (e.code !== 'ENOENT') throw e; }
+        const parent = path.dirname(dir); if (parent === dir) break; dir = parent;
+      }
+      receipt = treeReceipt(process.cwd(), { exclude: ['.great_cto', '.beads'], hashFilesInProcess: true });
+      // Preserve explicit non-Git binding, but never mint an unbound token when
+      // a real repository's evidence read failed.
+      if (!receipt && gitMetadata) throw Error('Repository receipt unavailable');
+    }
+    process.stdout.write(JSON.stringify({ receipt }), error => process.exit(error ? 1 : 0));
+  } catch { process.exit(1); }
+}

package/board/packages/board/lib/receipt-read.mjs

@@ -0,0 +1,70 @@
+import path from 'node:path';
+import { spawnBdRead } from './bd-read-worker.mjs';
+import { receiptReadEntry } from './receipt-read-worker.mjs';
+const pending = new Map();
+const MAX_ACTIVE = 2, MAX_BYTES = 16 * 1024 * 1024;
+export function readBindingReceipt(cwd, { timeoutMs = 20000 } = {}) {
+  return readEvidence(cwd, 'binding', timeoutMs);
+}
+export function readApprovalReceipt(cwd, { timeoutMs = 20000 } = {}) {
+  return readEvidence(cwd, 'approval', timeoutMs);
+}
+export function readSecondOpinion(cwd, { timeoutMs = 20000 } = {}) {
+  return readEvidence(cwd, 'second-opinion', timeoutMs);
+}
+function readEvidence(cwd, mode, timeoutMs) {
+  cwd = path.resolve(cwd);
+  const key = JSON.stringify([cwd, mode]);
+  if (pending.has(key)) return pending.get(key);
+  if (pending.size >= MAX_ACTIVE) return Promise.reject(Error('Receipt reader busy; retry'));
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 1 || timeoutMs > 20000) return Promise.reject(Error('Invalid receipt deadline'));
+  const operation = new Promise((resolve, reject) => {
+    let child, deadline, escalation, settled = false, resultCode, out = '', bytes = 0;
+    const grouped = process.platform !== 'win32';
+    const signal = s => { try { if (grouped) process.kill(-child.pid, s); else child.kill(s); } catch {} };
+    const finish = (error, value) => {
+      if (settled) return; settled = true; clearTimeout(deadline); clearTimeout(escalation);
+      if (error) reject(error); else resolve(value);
+    };
+    const stop = message => {
+      if (settled || escalation) return;
+      signal('SIGTERM');
+      escalation = setTimeout(() => {
+        signal('SIGKILL'); child.stdout?.destroy(); child.stderr?.destroy(); finish(Error(message));
+      }, 250);
+    };
+    try {
+      child = spawnBdRead(process.execPath, { cwd, detached: grouped, commandArgs: [receiptReadEntry, mode], readDeadlineMs: timeoutMs + 250 });
+      deadline = setTimeout(() => stop('Receipt read timed out'), timeoutMs);
+      child.on('message', m => { if (m?.type === 'bd-read-result' && Number.isInteger(m.code)) resultCode = m.code; });
+      child.stdout.setEncoding('utf8');
+      child.stdout.on('data', chunk => {
+        if (settled || escalation) return;
+        bytes += Buffer.byteLength(chunk);
+        if (bytes > MAX_BYTES) stop('Receipt output exceeded limit'); else out += chunk;
+      });
+      child.stderr.resume();
+      child.on('error', () => finish(Error('Receipt worker unavailable')));
+      child.on('close', code => {
+        if (settled) return;
+        if (escalation) { signal('SIGKILL'); finish(Error('Receipt read unavailable')); return; }
+        if ((resultCode ?? code) !== 0) { finish(Error('Receipt worker failed')); return; }
+        try {
+          const value = JSON.parse(out);
+          if (!value || !Object.hasOwn(value, 'receipt')) throw Error();
+          const evidence = value.receipt;
+          if (mode === 'binding') {
+            if (evidence !== null && (!evidence?.head || !evidence.files)) throw Error();
+          } else {
+            const states = mode === 'approval' ? ['no-receipt', 'unreadable', 'differs', 'extended', 'matches'] : ['not-run', 'unmeasured', 'unreadable', 'ok'];
+            if (!states.includes(evidence?.state)) throw Error();
+          }
+          finish(null, evidence);
+        } catch { finish(Error('Receipt worker returned invalid evidence')); }
+      });
+    } catch { finish(Error('Receipt worker unavailable')); }
+  });
+  pending.set(key, operation);
+  operation.then(() => pending.delete(key), () => pending.delete(key));
+  return operation;
+}

package/board/packages/board/lib/routes.mjs

@@ -32,7 +32,7 @@ import { log } from './log.mjs';
 import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, getTasksAsync, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
 import { getMetrics } from './metrics.mjs';
 import { agentActivity, agentActivitySince } from './agent-activity.mjs';
-import { issueTokens, checkToken, checkBinding, consumeToken } from './gate-tokens.mjs';
+import { issueTokensAsync, checkToken, checkBinding, consumeToken, approvalSnapshot, beginGateDecision } from './gate-tokens.mjs';
 import { readTurns, turnPatch } from '../../../scripts/lib/turn-snapshot.mjs';
 import { appendEvent } from '../../../scripts/lib/agent-events.mjs';
 
@@ -63,6 +63,7 @@ import { upsertCapability, capabilitiesFromProjectMd } from '../../../scripts/li
 // Moved to scripts/lib so the cross-review Stop hook can ask the same question
 // without importing a server. Re-exported here: this module's callers are unchanged.
 import { secondOpinionForTree } from '../../../scripts/lib/second-opinion-for-tree.mjs';
+import { readApprovalReceipt, readSecondOpinion } from './receipt-read.mjs';
 import { getAgentsFleet, getAgentProfile, retireAgent, restoreAgent, appendDecisionLog, readDecisionsLog } from './fleet.mjs';
 import { getResume, getShareState, toggleShare } from './share.mjs';
 import { listSessions, readSession, editedFiles, searchSessions } from './transcripts.mjs';
@@ -743,6 +744,12 @@ async function dispatch(req, res, url, cwd) {
       // Named outside the serialised block so the wake below can say WHICH gate a
       // human approved; the lookup itself belongs inside the lock.
       let gateTitle = id;
+      const endDecision = beginGateDecision(gateCwd);
+      if (!endDecision) {
+        refuse({ status: 409, outcome: 'refused-busy', why: 'A gate decision is in progress for this project; retry' });
+        return;
+      }
+      try {
 
       // BH-16 fix: serialise gate writes through bd-write queue.
       // Without this, concurrent approve+reject on the same gate produced
@@ -871,12 +878,14 @@ async function dispatch(req, res, url, cwd) {
             .catch(e => log.warn(`report: republish after gate failed: ${e.message}`));
         }
       }
+      } finally { endDecision(); }
     });
     return true;
   }
 
   // Inbox — what needs your attention right now
   if (pathname === '/api/inbox') {
+    const snapshot = approvalSnapshot(cwd);
     let inbox;
     try { inbox = await getInboxAsync(cwd); }
     catch {
@@ -891,7 +900,9 @@ async function dispatch(req, res, url, cwd) {
     // verdict: `not-run` (capability none / undeclared / unavailable),
     // `unmeasured` (declared, no line for this sha), `unreadable` (only
     // pre-join-key lines exist), `ok` (a paired verdict).
-    const second_opinion = secondOpinionForTree(cwd);
+    let second_opinion;
+    try { second_opinion = await readSecondOpinion(cwd); }
+    catch { second_opinion = { state: 'unreadable', why: 'Second opinion evidence is unavailable; retry', verdict: null }; }
     // What is waiting on the person in their OTHER projects. The headline and
     // the badge are about the person, and the person is not scoped to `cwd`.
     // If the registry itself cannot be walked, say so — `unreadable` is not
@@ -903,11 +914,11 @@ async function dispatch(req, res, url, cwd) {
     // bound to the project as it is now. The typed name stored with it is the one
     // the page asks for; a store that cannot be read issues nothing and says so.
     const gates = inbox.pending_gates || [];
-    const issued = issueTokens(cwd, gates.map((g) => ({
+    const issued = await issueTokensAsync(cwd, gates.map((g) => ({
       id: g.id,
       gate: g.reversibility?.gate ? `gate:${g.reversibility.gate}` : g.id,
       guarded: ['expensive', 'unclassified'].includes(g.reversibility?.state),
-    })));
+    })), { snapshot });
     const pending_gates = gates.map((g) => ({ ...g, token: issued.tokens[g.id] || null }));
     const approval_tokens = { state: issued.state, ...(issued.why ? { why: issued.why } : {}) };
     res.writeHead(200, verdictHeaders(cwd, { 'Content-Type': 'application/json' }));
@@ -926,15 +937,7 @@ async function dispatch(req, res, url, cwd) {
     const c = url.searchParams.get('project') ? resolveProjectCwd(url.searchParams.get('project')) : cwd;
     let out;
     try {
-      const { latestApproval, treeReceipt, compareReceipts, mergeBase } = await import('../../../scripts/lib/receipt.mjs');
-      const approval = latestApproval(c);
-      if (!approval?.receipt) {
-        out = { state: 'no-receipt', why: 'no approving verdict carries a receipt yet', agent: approval?.agent || null, ts: approval?.ts || null };
-      } else {
-        const current = treeReceipt(c, { base: approval.receipt.base || mergeBase(c) });
-        const cmp = compareReceipts(approval.receipt, current, { cwd: c });
-        out = { ...cmp, agent: approval.agent, ts: approval.ts };
-      }
+      out = await readApprovalReceipt(c);
     } catch (e) {
       // Never "matches" on an error. Not knowing whether the approval still
       // holds is its own state, and calling it a match would put the strongest

package/board/scripts/lib/receipt.mjs

@@ -88,9 +88,34 @@ const excludeLogs = ACTIVITY_LOGS.map((p) => `:(exclude)${p}`);
  * Returns `null` outside a git repository rather than a fabricated receipt: a
  * receipt that cannot be built must not look like one that matched.
  */
-export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_FILES, verdictsDir = null, exclude = [] } = {}) {
+export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_FILES, verdictsDir = null, exclude = [], hashFilesInProcess = false } = {}) {
   const head = git(['rev-parse', 'HEAD'], cwd)?.trim();
   if (!head) return null;
+  // Off-loop board readers avoid one process per untracked file. Preserve Git's
+  // blob format (including SHA-256 repositories) and --no-filters semantics.
+  const algorithm = hashFilesInProcess ? git(['rev-parse', '--show-object-format'], cwd)?.trim() : null;
+  if (hashFilesInProcess && !['sha1', 'sha256'].includes(algorithm)) return null;
+  const digest = p => {
+    if (!hashFilesInProcess) return fileDigest(cwd, p);
+    try {
+      const fd = fsModule.openSync(join(cwd, p), 'r');
+      try {
+        const before = fsModule.fstatSync(fd, { bigint: true });
+        if (!before.isFile()) return null;
+        const hash = createHash(algorithm).update(`blob ${before.size}\0`);
+        const chunk = Buffer.allocUnsafe(64 * 1024);
+        let remaining = before.size;
+        while (remaining > 0n) {
+          const count = fsModule.readSync(fd, chunk, 0, Number(remaining > BigInt(chunk.length) ? BigInt(chunk.length) : remaining), null);
+          if (!count) return null;
+          hash.update(chunk.subarray(0, count)); remaining -= BigInt(count);
+        }
+        const after = fsModule.fstatSync(fd, { bigint: true });
+        if (after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs) return null;
+        return hash.digest('hex');
+      } finally { fsModule.closeSync(fd); }
+    } catch { return null; }
+  };
 
   // Directories a caller does not want in this receipt, ON TOP OF the activity logs.
   // ADR-024: a gate token binds to the project outside .great_cto/, because an
@@ -121,7 +146,9 @@ export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_F
   if (diff === null || untrackedOutput === null) return null;
   const untracked = untrackedOutput
     .split('\n').map((s) => s.trim()).filter(Boolean);
-  const untrackedDigest = untracked.map((p) => `${p}:${fileDigest(cwd, p) ?? '?'}`).join('\n');
+  const untrackedDigests = untracked.map(p => [p, digest(p)]);
+  if (hashFilesInProcess && untrackedDigests.some(([, value]) => !value)) return null;
+  const untrackedDigest = untrackedDigests.map(([p, value]) => `${p}:${value ?? '?'}`).join('\n');
   const dirty = (diff.trim() || untrackedDigest) ? sha(`${diff}\n--untracked--\n${untrackedDigest}`) : null;
 
   // Which files the change touches. `--diff-filter=d` drops deletions: a file
@@ -170,7 +197,7 @@ export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_F
   let truncated = false;
   for (const p of names) {
     if (Object.keys(files).length >= maxFiles) { truncated = true; break; }
-    const blob = fileDigest(cwd, p);
+    const blob = digest(p);
     if (!blob) return null;
     files[p] = blob;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.62.1",
+  "version": "3.62.3",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",