great-cto 3.70.0 → 3.71.1

package/dist/codex.js

@@ -72,7 +72,6 @@ export function codexInstallPlan({ repoDir, codexOnPath }) {
 import { existsSync as fsExists, readdirSync, readFileSync as fsRead } from "node:fs";
 import { homedir as home } from "node:os";
 import { join as pjoin } from "node:path";
-import { execFileSync } from "node:child_process";
 /** A usable `codex` binary: PATH first, then nvm installs, then the desktop app. Null when none. */
 export function findCodexBinary(env = process.env, h = home()) {
     for (const dir of String(env.PATH || "").split(":")) {
@@ -134,18 +133,8 @@ export function upgradeCodexPlugin(opts = {}) {
         return { status: "skipped", fromVersion: null, toVersion: null, reason: "great_cto is not installed for Codex" };
     }
     const from = installedCodexVersion(codexHome);
-    const bin = opts.bin === undefined ? findCodexBinary() : opts.bin;
-    if (!bin) {
-        return { status: "skipped", fromVersion: from, toVersion: from, reason: "codex not found on PATH or under ~/.nvm — run: codex plugin marketplace upgrade great-cto" };
-    }
-    try {
-        execFileSync(bin, ["plugin", "marketplace", "upgrade", "great-cto"], {
-            stdio: ["ignore", "pipe", "pipe"], timeout: 180_000, env: { ...process.env, CODEX_HOME: codexHome },
-        });
-    }
-    catch (e) {
-        return { status: "failed", fromVersion: from, toVersion: from, reason: String(e.message).split("\n")[0] };
-    }
-    const to = installedCodexVersion(codexHome);
-    return { status: to && to !== from ? "upgraded" : "already_latest", fromVersion: from, toVersion: to };
+    return {
+        status: "failed", fromVersion: from, toVersion: from,
+        reason: "verified native Codex activation is unsupported until no-fetch runtime and preactivation/recovery admission are proven; marketplace refresh was not invoked",
+    };
 }

package/dist/companion.js

@@ -1,25 +1,4 @@
-/**
- * Companion plugin installer — superpowers + beads.
- *
- * great_cto requires these two plugins to be present. This module installs
- * them automatically during `great-cto init/install` so users get a working
- * setup in one command without reading the "Requires:" line in the README.
- *
- * Install strategy:
- *   - Clone (depth=1) the latest semver tag from GitHub into
- *     ~/.claude/plugins/cache/local/<name>/<version>/
- *   - Enable <name>@local in ~/.claude/settings.json
- *   - Idempotent — skips if any version is already present in the cache dir
- *   - Best-effort — never fails the parent install; logs a human-friendly
- *     hint if git is unavailable or clone fails
- */
-import { spawnSync, execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { dim, success, log, warn } from "./ui.js";
-import { enablePlugin } from "./settings.js";
-import { semverDescending } from "./semver.js";
+/** Companion metadata is discoverable; installation requires separate artifact admission. */
 export const COMPANION_PLUGINS = [
     {
         name: "superpowers",
@@ -32,107 +11,12 @@ export const COMPANION_PLUGINS = [
         repoUrl: "https://github.com/steveyegge/beads.git",
     },
 ];
-function getPluginCacheDir(name) {
-    return join(homedir(), ".claude", "plugins", "cache", "local", name);
-}
-/** Returns true if any version folder already exists in the cache dir. */
-function isAlreadyInstalled(name) {
-    const base = getPluginCacheDir(name);
-    if (!existsSync(base))
-        return null;
-    try {
-        const versions = readdirSync(base).filter((v) => /\S/.test(v));
-        if (versions.length === 0)
-            return null;
-        // Return the highest version, not filesystem order — matches
-        // upgrade.ts/installer.ts which both sort before picking.
-        return versions.sort(semverDescending)[0];
-    }
-    catch {
-        return null;
-    }
-}
-/** Detect the latest semver tag from a remote repo without cloning. */
-export function detectLatestTag(repoUrl) {
-    try {
-        const out = execFileSync("git", ["ls-remote", "--tags", repoUrl], {
-            encoding: "utf-8",
-            timeout: 15_000,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        const tags = out
-            .split("\n")
-            .map((line) => line.match(/refs\/tags\/v?([0-9]+\.[0-9]+\.[0-9]+)(?!\^)/)?.[1])
-            .filter((t) => !!t)
-            .sort(semverDescending);
-        return tags[0] ?? null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Install a single companion plugin.
- * Silent no-op if already present. Best-effort on failure.
- */
+/** Third-party snapshots have no publisher admission or managed recovery contract. */
+export const COMPANION_ADMISSION_REQUIRED = "UNSUPPORTED: companion artifact admission and managed activation are not established; no files changed";
+/** Refuse before network, cache inspection, settings enablement or overlay writes. */
 export function installCompanionPlugin(plugin) {
-    const { name, pluginKey, repoUrl } = plugin;
-    // ── already installed? ─────────────────────────────────────────────────
-    const existing = isAlreadyInstalled(name);
-    if (existing) {
-        // Make sure it's enabled in settings even if it was manually placed
-        enablePlugin(pluginKey);
-        return { name, status: "already_present", version: existing };
-    }
-    // ── git available? ─────────────────────────────────────────────────────
-    try {
-        execFileSync("git", ["--version"], { stdio: "ignore", timeout: 5_000 });
-    }
-    catch {
-        const msg = `git not found — install git, then run: npx great-cto install`;
-        warn(`${name}: ${msg}`);
-        return { name, status: "skipped", version: "—", reason: msg };
-    }
-    // ── resolve version ────────────────────────────────────────────────────
-    const tag = detectLatestTag(repoUrl);
-    const version = tag ?? "main";
-    const ref = tag ? `v${tag}` : "main";
-    const destDir = join(getPluginCacheDir(name), version);
-    mkdirSync(getPluginCacheDir(name), { recursive: true });
-    log(dim(`  installing ${name} ${version}…`));
-    // ── clone ──────────────────────────────────────────────────────────────
-    const cloneArgs = tag
-        ? ["clone", "--depth=1", "--branch", ref, repoUrl, destDir]
-        : ["clone", "--depth=1", repoUrl, destDir];
-    const result = spawnSync("git", cloneArgs, {
-        stdio: ["ignore", "pipe", "pipe"],
-        timeout: 60_000,
-    });
-    if (result.status !== 0) {
-        const stderr = (result.stderr?.toString() ?? "").slice(0, 200);
-        const msg = `clone failed: ${stderr}`;
-        warn(`${name}: ${msg}`);
-        warn(`  install manually: claude plugin install github.com/${repoUrl.replace("https://github.com/", "").replace(".git", "")}`);
-        return { name, status: "skipped", version: "—", reason: msg };
-    }
-    // ── enable in settings ─────────────────────────────────────────────────
-    enablePlugin(pluginKey);
-    success(`${name} ${version} installed`);
-    return { name, status: "installed", version };
+    return { name: plugin.name, status: "skipped", version: "—", reason: COMPANION_ADMISSION_REQUIRED };
 }
-/**
- * Install all companion plugins declared in COMPANION_PLUGINS.
- * Returns a summary array. Never throws — best-effort for all.
- */
 export function installAllCompanions() {
-    return COMPANION_PLUGINS.map((plugin) => {
-        try {
-            return installCompanionPlugin(plugin);
-        }
-        catch (e) {
-            const msg = e instanceof Error ? e.message : String(e);
-            warn(`${plugin.name}: unexpected error — ${msg}`);
-            return { name: plugin.name, status: "skipped", version: "—", reason: msg };
-        }
-    });
+    return COMPANION_PLUGINS.map(installCompanionPlugin);
 }

package/dist/installer.js

@@ -1,12 +1,11 @@
 // Install the great_cto plugin into ~/.claude/plugins/cache/local/great_cto/<version>/.
 // Uses git clone. Falls back to tarball fetch if git is unavailable.
-import { spawnSync, execFileSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { cpSync } from "node:fs";
-import { existsSync, mkdirSync, rmSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { log, success, warn, dim } from "./ui.js";
 const REPO_URL = "https://github.com/avelikiy/great_cto.git";
 export function hasGit() {
     try {
@@ -60,75 +59,8 @@ export function findInstalledVersions() {
     }
 }
 export function install(opts = {}) {
-    if (!hasGit()) {
-        throw new Error("git is required to install great_cto. Install git first: https://git-scm.com/downloads");
-    }
-    // Resolve version
-    let version = opts.version;
-    if (!version) {
-        const latest = detectLatestVersion();
-        if (!latest) {
-            warn("Could not detect latest version from GitHub tags — falling back to main branch.");
-            version = "main";
-        }
-        else {
-            version = latest;
-        }
-    }
-    const pluginDir = join(getPluginBaseDir(), version);
-    if (existsSync(pluginDir)) {
-        const manifest = join(pluginDir, ".claude-plugin", "plugin.json");
-        const looksValid = existsSync(manifest);
-        if (looksValid && !opts.force) {
-            return { installed: false, pluginDir, version, alreadyInstalled: true };
-        }
-        // Either corrupted, or --force: wipe and reinstall
-        if (!looksValid) {
-            warn(`Previous install at ${pluginDir} looks corrupted — reinstalling.`);
-        }
-        rmSync(pluginDir, { recursive: true, force: true });
-    }
-    mkdirSync(getPluginBaseDir(), { recursive: true });
-    log(dim(`  cloning ${REPO_URL} into ${pluginDir}`));
-    const ref = /^[0-9]+\.[0-9]+\.[0-9]+$/.test(version) ? `v${version}` : version;
-    const result = spawnSync("git", ["clone", "--depth=1", "--branch", ref, REPO_URL, pluginDir], {
-        stdio: ["ignore", "pipe", "pipe"],
-        timeout: 120_000,
-    });
-    if (result.status !== 0) {
-        const stderr = result.stderr?.toString() ?? "";
-        // If branch/tag doesn't exist, try plain clone of main
-        if (stderr.includes("not found") || stderr.includes("Remote branch")) {
-            warn(`Tag ${ref} not found — cloning default branch.`);
-            rmSync(pluginDir, { recursive: true, force: true });
-            const r2 = spawnSync("git", ["clone", "--depth=1", REPO_URL, pluginDir], {
-                stdio: ["ignore", "pipe", "pipe"],
-                timeout: 120_000,
-            });
-            if (r2.status !== 0) {
-                throw new Error(`git clone failed: ${r2.stderr?.toString() ?? "unknown error"}`);
-            }
-            // Re-read version from actual plugin.json
-            version = readPluginVersion(pluginDir) ?? "main";
-        }
-        else {
-            throw new Error(`git clone failed: ${stderr}`);
-        }
-    }
-    // A clone carries sources; the plugin runs on the build. Supply it from this
-    // CLI's own dist before checking whether the result can run.
-    const supplied = supplyBuiltDist(pluginDir);
-    if (supplied != null)
-        log(dim(`  supplied ${supplied} built file(s) into packages/cli/dist/`));
-    // Sanity check: can it RUN, not merely "did files arrive".
-    const missing = missingRuntimeParts(pluginDir);
-    if (missing.length) {
-        throw new Error(`Install appeared to succeed but the plugin cannot run — missing:\n` +
-            missing.map((m) => `  - ${m}`).join("\n") +
-            `\nThis is an install bug, not a configuration problem. Please report it with this list.`);
-    }
-    success(`plugin installed at ${pluginDir}`);
-    return { installed: true, pluginDir, version, alreadyInstalled: false };
+    throw new Error("Plugin installation refused: a signed complete runtime and verified managed activation are required. " +
+        "Mutable Git/main fallback and supplying dist from the running CLI are disabled.");
 }
 /**
  * The plugin needs BUILT JavaScript, and a git clone does not contain any.

package/dist/main.js

@@ -121,6 +121,13 @@ function parseArgs(argv) {
             args.command = "console";
         else if (a === "telemetry")
             args.command = "telemetry";
+        else if (a === "--no-telemetry")
+            continue;
+        else if (a === "distribution") {
+            args.command = "distribution";
+            args.taskArgs = argv.slice(i + 1);
+            break;
+        }
         else if (a === "register")
             args.command = "register";
         else if (a === "ci")
@@ -759,8 +766,8 @@ ${bold("Usage:")}
   npx great-cto run "describe the task" [--host claude-code|codex] [--dir PATH]
   npx great-cto status [RUN_UUID] [--host codex] [--json]
   npx great-cto resume [RUN_UUID] [--host codex]
-  npx great-cto install [options]    Same as init
-  npx great-cto [init] [options]     Detect + bootstrap
+  npx great-cto install [options]    Refused until managed plugin admission is supported
+  npx great-cto [init] [options]     Plugin activation currently unsupported (ADR-045)
   npx great-cto board [--port 3141] [--no-open]
   npx great-cto console [--port 8788] [--bind 0.0.0.0] [--no-open]
   npx great-cto register [--dir PATH]
@@ -770,8 +777,9 @@ ${bold("Usage:")}
   npx great-cto task work decisions|approve|verify|complete|metrics|preview|publish ...
   npx great-cto codex-host doctor|list|start|resume|status ...
   npx great-cto serve [--port 3142]
-  npx great-cto upgrade [superpowers|beads]  Re-clone companions to latest tag + re-apply overlays
-  npx great-cto upgrade --self                Upgrade the great-cto CLI itself, in place
+  npx great-cto upgrade [superpowers|beads]  Unsupported pending companion artifact admission
+  npx great-cto upgrade --self                Verified update for an owned plain npm installation
+  npx great-cto distribution status          Inspect separately configured verifier toolchain
   npx great-cto statusline install            Record Claude's plan use (5h / weekly %) for the board; keeps your status line
   npx great-cto statusline uninstall          Put your previous status line back
   npx great-cto uninstall [--yes]             Show what great_cto installed; --yes removes it (your data stays)
@@ -807,16 +815,18 @@ ${bold("Register:")}
                                 run this if the project doesn't appear in board)
 
 ${bold("Upgrade:")}
-  great-cto upgrade              Upgrade superpowers + beads to latest, re-apply critic overlays
-  great-cto upgrade superpowers  Upgrade superpowers only
-  great-cto upgrade beads        Upgrade beads only
-  great-cto upgrade --self       Upgrade the great-cto CLI itself (also: upgrade self)
-  great-cto upgrade codex        Refresh great_cto in Codex (also part of plain upgrade)
+  great-cto upgrade              Refused: choose a supported explicit update route
+  great-cto upgrade superpowers  Unsupported until companion runtime admission is available
+  great-cto upgrade beads        Unsupported until companion runtime admission is available
+  great-cto upgrade --self       Verify signed artifacts, then update an owned plain npm prefix
+  great-cto upgrade codex        Unsupported until native no-fetch activation is proven
+  great-cto distribution status  Inspect operator verifier configuration; no release admission
+  great-cto distribution configure ...  Register explicit tool paths and digests (see ADR-045)
   great-cto uninstall            Plan: what would be removed, what is kept (changes nothing)
   great-cto uninstall --yes      Remove plugin, agents, commands, board service, caches
       --purge-data               Also move ~/.great_cto aside (reversible, never deleted)
       --projects                 Also remove the pre-push hooks init wrote into your projects
-  ${dim("(Safe to run any time — idempotent if already on latest)")}
+  ${dim("(Missing artifact proof preserves the selected installation; no mutable fallback)")}
 
 ${bold("CI gate:")}
   great-cto ci                         Single-command CI gate (archetype + budget check)
@@ -879,57 +889,8 @@ ${bold("Links:")}
 `);
 }
 async function runInitCodex(args) {
-    const { codexInstallPlan } = await import("./codex.js");
-    const { execFileSync, spawnSync } = await import("node:child_process");
-    log(bold("great-cto · Codex host install"));
-    log("");
-    // Is the host actually there? The previous version of this function wrote
-    // hook scripts and a config fragment without checking, into
-    // `~/.codex/skills/great_cto/` — a directory a working Codex install does not
-    // have. It reported success either way.
-    let codexOnPath = false;
-    try {
-        execFileSync("codex", ["--version"], { stdio: "ignore", timeout: 15000 });
-        codexOnPath = true;
-    }
-    catch {
-        codexOnPath = false;
-    }
-    const plan = codexInstallPlan({ repoDir: args.dir, codexOnPath });
-    if (!plan.ok) {
-        error(plan.why);
-        return 1;
-    }
-    log(`This registers ${cyan(args.dir)} as a Codex plugin marketplace and installs from it.`);
-    log("");
-    log(bold("Carries over:"));
-    for (const s2 of plan.supported)
-        log(`  ${green("✓")} ${s2}`);
-    log("");
-    // Printed on every run, not buried in docs. An install that lists only what it
-    // gives promises a pipeline this host cannot run.
-    log(bold("Does NOT carry over on Codex:"));
-    for (const s2 of plan.notSupported)
-        log(`  ${yellow("—")} ${s2}`);
-    log("");
-    if (args.dryRun) {
-        log(yellow("dry-run: these commands would run."));
-        for (const c of plan.commands)
-            log(`  ${dim(c)}`);
-        return 0;
-    }
-    for (const c of plan.commands) {
-        log(dim(`  $ ${c}`));
-        const parts = c.split(" ");
-        const r = spawnSync(parts[0], parts.slice(1), { stdio: "inherit", timeout: 120000 });
-        if (r.status !== 0) {
-            error(`command failed: ${c}`);
-            return 1;
-        }
-    }
-    log("");
-    log(`${green("✓")} installed. Verify with: ${cyan("codex plugin list")}`);
-    return 0;
+    error("Codex activation is unsupported until a verified no-fetch local runtime and recovery route are proven. No marketplace or installed plugin was changed.");
+    return 1;
 }
 async function runInit(args) {
     // Route to Codex-specific install if --host codex
@@ -1428,40 +1389,11 @@ function installPrePushHook(projectDir) {
     }
 }
 async function runSelfUpgrade() {
-    const { performSelfUpgrade, resolveRunningBinaryPath } = await import("./self-upgrade.js");
-    const currentVersion = getCliVersion();
-    const binaryPath = resolveRunningBinaryPath();
-    log(`${bold("great-cto upgrade --self")} — current version ${cyan(currentVersion)}`);
-    log(dim(`  running binary: ${binaryPath}`));
-    log("");
-    const result = performSelfUpgrade({ currentVersion, binaryPath });
-    if (result.manager === "npx") {
-        log(result.message);
-        return 0;
-    }
-    if (result.exitCode !== 0) {
-        error(result.message);
-        return result.exitCode;
-    }
-    success(result.message);
-    // The CLI is upgraded; the plugin Claude Code actually loads may not be.
-    // `npm i -g` never touches the plugin cache, so without this the user is told
-    // the upgrade succeeded and keeps running the previous release's hooks and
-    // agent prompts with nothing anywhere saying so.
-    try {
-        const { pluginCacheLagWarning } = await import("./self-upgrade.js");
-        const { readdirSync } = await import("node:fs");
-        const { join } = await import("node:path");
-        const cacheRoot = join(homedir(), ".claude", "plugins", "cache", "local", "great_cto");
-        const dirs = readdirSync(cacheRoot);
-        const warning = pluginCacheLagWarning(result.newVersion ?? "", dirs);
-        if (warning) {
-            log("");
-            log(dim(warning));
-        }
-    }
-    catch { /* no plugin cache is not a lag — the plugin is simply not installed */ }
-    return 0;
+    const { resolveRunningBinaryPath } = await import("./self-upgrade.js");
+    const { runVerifiedSelfUpgrade } = await import("./release-update.mjs");
+    const result = await runVerifiedSelfUpgrade({ currentVersion: getCliVersion(), binaryPath: resolveRunningBinaryPath() });
+    log(JSON.stringify(result));
+    return ["SMOKE_PASSED", "ALREADY_ACTIVE", "ALREADY_CURRENT"].includes(result.state) ? 0 : 1;
 }
 async function runUpgrade(rawArgv, args) {
     // `upgrade --self` / `upgrade self` — upgrade the CLI itself, not companion plugins.
@@ -1490,22 +1422,10 @@ async function runUpgrade(rawArgv, args) {
     else {
         results = await upgradeAll();
     }
-    for (const r of results) {
-        if (r.status === "upgraded") {
-            success(`${r.name} ${r.fromVersion} → ${r.toVersion}`);
-        }
-        else if (r.status === "already_latest") {
-            log(`  ${dim(`${r.name} ${r.toVersion} already at latest (overlays re-applied)`)}`);
-        }
-        else {
-            warn(`${r.name} skipped — ${r.reason ?? "unknown reason"}`);
-        }
-    }
-    // Codex keeps its own snapshot of great_cto and never refreshes it; without this
-    // step every Codex guard shipped after the first install stays out of reach.
-    if (!targetPlugin)
-        await reportCodexUpgrade();
-    return 0;
+    // Unadmitted companion routes fail before fetching, deleting caches or enabling plugins.
+    for (const r of results)
+        warn(`${r.name}: ${r.reason ?? "UNSUPPORTED: companion artifact admission required"}`);
+    return 1;
 }
 async function reportCodexUpgrade() {
     const { upgradeCodexPlugin } = await import("./codex.js");
@@ -1538,12 +1458,13 @@ async function main() {
     // widen types at every call site.
     const finish = async (code) => {
         try {
-            await sendUsagePing({
-                cliVersion: getCliVersion(),
-                subcommand: args.command,
-                exitCode: code,
-                durationMs: Date.now() - __tStart,
-            });
+            if (!rawArgv.includes("--no-telemetry"))
+                await sendUsagePing({
+                    cliVersion: getCliVersion(),
+                    subcommand: args.command,
+                    exitCode: code,
+                    durationMs: Date.now() - __tStart,
+                });
         }
         catch { /* telemetry never affects the exit */ }
         // Update hint / prompt — printed after the command's own output, never
@@ -1561,6 +1482,12 @@ async function main() {
         process.exit(code);
     };
     // `great-cto telemetry <on|off|status|whoami>` — inspect / toggle, never sends.
+    if (args.command === "distribution") {
+        const { runDistributionCommand } = await import("./release-update.mjs");
+        const result = runDistributionCommand(rawArgv.slice(rawArgv.indexOf("distribution") + 1));
+        process.stdout.write(JSON.stringify(result) + "\n");
+        await finish(result.state === "REFUSED" ? 1 : 0);
+    }
     if (args.command === "telemetry") {
         const { exitCode, output } = telemetrySubcommand(args.positional[0]);
         process.stdout.write(output);
@@ -1680,7 +1607,13 @@ async function main() {
     if (args.command === "run" || args.command === "status" || args.command === "resume") {
         const { runDaily } = await import('./run.js');
         const dailyArgs = [...(args.hostInput !== undefined ? ['--host', args.hostInput] : []), ...(args.taskArgs ?? [])];
-        await finish(runDaily(args.command, dailyArgs, { cwd: args.dir }));
+        const code = runDaily(args.command, dailyArgs, { cwd: args.dir });
+        if (args.command === 'status') {
+            await new Promise((resolve, reject) => {
+                process.stdout.write('', error => error ? reject(error) : resolve());
+            });
+        }
+        await finish(code);
     }
     if (args.command === "serve") {
         try {