great-cto 3.72.0 → 3.73.0

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.72.0",
+  "version": "3.73.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/scripts/codex-pipeline.mjs

@@ -43,19 +43,54 @@ const save = state => {
   renameSync(`${file}.tmp`, file);
   observeWorkRun(state);
 };
+// Keep this local to the entrypoint: source controller and packaged CLI have
+// separate runtime closures, but both must complete queued pipe writes.
+function drainOutput(stream) {
+  if (stream.destroyed || stream.closed || stream.writableFinished) return Promise.resolve(true);
+  return new Promise(resolve => {
+    let settled = false;
+    const finish = complete => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      stream.off('error', completed);
+      stream.off('close', completed);
+      stream.off('finish', completed);
+      resolve(complete);
+    };
+    const completed = () => finish(true);
+    const timer = setTimeout(() => finish(false), 1000);
+    timer.unref();
+    stream.once('error', completed);
+    stream.once('close', completed);
+    stream.once('finish', completed);
+    if (!stream.writableEnded) {
+      try {
+        stream.write('', error => {
+          // The error event follows an errored write callback.
+          if (error) queueMicrotask(completed);
+          else completed();
+        });
+      } catch { completed(); }
+    }
+  });
+}
+async function exitAfterOutput(code) {
+  // An unresolved promise and unref timer must not allow an early rc0.
+  process.exitCode = code || 1;
+  const completed = await Promise.all([drainOutput(process.stdout), drainOutput(process.stderr)]);
+  process.exit(completed.every(Boolean) ? code : code || 1);
+}
+
 let locked = null, projectLease = null, work = null, taskForFinish = null;
 try {
   if (command === 'doctor') {
     const result = codexHostDoctor({ pluginRoot: resolve(value('--plugin-root') || join(dirname(fileURLToPath(import.meta.url)), '..')), store });
-    console.log(JSON.stringify(result, null, 2)); process.exit(result.state === 'ready' ? 0 : 2);
+    console.log(JSON.stringify(result, null, 2)); await exitAfterOutput(result.state === 'ready' ? 0 : 2);
   }
   if (command === 'list') {
-    const output = JSON.stringify(listCodexRuns({ root: value('--dir') ? realpathSync(resolve(value('--dir'))) : null, store }), null, 2) + '\n';
-    // Piped stdout is asynchronous: exiting before the callback can truncate JSON.
-    await new Promise((resolve, reject) => {
-      process.stdout.write(output, error => error ? reject(error) : resolve());
-    });
-    process.exit(0);
+    console.log(JSON.stringify(listCodexRuns({ root: value('--dir') ? realpathSync(resolve(value('--dir'))) : null, store }), null, 2));
+    await exitAfterOutput(0);
   }
   let state;
   if (command === 'start') {

package/board/scripts/lib/cost-meter.mjs

@@ -60,6 +60,9 @@ export const DEFAULT_PRICES = {
   // override via ~/.great_cto/model-prices.json or GREAT_CTO_MODEL_PRICES).
   'moonshotai/kimi-k2':  { input: 0.55, output: 2.2 },
   'moonshotai/kimi-k3':  { input: 3,    output: 15 },
+  // Standard endpoint snapshot, 2026-10-24. Highspeed is a different rate.
+  'moonshotai/kimi-k3.1-pro': { input: 2, output: 10, cacheRead: 0.2 },
+  'moonshotai/kimi-k3.1-pro-20261023': { input: 2, output: 10, cacheRead: 0.2 },
   // Read from OpenRouter's /models on 2026-08-27, not guessed. Until now these
   // reported `priced: false` — correctly, and that honesty is why an eval run on
   // glm-5.3-flash showed $0.000: not free, unpriced. Now they are priced exactly.
@@ -159,7 +162,7 @@ export function resolvePrice(model, prices = effectivePrices()) {
  * 172 turns of `claude-fable-5` were billed at $0.00 for exactly that reason,
  * and the total looked like a total rather than a total plus a hole.
  *
- * @returns {{usd:number, priced:boolean, assumed:boolean, source:string, model:string}}
+ * @returns {{usd:number|null, priced:boolean, assumed:boolean, source:string, model:string}}
  */
 /**
  * Cache-write dollars. Anthropic bills a 5-minute cache write at 1.25× the input
@@ -180,7 +183,30 @@ export function cacheWriteUsd(usage, inputPrice) {
   return total * 1.25 * inputPrice;
 }
 
+const KIMI_STANDARD_MODELS = new Set(['moonshotai/kimi-k3.1-pro', 'moonshotai/kimi-k3.1-pro-20261023']);
+
+function priceKimiUsage({ model, usage, prices }) {
+  const { price, source } = resolvePrice(model, prices);
+  const input = usage?.prompt_tokens;
+  const output = usage?.completion_tokens;
+  const cached = usage?.prompt_tokens_details?.cached_tokens;
+  const reasoning = usage?.completion_tokens_details?.reasoning_tokens;
+  const providerReportedUsd = typeof usage?.cost === 'number' && Number.isFinite(usage.cost) && usage.cost >= 0 ? usage.cost : null;
+  const base = { model, source, assumed: false, providerReportedUsd, costProvenance: 'calculated-standard-token-rates' };
+  if (source !== 'exact' || !price || ![price.input, price.output, price.cacheRead].every(n => Number.isFinite(n) && n >= 0)
+      || ![input, output, cached, reasoning].every(n => Number.isSafeInteger(n) && n >= 0)
+      || (Object.hasOwn(usage, 'total_tokens') && (!Number.isSafeInteger(usage.total_tokens) || usage.total_tokens !== input + output))
+      || (Object.hasOwn(usage, 'cost') && providerReportedUsd === null)
+      || cached > input || reasoning > output) {
+    return { ...base, usd: null, priced: false, usageState: 'unknown', costState: 'unknown' };
+  }
+  // OpenRouter includes cache reads in prompt and reasoning in completion.
+  const usd = ((input - cached) * price.input + cached * price.cacheRead + output * price.output) / 1_000_000;
+  return { ...base, usd, priced: true, usageState: 'known', costState: 'known' };
+}
+
 export function priceUsage({ model, usage, prices }) {
+  if (KIMI_STANDARD_MODELS.has(model)) return priceKimiUsage({ model, usage, prices: prices || effectivePrices() });
   const { price, source } = resolvePrice(model, prices || effectivePrices());
   if (!usage || !price) {
     return { usd: 0, priced: false, assumed: false, source, model: model || '' };
@@ -199,9 +225,11 @@ export function priceUsage({ model, usage, prices }) {
  * @param {string} opts.model
  * @param {{input_tokens?:number, output_tokens?:number}} opts.usage  Anthropic response.usage
  * @param {object} [opts.prices]  override table (for tests)
- * @returns {number} USD (0 if usage or price unknown)
+ * @returns {number|null} USD; exact Kimi requires complete raw OpenRouter usage
+ * and returns null when unknown. Legacy models retain the numeric 0 fallback.
  */
 export function costForUsage({ model, usage, prices }) {
+  if (KIMI_STANDARD_MODELS.has(model)) return priceKimiUsage({ model, usage, prices: prices || effectivePrices() }).usd;
   if (!usage) return 0;
   const p = priceForModel(model, prices);
   if (!p) return 0;
@@ -246,6 +274,10 @@ function main(argv) {
     return process.exit(2);
   }
   const cost = costForUsage({ model, usage: { input_tokens: inTok, output_tokens: outTok } });
+  if (cost === null) {
+    process.stderr.write('cost-meter: complete provider usage required — cost unknown\n');
+    return process.exit(2);
+  }
   process.stdout.write(String(round4(cost)));
 }
 

package/board/scripts/lib/cross-model-review.mjs

@@ -13,14 +13,14 @@
 //   node scripts/lib/cross-model-review.mjs --diff /tmp/d.diff --spec docs/architecture/ARCH-x.md
 //   GREAT_CTO_CROSS_REVIEW_MODEL=google/gemini-2.5-pro node ... --diff -
 
-import { readFileSync } from 'node:fs';
+import { readFileSync, lstatSync, openSync, closeSync, fstatSync, readSync, constants } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { costForUsage, round4, resolvePrice } from './cost-meter.mjs';
 import { resolveSecondOpinion, codexReview } from './second-opinion.mjs';
 import { principalError } from './provider-exhaustion.mjs';
 import { existsSync, appendFileSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve, parse, sep } from 'node:path';
 import { reviewInputBinding, parseLegacyReview } from './review-contract.mjs';
 
 /**
@@ -34,9 +34,14 @@ import { reviewInputBinding, parseLegacyReview } from './review-contract.mjs';
 export const EXIT = Object.freeze({ PASS: 0, BLOCK: 1, USAGE: 2, SKIPPED: 3 });
 
 /**
- * Which provider reviews, decided from three sources in a fixed order:
- * an explicit `--provider`, then the project's `capabilities: second_opinion`,
- * then — for compatibility with every script that set it — the OpenRouter env.
+ * Which provider reviews, decided from two sources in a fixed order:
+ * an explicit `--provider`, then the project's `capabilities: second_opinion`.
+ *
+ * An exported OPENROUTER_API_KEY used to be a third source: with nothing
+ * declared, the key chose OpenRouter and the diff left the machine without
+ * anyone deciding it should (CSO SEC-2, 27.10). The key is a credential, not a
+ * decision — undeclared stays undeclared, and the skip line names the
+ * declaration that would turn the review on.
  *
  * Returns the resolver's four states plus `source`, so the log line can say
  * why this provider and not another. Pure: `codex` and `env` are injected.
@@ -48,9 +53,9 @@ export function decideProvider({ argv = [], projectMd = '', codex = null, env =
     return { ...r, source: '--provider' };
   }
   const fromProject = resolveSecondOpinion({ projectMd, codex, env });
-  if (fromProject.state !== 'undeclared') return { ...fromProject, source: 'PROJECT.md' };
-  if (env.OPENROUTER_API_KEY) {
-    return { state: 'declared', provider: 'openrouter', why: '', source: 'OPENROUTER_API_KEY (second_opinion undeclared)' };
+  if (fromProject.state === 'undeclared' && env.OPENROUTER_API_KEY) {
+    return { ...fromProject, source: 'PROJECT.md',
+      why: `${fromProject.why}; OPENROUTER_API_KEY is set but does not choose the provider — declare \`second_opinion: openrouter\` or pass --provider openrouter` };
   }
   return { ...fromProject, source: 'PROJECT.md' };
 }
@@ -128,6 +133,93 @@ export async function callOpenRouter({ apiKey, model, system, user, maxTokens =
 
 function readArg(argv, name) { const i = argv.indexOf(name); return i > -1 ? argv[i + 1] : null; }
 
+/** Read explicitly selected input without following symlinks or special files. */
+function readProfileFile(file, root, cap) {
+  if (typeof file !== 'string' || !file || file === '-' || Buffer.byteLength(file) > 4096
+      || file.split(/[\\/]/).includes('..') || /[\x00-\x1f\x7f]/.test(file)) throw new Error('invalid-input-file');
+  const target = resolve(root, file), parsed = parse(target);
+  const parts = target.slice(parsed.root.length).split(sep);
+  let current = parsed.root;
+  for (let i = 0; i < parts.length; i++) {
+    if (parts[i] === '.git' || /^\.env(?:\.|$)/i.test(parts[i])) throw new Error('invalid-input-file');
+    current = join(current, parts[i]);
+    const st = lstatSync(current);
+    if (st.isSymbolicLink() || (i < parts.length - 1 ? !st.isDirectory() : !st.isFile())) throw new Error('invalid-input-file');
+  }
+  const fd = openSync(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.size > cap) throw new Error('invalid-input-file');
+    const bytes = Buffer.alloc(cap + 1);
+    let size = 0, n;
+    while (size <= cap && (n = readSync(fd, bytes, size, cap + 1 - size, null)) > 0) size += n;
+    if (size > cap) throw new Error('invalid-input-file');
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, size));
+  } finally { closeSync(fd); }
+}
+
+/** Check explicit runtime roots before any credential getter is evaluated. */
+export function validateKimiRuntimePaths(root, operatorRoot) {
+  for (const [directory, allowMissing] of [[root, false], [operatorRoot, true]]) {
+    if (typeof directory !== 'string' || !directory || Buffer.byteLength(directory) > 4096
+        || /[\x00-\x1f\x7f]/.test(directory)) throw new Error('invalid-runtime-path');
+    const target = resolve(directory), parsed = parse(target);
+    let current = parsed.root, missing = false;
+    for (const part of target.slice(parsed.root.length).split(sep).filter(Boolean)) {
+      if (Buffer.byteLength(part) > 255 || part === '.git' || /^\.env(?:\.|$)/i.test(part)) throw new Error('invalid-runtime-path');
+      current = join(current, part);
+      if (missing) continue;
+      try {
+        const st = lstatSync(current);
+        if (st.isSymbolicLink() || !st.isDirectory()) throw new Error('invalid-runtime-path');
+      } catch (error) {
+        if (allowMissing && error.code === 'ENOENT') missing = true;
+        else throw error;
+      }
+    }
+  }
+}
+
+/** Explicit extra opinion. Runtime capabilities are resolved only after admission. */
+export async function runProfileReview(options = {}) {
+  const argv = options.argv ?? [];
+  if (!argv.includes('--profile')) return null;
+  const denied = () => ({ exitCode: EXIT.USAGE, summary: { status: 'usage-error', verdict: null,
+    advisory: true, authority: 'NONE', releaseEligibility: 'NOT_CHECKED', reasonCode: 'invalid-profile-invocation' } });
+  const allowed = new Set(['--profile', '--envelope', '--task', '--context-class', '--reason', '--root', '--operator-root', '--diff', '--spec']);
+  const flags = new Map();
+  for (let i = 0; i < argv.length; i += 2) {
+    const flag = argv[i], value = argv[i + 1];
+    if (!allowed.has(flag) || flags.has(flag) || typeof value !== 'string' || !value || value.startsWith('--')) return denied();
+    flags.set(flag, value);
+  }
+  if (flags.get('--profile') !== 'kimi-readonly-v1'
+      || ['--envelope', '--task', '--context-class', '--reason', '--operator-root'].some(k => !flags.has(k))) return denied();
+  let root, operatorRoot, envelope, profileApi;
+  try {
+    root = resolve(flags.get('--root') || process.cwd());
+    operatorRoot = resolve(root, flags.get('--operator-root'));
+    validateKimiRuntimePaths(root, operatorRoot);
+    envelope = JSON.parse(readProfileFile(flags.get('--envelope'), root, 131072));
+    if (!envelope || envelope.mode !== 'diff-review' || envelope.taskId !== flags.get('--task')
+        || envelope.contextClass !== flags.get('--context-class') || envelope.reason !== flags.get('--reason')) return denied();
+    for (const [flag, field, cap] of [['--diff', 'diff', 96000], ['--spec', 'spec', 16000]]) {
+      if (flags.has(flag) && readProfileFile(flags.get(flag), root, cap) !== envelope[field]) return denied();
+    }
+    profileApi = await import('./kimi-review-profile.mjs');
+    profileApi.buildKimiInputBinding(envelope);
+  } catch { return denied(); }
+  const result = await profileApi.runKimiReview({ profile: flags.get('--profile'), envelope, root,
+    operatorRoot,
+    get apiKey() { return options.apiKey ?? (options.env ?? process.env).OPENROUTER_API_KEY; },
+    fetchImpl: options.fetchImpl, now: options.now, uuid: options.uuid, signal: options.signal, timeoutMs: options.timeoutMs });
+  const complete = result.status === 'complete' && ['PASS', 'BLOCK'].includes(result.verdict);
+  return { exitCode: complete ? result.verdict === 'BLOCK' ? EXIT.BLOCK : EXIT.PASS : EXIT.SKIPPED,
+    summary: { status: result.status, reasonCode: result.reasonCode, verdict: complete ? result.verdict : null,
+      advisory: true, authority: 'NONE', releaseEligibility: 'NOT_CHECKED', bindingDigest: result.bindingDigest,
+      findings: result.result?.findings?.length ?? null, costState: result.costState, costUsd: result.costUsd } };
+}
+
 /**
  * The tree's identity at review time — git HEAD and whether it was dirty.
  * CLI-only: the pure `reviewLogLine` above never shells out; per this file's
@@ -147,6 +239,11 @@ function gitIdentity(cwd) {
 }
 
 async function main(argv) {
+  if (argv.includes('--profile')) {
+    const r = await runProfileReview({ argv, fetchImpl: fetch });
+    console.log(JSON.stringify(r.summary));
+    process.exit(r.exitCode);
+  }
   const diffPath = readArg(argv, '--diff');
   if (!diffPath) { console.error('Usage: cross-model-review.mjs --diff <file|-> [--spec <file>] [--model <slug>] [--provider codex|openrouter]'); process.exit(EXIT.USAGE); }
 
@@ -216,7 +313,8 @@ async function main(argv) {
   // was present and costForUsage prices an unknown model at nothing. A reviewer
   // that reads as free is the defect this repository has removed twice already.
   const priced = resolvePrice(res.model).price != null;
-  const cost = res.usage && priced ? round4(costForUsage({ model: res.model, usage: res.usage })) : null;
+  const calculated = res.usage && priced ? costForUsage({ model: res.model, usage: res.usage }) : null;
+  const cost = calculated === null ? null : round4(calculated);
 
   for (const f of findings) console.log(`  ${f.severity} ${f.file}:${f.line} — ${f.issue}`);
   if (verdict == null) {