great-cto 3.72.0 → 3.74.0

package/board/scripts/lib/cross-model-review.mjs

@@ -13,14 +13,14 @@
 //   node scripts/lib/cross-model-review.mjs --diff /tmp/d.diff --spec docs/architecture/ARCH-x.md
 //   GREAT_CTO_CROSS_REVIEW_MODEL=google/gemini-2.5-pro node ... --diff -
 
-import { readFileSync } from 'node:fs';
+import { readFileSync, lstatSync, openSync, closeSync, fstatSync, readSync, constants } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { costForUsage, round4, resolvePrice } from './cost-meter.mjs';
 import { resolveSecondOpinion, codexReview } from './second-opinion.mjs';
 import { principalError } from './provider-exhaustion.mjs';
 import { existsSync, appendFileSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
+import { join, resolve, parse, sep } from 'node:path';
 import { reviewInputBinding, parseLegacyReview } from './review-contract.mjs';
 
 /**
@@ -34,9 +34,14 @@ import { reviewInputBinding, parseLegacyReview } from './review-contract.mjs';
 export const EXIT = Object.freeze({ PASS: 0, BLOCK: 1, USAGE: 2, SKIPPED: 3 });
 
 /**
- * Which provider reviews, decided from three sources in a fixed order:
- * an explicit `--provider`, then the project's `capabilities: second_opinion`,
- * then — for compatibility with every script that set it — the OpenRouter env.
+ * Which provider reviews, decided from two sources in a fixed order:
+ * an explicit `--provider`, then the project's `capabilities: second_opinion`.
+ *
+ * An exported OPENROUTER_API_KEY used to be a third source: with nothing
+ * declared, the key chose OpenRouter and the diff left the machine without
+ * anyone deciding it should (CSO SEC-2, 27.10). The key is a credential, not a
+ * decision — undeclared stays undeclared, and the skip line names the
+ * declaration that would turn the review on.
  *
  * Returns the resolver's four states plus `source`, so the log line can say
  * why this provider and not another. Pure: `codex` and `env` are injected.
@@ -48,9 +53,9 @@ export function decideProvider({ argv = [], projectMd = '', codex = null, env =
     return { ...r, source: '--provider' };
   }
   const fromProject = resolveSecondOpinion({ projectMd, codex, env });
-  if (fromProject.state !== 'undeclared') return { ...fromProject, source: 'PROJECT.md' };
-  if (env.OPENROUTER_API_KEY) {
-    return { state: 'declared', provider: 'openrouter', why: '', source: 'OPENROUTER_API_KEY (second_opinion undeclared)' };
+  if (fromProject.state === 'undeclared' && env.OPENROUTER_API_KEY) {
+    return { ...fromProject, source: 'PROJECT.md',
+      why: `${fromProject.why}; OPENROUTER_API_KEY is set but does not choose the provider — declare \`second_opinion: openrouter\` or pass --provider openrouter` };
   }
   return { ...fromProject, source: 'PROJECT.md' };
 }
@@ -128,6 +133,93 @@ export async function callOpenRouter({ apiKey, model, system, user, maxTokens =
 
 function readArg(argv, name) { const i = argv.indexOf(name); return i > -1 ? argv[i + 1] : null; }
 
+/** Read explicitly selected input without following symlinks or special files. */
+function readProfileFile(file, root, cap) {
+  if (typeof file !== 'string' || !file || file === '-' || Buffer.byteLength(file) > 4096
+      || file.split(/[\\/]/).includes('..') || /[\x00-\x1f\x7f]/.test(file)) throw new Error('invalid-input-file');
+  const target = resolve(root, file), parsed = parse(target);
+  const parts = target.slice(parsed.root.length).split(sep);
+  let current = parsed.root;
+  for (let i = 0; i < parts.length; i++) {
+    if (parts[i] === '.git' || /^\.env(?:\.|$)/i.test(parts[i])) throw new Error('invalid-input-file');
+    current = join(current, parts[i]);
+    const st = lstatSync(current);
+    if (st.isSymbolicLink() || (i < parts.length - 1 ? !st.isDirectory() : !st.isFile())) throw new Error('invalid-input-file');
+  }
+  const fd = openSync(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  try {
+    const st = fstatSync(fd);
+    if (!st.isFile() || st.size > cap) throw new Error('invalid-input-file');
+    const bytes = Buffer.alloc(cap + 1);
+    let size = 0, n;
+    while (size <= cap && (n = readSync(fd, bytes, size, cap + 1 - size, null)) > 0) size += n;
+    if (size > cap) throw new Error('invalid-input-file');
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes.subarray(0, size));
+  } finally { closeSync(fd); }
+}
+
+/** Check explicit runtime roots before any credential getter is evaluated. */
+export function validateKimiRuntimePaths(root, operatorRoot) {
+  for (const [directory, allowMissing] of [[root, false], [operatorRoot, true]]) {
+    if (typeof directory !== 'string' || !directory || Buffer.byteLength(directory) > 4096
+        || /[\x00-\x1f\x7f]/.test(directory)) throw new Error('invalid-runtime-path');
+    const target = resolve(directory), parsed = parse(target);
+    let current = parsed.root, missing = false;
+    for (const part of target.slice(parsed.root.length).split(sep).filter(Boolean)) {
+      if (Buffer.byteLength(part) > 255 || part === '.git' || /^\.env(?:\.|$)/i.test(part)) throw new Error('invalid-runtime-path');
+      current = join(current, part);
+      if (missing) continue;
+      try {
+        const st = lstatSync(current);
+        if (st.isSymbolicLink() || !st.isDirectory()) throw new Error('invalid-runtime-path');
+      } catch (error) {
+        if (allowMissing && error.code === 'ENOENT') missing = true;
+        else throw error;
+      }
+    }
+  }
+}
+
+/** Explicit extra opinion. Runtime capabilities are resolved only after admission. */
+export async function runProfileReview(options = {}) {
+  const argv = options.argv ?? [];
+  if (!argv.includes('--profile')) return null;
+  const denied = () => ({ exitCode: EXIT.USAGE, summary: { status: 'usage-error', verdict: null,
+    advisory: true, authority: 'NONE', releaseEligibility: 'NOT_CHECKED', reasonCode: 'invalid-profile-invocation' } });
+  const allowed = new Set(['--profile', '--envelope', '--task', '--context-class', '--reason', '--root', '--operator-root', '--diff', '--spec']);
+  const flags = new Map();
+  for (let i = 0; i < argv.length; i += 2) {
+    const flag = argv[i], value = argv[i + 1];
+    if (!allowed.has(flag) || flags.has(flag) || typeof value !== 'string' || !value || value.startsWith('--')) return denied();
+    flags.set(flag, value);
+  }
+  if (flags.get('--profile') !== 'kimi-readonly-v1'
+      || ['--envelope', '--task', '--context-class', '--reason', '--operator-root'].some(k => !flags.has(k))) return denied();
+  let root, operatorRoot, envelope, profileApi;
+  try {
+    root = resolve(flags.get('--root') || process.cwd());
+    operatorRoot = resolve(root, flags.get('--operator-root'));
+    validateKimiRuntimePaths(root, operatorRoot);
+    envelope = JSON.parse(readProfileFile(flags.get('--envelope'), root, 131072));
+    if (!envelope || envelope.mode !== 'diff-review' || envelope.taskId !== flags.get('--task')
+        || envelope.contextClass !== flags.get('--context-class') || envelope.reason !== flags.get('--reason')) return denied();
+    for (const [flag, field, cap] of [['--diff', 'diff', 96000], ['--spec', 'spec', 16000]]) {
+      if (flags.has(flag) && readProfileFile(flags.get(flag), root, cap) !== envelope[field]) return denied();
+    }
+    profileApi = await import('./kimi-review-profile.mjs');
+    profileApi.buildKimiInputBinding(envelope);
+  } catch { return denied(); }
+  const result = await profileApi.runKimiReview({ profile: flags.get('--profile'), envelope, root,
+    operatorRoot,
+    get apiKey() { return options.apiKey ?? (options.env ?? process.env).OPENROUTER_API_KEY; },
+    fetchImpl: options.fetchImpl, now: options.now, uuid: options.uuid, signal: options.signal, timeoutMs: options.timeoutMs });
+  const complete = result.status === 'complete' && ['PASS', 'BLOCK'].includes(result.verdict);
+  return { exitCode: complete ? result.verdict === 'BLOCK' ? EXIT.BLOCK : EXIT.PASS : EXIT.SKIPPED,
+    summary: { status: result.status, reasonCode: result.reasonCode, verdict: complete ? result.verdict : null,
+      advisory: true, authority: 'NONE', releaseEligibility: 'NOT_CHECKED', bindingDigest: result.bindingDigest,
+      findings: result.result?.findings?.length ?? null, costState: result.costState, costUsd: result.costUsd } };
+}
+
 /**
  * The tree's identity at review time — git HEAD and whether it was dirty.
  * CLI-only: the pure `reviewLogLine` above never shells out; per this file's
@@ -147,6 +239,11 @@ function gitIdentity(cwd) {
 }
 
 async function main(argv) {
+  if (argv.includes('--profile')) {
+    const r = await runProfileReview({ argv, fetchImpl: fetch });
+    console.log(JSON.stringify(r.summary));
+    process.exit(r.exitCode);
+  }
   const diffPath = readArg(argv, '--diff');
   if (!diffPath) { console.error('Usage: cross-model-review.mjs --diff <file|-> [--spec <file>] [--model <slug>] [--provider codex|openrouter]'); process.exit(EXIT.USAGE); }
 
@@ -216,7 +313,8 @@ async function main(argv) {
   // was present and costForUsage prices an unknown model at nothing. A reviewer
   // that reads as free is the defect this repository has removed twice already.
   const priced = resolvePrice(res.model).price != null;
-  const cost = res.usage && priced ? round4(costForUsage({ model: res.model, usage: res.usage })) : null;
+  const calculated = res.usage && priced ? costForUsage({ model: res.model, usage: res.usage }) : null;
+  const cost = calculated === null ? null : round4(calculated);
 
   for (const f of findings) console.log(`  ${f.severity} ${f.file}:${f.line} — ${f.issue}`);
   if (verdict == null) {

package/board/scripts/lib/gate-tier.mjs

@@ -18,7 +18,7 @@
 // Thirty evals clear the interval. Only some of those may drop a gate, and the
 // three cuts are mechanical rather than judgement:
 //
-//   - `sharedExpanded` non-empty: the harness inlined `_shared` contracts into
+//   - `sharedExpanded` non-empty: the harness inlined shared contracts into
 //     the actor's prompt, so the agent was handed something it may never fetch
 //     on a live run. On 2026-08-07 architect did not fetch the one whose command
 //     sat verbatim in its own file. An eval that inlines the handoff measures an

package/board/scripts/lib/host-graph-bindings.mjs

@@ -104,12 +104,24 @@ export function nativeGraphObservations(root, { store = nativeGraphStore(), jour
   return rows;
 }
 
-/** Bounded page of exactly one explicitly enrolled session. */
+/**
+ * Bounded page of exactly one session of this project and host.
+ *
+ * An enrolled session is a live read (`enrolled: true, retained: false`). After unbind or
+ * disable the enrollment is gone but the private journal stays (`retainedHistory`), and it
+ * remains readable as `enrolled: false, retained: true`. That read is derived from the
+ * exact project, host and session, creates no enrollment and cannot resume recording; a
+ * session with neither an enrollment nor a journal is refused as before.
+ */
 export function readNativeGraphPage({ root, host, sessionId, cursor = null, limit = 200 }, { store = nativeGraphStore(), journalStore } = {}) {
   if (!hostSet.has(host) || !identity(sessionId)) throw Error('invalid native graph binding');
   const b = load(root, host, sessionId, store);
-  if (!b) throw Error('native session is not enrolled in this project');
-  return projectHostObservations(b, { store: journalStore, cursor, limit });
+  if (b) return { ...projectHostObservations(b, { store: journalStore, cursor, limit }), enrolled: true, retained: false };
+  // Same journal identity that bindNativeGraph gives this session: enrollment adds no secret.
+  const retained = { ...graphBinding({ root: realpathSync(root), runId: sessionId, sessionId }), host };
+  const graph = projectHostObservations(retained, { store: journalStore, cursor, limit });
+  if (graph.health === 'absent') throw Error('native session is not enrolled in this project');
+  return { ...graph, enrolled: false, retained: true };
 }
 
 /** Project opt-in before SessionStart permits observation from the real start event. */

package/board/scripts/lib/host-graph-events.mjs

@@ -1,5 +1,6 @@
 /** Host observations are metadata, never controller approval or execution authority. */
 import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 
 const hash = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const safeId = value => typeof value === 'string' && /^[a-zA-Z0-9_.:-]{1,160}$/.test(value) ? value : null;
@@ -9,11 +10,29 @@ const hosts = new Set(['codex', 'claude-code']);
 const modes = new Set(['controlled', 'native']);
 const timestamp = value => typeof value === 'string' && value.length <= 40 && Number.isFinite(Date.parse(value)) ? new Date(value).toISOString() : null;
 
+// Live acceptance, by exact host version (shared/host-graph-acceptance.json). Support is never
+// inferred from semver syntax: only a version that passed a live run is `supported`, a dimension
+// that was exercised and not delivered is `unsupported`, everything else stays `unknown`.
+let acceptanceCache;
+export function loadHostGraphAcceptance() {
+  if (acceptanceCache !== undefined) return acceptanceCache;
+  try {
+    const doc = JSON.parse(readFileSync(new URL('../../shared/host-graph-acceptance.json', import.meta.url), 'utf8'));
+    acceptanceCache = doc?.schema === 1 && Array.isArray(doc.accepted) ? doc.accepted : null;
+  } catch { acceptanceCache = null; }   // unreadable: support stays unknown, and the audit says so
+  return acceptanceCache;
+}
+export function acceptedEntry({ host, mode, sourceVersion, acceptance = loadHostGraphAcceptance() } = {}) {
+  if (!Array.isArray(acceptance) || !version(sourceVersion)) return null;
+  return acceptance.find(e => e && e.host === host && e.mode === mode && e.version === sourceVersion) || null;
+}
+
 /** Supported event families do not attest that a particular run was fully observed. */
-export function hostGraphCapabilities({ host, mode, sourceVersion } = {}) {
-  const known = false; // Version compatibility is established by the collector's capability audit, never semver syntax alone.
-  return { lifecycle: known ? 'supported' : 'unknown', tools: known ? 'supported' : 'unknown',
-    parentChild: known ? 'supported' : 'unknown', verification: 'unsupported', gates: 'unsupported', artifacts: 'unsupported' };
+export function hostGraphCapabilities({ host, mode, sourceVersion, acceptance } = {}) {
+  const entry = acceptedEntry({ host, mode, sourceVersion, ...(acceptance !== undefined ? { acceptance } : {}) });
+  const dim = key => entry?.dimensions?.[key] === true ? 'supported' : entry?.dimensions?.[key] === false ? 'unsupported' : 'unknown';
+  return { lifecycle: dim('lifecycle'), tools: dim('tools'), parentChild: dim('parentChild'),
+    verification: 'unsupported', gates: 'unsupported', artifacts: 'unsupported' };
 }
 
 function toolClass(name) {

package/board/scripts/lib/host-graph-runtime.mjs

@@ -1,5 +1,6 @@
 /** Provider-free CLI surface audit. Help text is not execution or hook-delivery proof. */
 import { spawnSync } from 'node:child_process';
+import { loadHostGraphAcceptance } from './host-graph-events.mjs';
 
 const hosts = new Set(['codex', 'claude-code']);
 const commandOptions = Object.freeze({ encoding: 'utf8', timeout: 10000, maxBuffer: 1024 * 1024, windowsHide: true });
@@ -13,7 +14,7 @@ function command(run, bin, args) {
   catch { return { status: null, error: { code: 'AUDIT_COMMAND_FAILED' } }; }
 }
 
-export function auditHostGraphRuntime({ host, bin = host === 'claude-code' ? 'claude' : 'codex', run = spawnSync } = {}) {
+export function auditHostGraphRuntime({ host, bin = host === 'claude-code' ? 'claude' : 'codex', run = spawnSync, acceptance = loadHostGraphAcceptance() } = {}) {
   if (!hosts.has(host)) throw Error('unsupported graph host');
   const result = { host, sourceVersion: null, state: 'unreadable', controlled: { streamEvents: null },
     native: { hookEvents: null }, liveAcceptance: 'not-checked' };
@@ -23,6 +24,12 @@ export function auditHostGraphRuntime({ host, bin = host === 'claude-code' ? 'cl
     return result;
   }
   result.sourceVersion = sourceVersion(version);
+  // Which modes of this exact version passed live acceptance; an unreadable record is not "none".
+  if (acceptance === null) result.liveAcceptance = 'unreadable';
+  else {
+    const modes = acceptance.filter(e => e?.host === host && e.version === result.sourceVersion).map(e => e.mode);
+    if (modes.length) result.liveAcceptance = { state: 'accepted', modes: [...new Set(modes)].sort() };
+  }
   const help = command(run, bin, host === 'codex' ? ['exec', '--help'] : ['--help']);
   if (help?.error || help?.status !== 0) return result;
   const text = String(help.stdout || '');
@@ -33,6 +40,6 @@ export function auditHostGraphRuntime({ host, bin = host === 'claude-code' ? 'cl
   return result;
 }
 
-export function auditHostGraphRuntimes({ run = spawnSync, binaries = {} } = {}) {
-  return ['codex', 'claude-code'].map(host => auditHostGraphRuntime({ host, run, bin: binaries[host] || (host === 'codex' ? 'codex' : 'claude') }));
+export function auditHostGraphRuntimes({ run = spawnSync, binaries = {}, acceptance = loadHostGraphAcceptance() } = {}) {
+  return ['codex', 'claude-code'].map(host => auditHostGraphRuntime({ host, run, acceptance, bin: binaries[host] || (host === 'codex' ? 'codex' : 'claude') }));
 }