great-cto 3.72.0 → 3.74.0

package/dist/main.js

@@ -66,6 +66,8 @@ function parseArgs(argv) {
         version: null,
         useLlm: false,
         noLlm: false,
+        noTelemetry: false,
+        rootArgv: argv,
         host: null,
         upgradeSelf: false,
         purgeData: false,
@@ -73,8 +75,18 @@ function parseArgs(argv) {
         positional: [],
     };
     const rest = [];
+    const telemetryFlagIndices = new Set();
+    const webhookValueOptions = new Set(["--secret", "--url", "--format", "--triggers", "--events", "--routing-key"]);
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
+        // Webhook values may themselves look like options. Consume each owned
+        // value once so it cannot claim a later standalone root refusal as data.
+        if (args.command === "webhook" && webhookValueOptions.has(a)) {
+            rest.push(a);
+            if (i + 1 < argv.length)
+                rest.push(argv[++i]);
+            continue;
+        }
         if (a === "-h" || a === "--help")
             args.command = "help";
         else if (a === "-v" || a === "--version")
@@ -99,6 +111,10 @@ function parseArgs(argv) {
             args.useLlm = true;
         else if (a === "--no-llm")
             args.noLlm = true;
+        else if (a === "--no-telemetry") {
+            args.noTelemetry = true;
+            telemetryFlagIndices.add(i);
+        }
         else if (a === "--host") {
             const v = argv[++i] ?? "";
             args.hostInput = v;
@@ -121,8 +137,6 @@ function parseArgs(argv) {
             args.command = "console";
         else if (a === "telemetry")
             args.command = "telemetry";
-        else if (a === "--no-telemetry")
-            continue;
         else if (a === "distribution") {
             args.command = "distribution";
             args.taskArgs = argv.slice(i + 1);
@@ -200,7 +214,7 @@ function parseArgs(argv) {
                 args._fromInstall = true;
             }
         }
-        else if (!a.startsWith("-") && args.command === "init" && i === 0) {
+        else if (!a.startsWith("-") && args.command === "init" && i - telemetryFlagIndices.size === 0) {
             // First positional that isn't a recognised subcommand → unknown
             args.command = "unknown";
             args.unknownToken = a;
@@ -215,6 +229,9 @@ function parseArgs(argv) {
     }
     args.dir = resolve(args.dir);
     args.positional = rest;
+    // A consumed option value or an early-break tail belongs to its original
+    // parser. Filtering by value would erase literal data in either case.
+    args.rootArgv = argv.filter((_, i) => !telemetryFlagIndices.has(i));
     return args;
 }
 async function runRegister(args) {
@@ -870,6 +887,9 @@ ${bold("Options:")}
                          even when heuristic confidence is high
       --no-llm           Skip LLM suggestion (run heuristic only)
                          Or set ${cyan("GREATCTO_NO_LLM=1")}
+      --no-telemetry     Disable telemetry for this invocation, even if opted in
+                         Put before task/worker/codex-host/run/status/resume/statusline
+                         Does not disable update checks or command network access
   -h, --help             Show this help
   -v, --version          Show great-cto CLI version
 
@@ -1249,10 +1269,12 @@ async function runInit(args) {
     // ── 6. install pre-push git hook ─────────────────────────
     installPrePushHook(args.dir);
     // ── 7. opt-IN telemetry prompt (default OFF) ─────────────
-    await promoteTelemetryOptIn({ archetype: String(archetype), cliVersion: getCliVersion(), yes: args.yes });
+    if (!args.noTelemetry) {
+        await promoteTelemetryOptIn({ archetype: String(archetype), cliVersion: getCliVersion(), yes: args.yes });
+    }
     // If already enabled (prior opt-in or env var), count this (re)install toward MAU.
-    if (isTelemetryEnabled()) {
-        await sendInstallPing({ cliVersion: getCliVersion(), archetype: String(archetype), consent: true })
+    if (isTelemetryEnabled(args.noTelemetry)) {
+        await sendInstallPing({ cliVersion: getCliVersion(), archetype: String(archetype), consent: true, noTelemetry: args.noTelemetry })
             .catch(() => { });
     }
     // ── done ─────────────────────────────────────────────────
@@ -1445,9 +1467,49 @@ async function reportCodexUpgrade() {
     }
     return 0;
 }
+// A successful write() may still have queued pipe bytes. Complete an ordered
+// empty write before forced exit, without keeping a broken consumer alive.
+function drainOutput(stream) {
+    if (stream.destroyed || stream.closed || stream.writableFinished)
+        return Promise.resolve(true);
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (complete) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            stream.off("error", completed);
+            stream.off("close", completed);
+            stream.off("finish", completed);
+            resolve(complete);
+        };
+        const completed = () => finish(true);
+        const timer = setTimeout(() => finish(false), 1000);
+        timer.unref();
+        stream.once("error", completed);
+        stream.once("close", completed);
+        stream.once("finish", completed);
+        if (!stream.writableEnded) {
+            try {
+                stream.write("", (error) => {
+                    // Node emits the write error after its callback; leave the listener
+                    // in place for that event before cleaning up a callback-only failure.
+                    if (error)
+                        queueMicrotask(completed);
+                    else
+                        completed();
+                });
+            }
+            catch {
+                completed();
+            }
+        }
+    });
+}
 async function main() {
-    const rawArgv = process.argv.slice(2);
-    const args = parseArgs(rawArgv);
+    const args = parseArgs(process.argv.slice(2));
+    const rawArgv = args.rootArgv;
     // Anonymous, opt-IN usage telemetry (default OFF — see docs/PRIVACY.md). `finish`
     // is the single exit funnel: it fires one fire-and-forget event (command + node + os
     // + exit_code + duration, no PII) only when the user has opted in, then exits.
@@ -1458,13 +1520,13 @@ async function main() {
     // widen types at every call site.
     const finish = async (code) => {
         try {
-            if (!rawArgv.includes("--no-telemetry"))
-                await sendUsagePing({
-                    cliVersion: getCliVersion(),
-                    subcommand: args.command,
-                    exitCode: code,
-                    durationMs: Date.now() - __tStart,
-                });
+            await sendUsagePing({
+                cliVersion: getCliVersion(),
+                subcommand: args.command,
+                exitCode: code,
+                durationMs: Date.now() - __tStart,
+                noTelemetry: args.noTelemetry,
+            });
         }
         catch { /* telemetry never affects the exit */ }
         // Update hint / prompt — printed after the command's own output, never
@@ -1479,7 +1541,11 @@ async function main() {
             await checkForUpdate({ currentVersion: getCliVersion(), command: args.command });
         }
         catch { /* update hint never affects the exit */ }
-        process.exit(code);
+        // An unref deadline cannot keep an otherwise empty event loop alive.
+        // Until completion is proven, even that early exit must fail closed.
+        process.exitCode = code || 1;
+        const completed = await Promise.all([drainOutput(process.stdout), drainOutput(process.stderr)]);
+        process.exit(completed.every(Boolean) ? code : code || 1);
     };
     // `great-cto telemetry <on|off|status|whoami>` — inspect / toggle, never sends.
     if (args.command === "distribution") {

package/dist/release-activation.mjs

@@ -183,8 +183,10 @@ function safeEnvironment(tx, npmPath) {
     fs.mkdirSync(temp, { mode: 0o700 });
     const config = path.join(tx, 'empty.npmrc');
     fs.writeFileSync(config, '', { flag: 'wx', mode: 0o600 });
+    const globalConfig = path.join(tx, 'empty-global.npmrc');
+    fs.writeFileSync(globalConfig, '', { flag: 'wx', mode: 0o600 });
     return { PATH: [path.dirname(process.execPath), path.dirname(npmPath), '/usr/bin', '/bin', '/usr/sbin', '/sbin'].join(path.delimiter),
-        HOME: home, USERPROFILE: home, TMPDIR: temp, NPM_CONFIG_USERCONFIG: config, NPM_CONFIG_GLOBALCONFIG: config,
+        HOME: home, USERPROFILE: home, TMPDIR: temp, NPM_CONFIG_USERCONFIG: config, NPM_CONFIG_GLOBALCONFIG: globalConfig,
         NPM_CONFIG_CACHE: path.join(tx, 'npm-cache'), NPM_CONFIG_IGNORE_SCRIPTS: 'true', NPM_CONFIG_OFFLINE: 'true',
         NPM_CONFIG_AUDIT: 'false', NPM_CONFIG_FUND: 'false', NPM_CONFIG_PACKAGE_LOCK: 'false',
         DO_NOT_TRACK: '1', GREAT_CTO_TELEMETRY: 'off', GREAT_CTO_NO_BOARD: '1', GREAT_CTO_NO_UPDATE_CHECK: '1', CI: '1' };

package/dist/telemetry.js

@@ -150,7 +150,7 @@ async function send(evt) {
 export async function sendInstallPing(opts) {
     if (!opts.consent)
         return;
-    if (!isTelemetryEnabled())
+    if (!isTelemetryEnabled(opts.noTelemetry))
         return;
     const evt = sanitize({ cliVersion: opts.cliVersion, command: "install", archetype: opts.archetype });
     if (!evt)
@@ -159,7 +159,7 @@ export async function sendInstallPing(opts) {
 }
 /** Per-command usage ping. Sent only when enabled. Fire-and-forget. */
 export async function sendUsagePing(opts) {
-    if (!isTelemetryEnabled())
+    if (!isTelemetryEnabled(opts.noTelemetry))
         return;
     const evt = sanitize({
         cliVersion: opts.cliVersion,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.72.0",
+  "version": "3.74.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",