great-cto 3.75.2 → 3.75.3

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.75.2",
+  "version": "3.75.3",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/scripts/lib/receipt.mjs

@@ -99,7 +99,7 @@ const excludeLogs = ACTIVITY_LOGS.map((p) => `:(exclude)${p}`);
  * Returns `null` outside a git repository rather than a fabricated receipt: a
  * receipt that cannot be built must not look like one that matched.
  */
-export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_FILES, verdictsDir = null, exclude = [], hashFilesInProcess = false } = {}) {
+export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_FILES, verdictsDir = null, exclude = [], hashFilesInProcess = false, persist = false } = {}) {
   const head = git(['rev-parse', 'HEAD'], cwd)?.trim();
   if (!head) return null;
   // Off-loop board readers avoid one process per untracked file. Preserve Git's
@@ -107,7 +107,7 @@ export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_F
   const algorithm = hashFilesInProcess ? git(['rev-parse', '--show-object-format'], cwd)?.trim() : null;
   if (hashFilesInProcess && !['sha1', 'sha256'].includes(algorithm)) return null;
   const digest = p => {
-    if (!hashFilesInProcess) return fileDigest(cwd, p);
+    if (!hashFilesInProcess) return fileDigest(cwd, p, { write: persist });
     try {
       const fd = fsModule.openSync(join(cwd, p), 'r');
       try {
@@ -223,8 +223,8 @@ export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_F
  * what an agent read. `hash-object` on the working file is the thing the
  * reviewer actually saw.
  */
-export function fileDigest(cwd, path) {
-  const out = git(['hash-object', '--no-filters', '--', path], cwd);
+export function fileDigest(cwd, path, { write = false } = {}) {
+  const out = git(['hash-object', ...(write ? ['-w'] : []), '--no-filters', '--', path], cwd);
   return out ? out.trim() : null;
 }
 
@@ -500,7 +500,13 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1
     // `--verdicts <dir>`: measure the change from where the previous stage stood.
     const vi = argv.indexOf('--verdicts');
     const verdictsDir = vi >= 0 && argv[vi + 1] ? argv[vi + 1] : null;
-    const r = treeReceipt(process.cwd(), { verdictsDir });
+    // `persist`: the bytes go into git's object store, not only their digest. The
+    // judge reads the change from those objects later; a digest alone is a
+    // promise about content nobody kept, and an uncommitted change — senior-dev's
+    // normal case — would otherwise be judged from whatever the disk holds by then.
+    // Only here, where a verdict is recorded: the board's frequent readers must
+    // not leave objects behind.
+    const r = treeReceipt(process.cwd(), { verdictsDir, persist: true });
     process.stdout.write(r ? JSON.stringify(r) : '');
     process.exit(r ? 0 : 1);
   }

package/board/scripts/lib/second-opinion.mjs

@@ -256,6 +256,24 @@ if (import.meta.url === `file://${process.argv[1]}`) {
 
 import { capabilitiesFromProjectMd } from './stack-capabilities.mjs';
 import { runCodexExec, detectCodex } from './codex-exec.mjs';
+import { parseEnv, KEY_NAME } from './router-key.mjs';
+import { readFileSync as readKeyFile } from 'node:fs';
+import { join as joinPath } from 'node:path';
+
+/**
+ * Is an OpenRouter key reachable — in the environment, or in the secrets file the
+ * router itself reads? Checking the environment alone called `openrouter`
+ * unavailable on every machine that keeps the key where great_cto tells people to
+ * keep it (~/.great_cto/secrets.env): the router would have answered, and the
+ * second judge was never asked. The home comes from `env`, so a caller that
+ * injects `env` (every test) never reads the real machine.
+ */
+function openrouterKeyPresent(env) {
+  if (env.OPENROUTER_API_KEY) return true;
+  if (!env.HOME) return false;
+  try { return Boolean(parseEnv(readKeyFile(joinPath(env.HOME, '.great_cto', 'secrets.env'), 'utf8')).get(KEY_NAME)); }
+  catch { return false; }
+}
 
 export const SECOND_OPINION_PROVIDERS = Object.freeze(['codex', 'openrouter', 'none']);
 
@@ -291,7 +309,7 @@ export function resolveSecondOpinion({ projectMd = '', codex = null, env = proce
     return { state: 'declared', provider, why: '', codex: c };
   }
   if (provider === 'openrouter') {
-    if (!env.OPENROUTER_API_KEY) return { state: 'unavailable', provider, why: 'second_opinion: openrouter needs OPENROUTER_API_KEY' };
+    if (!openrouterKeyPresent(env)) return { state: 'unavailable', provider, why: 'second_opinion: openrouter needs OPENROUTER_API_KEY (environment or ~/.great_cto/secrets.env)' };
     return { state: 'declared', provider, why: '' };
   }
   return { state: 'none', provider: 'none', why: '' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.75.2",
+  "version": "3.75.3",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",