This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+2 more
Affected surfaces
Summary
AI summaryStructured logging added across server and scripts with zero‑dependency logger.
Full changelog
Quality deepened, prompts on a diet, structured logs
- QUALITY-DEEPEN follow-ups #3–#6 (
ARCH-quality-deepen-followups.md):
archetype domain contracts extended 6 → 14 archetypes; contract regexes
hardened against false positives (the/hold/-matches-"household" class);
quality.mjs --gate --baseline(product-eval parity) and--trend
(sparkline overmetrics-history.jsonl); opt-in--browserharness with
axe-core a11y + Web Vitals (LCP/CLS/INP) — dynamic playwright import,
gracefulnaeverywhere, runtime stays zero-dep. - Agent prompt diet —
architect.md1181 → 827 lines,project-auditor.md
1019 → 701 (−30% each): 16 embedded bash blocks extracted toscripts/*.sh,
pricing/framework tables toskills/great_cto/references/, duplicate step
numbering fixed, vestigialbd_create_if_newcode removed. Cheaper every
single agent invocation. - Structured logging — zero-dep leveled logger (
GREAT_CTO_LOG_LEVEL,
ISO timestamps, error→stderr) across the board server; script diagnostics
routed through it; hook protocol and CLI user output untouched by design. - Board hardening — static path-traversal containment, origin-check dedupe,
HOME-boundary for raw?project=paths. - Telemetry endpoint — default now the documented
telemetry.greatcto.systems
(verified live); personal placeholder hostname removed. - Fixed the archetype-drift test failures (
clivscli-tool) — main is fully
green: lib suite 355, full suite 176, hooks 117.
Security Fixes
- Board hardening: added static path‑traversal containment, origin‑check deduplication, and HOME‑boundary enforcement for `?project=` paths
- Telemetry endpoint default changed to verified live `telemetry.greatcto.systems`; removed personal placeholder hostname
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About great_cto
Engineering-management layer of 34 specialist AI agents covering the full SDLC (architect, PM, senior-dev, reviewer, QA, security, devops, L3-support + 18 archetype-specific reviewers) with auto-detected archetypes and compliance gates (PCI-DSS, HIPAA, FedRAMP, GDPR, EU AI Act). Runs in Claude Code, Cursor, Codex CLI, Aider, and Continue via AGENTS.md + MCP. MIT.
Related context
Related tools
Earlier breaking changes
- v2.72.2 Removes Autopilot sidebar item and Operate topbar button from dev board.
- v2.55.0 Hard-gates the Build board; redirects invite sessions to Operate for operators.
- v2.43.0 Runtime now blocks autonomous execution of irreversible actions without prior human checkpoint.
- v2.43.0 Adds reversible and blastRadius fields to every flow step.
- v2.32.0 Removed AgentShield scanner and its CLI commands.
Beta — feedback welcome: [email protected]