@floomhq/floom 1.0.43 → 1.0.45

package/dist/cli.js

@@ -105,7 +105,7 @@ function commandUsage() {
    ${c.dim("Advanced")}
      ${c.cyan("library")}            Create, browse, and subscribe to libraries
                        ${c.dim("Alias: lib")}
-     ${c.cyan("move")} ${c.dim("<slug> --folder <path>")}  Place a saved skill in a local folder
+     ${c.cyan("move")} ${c.dim("<slug> --folder <path>")}  Place a saved skill in a relative folder
      ${c.cyan("mcp")}                Print optional MCP setup guidance
      ${c.cyan("sync")}               Preview pull of published, saved, and library skills
                        ${c.dim(`Flags: --target ${TARGET_HINT} (default: claude)`)}
@@ -163,13 +163,13 @@ function moveUsage() {
     process.stdout.write(`
  ${c.bold("Usage:")} ${c.cyan(`${CLI_COMMAND} move`)} ${c.dim("<slug> --folder <path> [--tag <tag>]")}
 
- ${c.bold("Place a saved or subscribed skill in a local folder.")}
+ ${c.bold("Place a saved or subscribed skill in a portable library folder.")}
    ${c.cyan(`${CLI_COMMAND} move support-tone --folder support/tone`)}
    ${c.cyan(`${CLI_COMMAND} move support-tone --root`)}
    ${c.cyan(`${CLI_COMMAND} move support-tone --folder support --tags support,tone`)}
 
  ${c.bold("Flags")}
-   ${c.cyan("--folder <path>")}     Folder path for synced installs
+   ${c.cyan("--folder <path>")}     Relative folder path for synced installs
    ${c.cyan("--root")}              Put the skill at the root
    ${c.cyan("--tag <tag>")}         Add one tag, repeatable
    ${c.cyan("--tags a,b")}          Add comma-separated tags
@@ -589,7 +589,20 @@ function parseDoctorFlags(argv) {
     return out;
 }
 function normalizeFolder(value) {
-    return value === "root" || value === "/" || value === "." ? null : value;
+    const normalized = value.trim().replace(/\\/g, "/").replace(/\/+/g, "/");
+    if (normalized === "root" || normalized === "/" || normalized === ".")
+        return null;
+    if (normalized.startsWith("/")) {
+        throw new FloomError("Invalid --folder: use a relative sync folder.", "Floom folders are portable library paths like `support/tone`, not absolute filesystem paths like `/tmp/floom-move-target`.");
+    }
+    if (normalized === ".." ||
+        normalized.startsWith("../") ||
+        normalized.includes("/../") ||
+        normalized.endsWith("/..")) {
+        throw new FloomError("Invalid --folder: path traversal is not allowed.", "Use a relative sync folder like `support/tone`, or use `--root`.");
+    }
+    const relative = normalized.startsWith("./") ? normalized.slice(2) : normalized;
+    return relative || null;
 }
 function parseFolderTagFlags(argv) {
     const out = { tags: [], rest: [] };

package/dist/login.js

@@ -107,6 +107,31 @@ function waitForCallback(port) {
                 res.end();
                 return;
             }
+            if (req.method === "GET" && req.url?.startsWith("/cli-callback?")) {
+                try {
+                    const data = parseCallbackQuery(req.url);
+                    if (!data.access_token || !data.refresh_token) {
+                        res.writeHead(400, {
+                            "content-type": "text/html; charset=utf-8",
+                        });
+                        res.end(localCallbackPage("Missing tokens from OAuth response."));
+                        return;
+                    }
+                    res.writeHead(200, {
+                        "content-type": "text/html; charset=utf-8",
+                        "referrer-policy": "no-referrer",
+                    });
+                    res.end(localCallbackPage("Signed in. You can close this tab."));
+                    settled = true;
+                    cleanup();
+                    resolve(data);
+                }
+                catch {
+                    res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+                    res.end(localCallbackPage("Invalid OAuth response."));
+                }
+                return;
+            }
             if (req.method === "POST" && req.url === "/cli-callback") {
                 let body = "";
                 req.on("data", (chunk) => { body += chunk.toString("utf8"); });
@@ -170,6 +195,16 @@ function waitForCallback(port) {
         });
     });
 }
+function parseCallbackQuery(url) {
+    const parsed = new URL(url, "http://127.0.0.1");
+    const result = {};
+    for (const key of ["access_token", "refresh_token", "expires_in", "token_type"]) {
+        const value = parsed.searchParams.get(key);
+        if (value)
+            result[key] = value;
+    }
+    return result;
+}
 function parseCallbackBody(body, contentType) {
     const type = Array.isArray(contentType) ? contentType.join(";") : contentType ?? "";
     if (type.includes("application/x-www-form-urlencoded")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom",
-  "version": "1.0.43",
+  "version": "1.0.45",
   "description": "Sync AI skills across agents and machines.",
   "license": "MIT",
   "type": "module",