@gouthamjm1997/dayflow 0.2.0 → 0.2.1

package/README.md

@@ -58,7 +58,7 @@ Use `goals update`, `kr-update`, `archive`, `restore`, or `kr-delete` to maintai
 
 ## Dayflow CLI for Hermes
 
-The local CLI can read and update the signed-in Supabase user's Dayflow record. Run `npm run dayflow -- auth login` once; finish Google sign-in in the browser. The refresh token is kept in this machine's credential store (Windows Credential Manager on Windows), not in the repository. CLI requests use the publishable key plus the user's refreshed session and remain subject to the table's RLS policies; no service-role key is used.
+The local CLI can read and update the signed-in Supabase user's Dayflow record. Run `npm run dayflow -- auth login` once; finish Google sign-in in the browser. The refresh token is kept in this machine's credential store (Windows Credential Manager on Windows), not in the repository. On a machine without a usable credential store (a container, server, or CI runner), the token is saved to the Dayflow config file automatically so the login still survives across runs; keep that file private. CLI requests use the publishable key plus the user's refreshed session and remain subject to the table's RLS policies; no service-role key is used.
 
 Examples: `npm run dayflow -- tasks list`, `npm run dayflow -- tasks list --list Work`, `npm run dayflow -- tasks add "Prepare project update" --list "Deep work"`, `npm run dayflow -- tasks complete <task-id>`, `npm run dayflow -- lists add "Errands"`, `npm run dayflow -- lists rename <list-id> --name "Home"`, `npm run dayflow -- workouts log --kind Walk --minutes 30 --date 2026-10-02`, and `npm run dayflow -- focus log --minutes 25 --tag "Deep Work"`. Focus logs accept `--tag`, `--seconds`, and `--timer-type countdown|stopwatch`. Task commands accept `--list` with either a list id or its exact name. Sign out with `npm run dayflow -- auth logout`. Sign-in needs `http://localhost:3000` to be free and allowlisted in Supabase.
 

package/docs/okr-plan.md

@@ -0,0 +1,48 @@
+# Dayflow Goals: implementation plan
+
+## Framework
+
+An objective describes what to achieve. Key results define measurable, verifiable outcomes within a time period; a typical cycle is a quarter, and 3–5 key results support one objective.[1] Dayflow also supports monthly cycles as a shorter personal planning option.
+
+## Product choices
+
+- Add a Goals destination beside Plan and Focus. Keep the existing task lists; lists organize work, while goal links explain why the work matters.
+- Use one hierarchy: monthly/quarterly objective → measurable key result → daily task. Start with a few objectives rather than making every task its own goal.
+- An objective has a title, optional context, cycle type and period. It can be edited, archived and restored without deleting task history.
+- A key result has an outcome description, unit, baseline, target and current measurement. Support both increasing and decreasing targets, including zero and decimals.
+- Check-ins record an absolute measurement, timestamp and optional evidence/note. Suggest reviewing weekly. A task being completed is not evidence that the measured outcome improved.
+- Show each key result's progress from baseline toward target, capped between 0% and 100%. Objective progress is an equal-weight average of its key results; this is a Dayflow display convention, not a universal OKR grading rule.
+- Show linked tasks below each key result and let the user add another task with that result preselected.
+
+## Task alignment
+
+- Add an alignment selector to task creation and existing task rows: a key result, Chore / routine, or Needs alignment.
+- Treat chores as an explicit user choice, never a guess based on task title, tag or list name.
+- Keep task capture flexible. An unlinked non-chore task is visibly pending alignment, not silently treated as strategic work.
+- Goals includes an alignment queue of all open non-chore tasks without a valid active key result. It spans every task list, including tasks linked to archived objectives.
+- Existing tasks remain unchanged until classified. No personal goals, metrics or task links are seeded or inferred.
+- Marking a task as a chore clears its goal link; linking a task to a key result removes its chore exemption.
+- Archiving an objective preserves links and measurements. Removing a key result preserves tasks but returns them to Needs alignment.
+
+## Persistence and compatibility
+
+Use the existing local-first per-user Supabase JSON record; no new public table or expanded permission is needed. UI and CLI share the OKR mutation module. Preserve unrelated data when either client writes. Legacy records without the optional objectives field remain readable with unchanged legacy serialization; the field is initialized when the user begins using Goals.
+
+## Acceptance checks
+
+1. Create, edit, archive and restore monthly/quarterly objectives.
+2. Create and edit numeric key results; check in and review measurement history.
+3. Correct quarter/month date boundaries and progress for ascending/descending metrics.
+4. Link, relink and exempt tasks; show the correct alignment queue across lists.
+5. Task completion does not modify key-result measurements.
+6. Reload and signed-in JSON serialization preserve objectives, links and unrelated history.
+7. Desktop and mobile forms/navigation fit and remain usable.
+8. Existing tests stay intact; add new feature coverage and run the complete suite/build.
+
+## Suggested use, not preloaded data
+
+A quarterly objective might be “Communicate technical decisions clearly.” A key result could be “Raise feedback clarity score from 3 to 4.5 out of 5”; a task such as “Draft and rehearse the architecture walkthrough” contributes to it. “Buy groceries” can be marked Chore / routine. These are illustrations, not automatically created goals or asserted personal measurements.
+
+## Sources
+
+[1] https://www.whatmatters.com/faqs/okr-meaning-definition-example — What Matters: OKR definition and examples

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gouthamjm1997/dayflow",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": false,
   "description": "Dayflow CLI — plan tasks, log focus sessions, and record gym sets against your own Supabase Dayflow project.",
   "type": "module",
@@ -17,6 +17,7 @@
     "src/task-lists.mjs",
     "src/okr.mjs",
     "src/supabase-data.mjs",
+    "docs/okr-plan.md",
     ".env.example",
     "README.md"
   ],

package/scripts/dayflow.mjs

@@ -7,6 +7,7 @@ import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { createClient } from '@supabase/supabase-js'
 import {
+  createConfigFileStore,
   createRefreshTokenStore,
   exchangeDayflowCode,
   extractAuthCode,
@@ -22,35 +23,58 @@ const CONFIG_PATH = process.env.DAYFLOW_CONFIG || join(homedir(), '.dayflow', 'c
 const IGNORE_KEYRING = process.env.DAYFLOW_IGNORE_KEYRING === '1'
 const MANUAL_TIMEOUT_MS = 15 * 60 * 1000
 const tokenStore = createRefreshTokenStore()
+const configStore = createConfigFileStore(CONFIG_PATH)
 const repoRoot = dirname(dirname(fileURLToPath(import.meta.url)))
 
-let storeUnavailable = false
+let storeLocation = 'keyring'
 
-// Containers and cloud sandboxes often have no usable credential store. Failing to persist is not
-// fatal while a token can still be supplied per run, but the session then dies with the machine.
+// Containers and cloud sandboxes often have no usable credential store. When the keyring cannot
+// hold the token, fall back to the config file so the sign-in still survives across runs; only if
+// both fail does the session die with the machine.
 const sessionStore = {
   get() {
-    return IGNORE_KEYRING ? null : tokenStore.get()
+    if (!IGNORE_KEYRING) {
+      const stored = tokenStore.get()
+      if (stored) return stored
+    }
+    return configStore.get()
   },
   set(token) {
-    if (IGNORE_KEYRING) {
-      storeUnavailable = true
-      return
+    if (!IGNORE_KEYRING) {
+      try {
+        tokenStore.set(token)
+        storeLocation = 'keyring'
+        return
+      } catch {
+        // No usable credential store: persist to the config file instead.
+      }
     }
     try {
-      tokenStore.set(token)
+      configStore.set(token)
+      storeLocation = 'config'
     } catch {
-      storeUnavailable = true
+      storeLocation = 'memory'
     }
   },
   clear() {
-    return tokenStore.clear()
+    const cleared = tokenStore.clear()
+    configStore.clear()
+    return cleared
   },
 }
 
+function storeDescription() {
+  if (storeLocation === 'config') return 'the Dayflow config file (this machine has no credential store)'
+  if (storeLocation === 'memory') return 'memory for this run only'
+  return "this machine's credential store"
+}
+
 function warnIfStoreUnavailable() {
-  if (!storeUnavailable) return
-  process.stderr.write('Note: this machine has no usable credential store, so the login only lasts for this run. Set DAYFLOW_REFRESH_TOKEN (or add "refreshToken" to the config file) to sign in without a browser.\n')
+  if (storeLocation === 'config') {
+    process.stderr.write('Note: no usable credential store on this machine, so the refresh token was saved to the Dayflow config file in plain text. Keep that file private.\n')
+  } else if (storeLocation === 'memory') {
+    process.stderr.write('Note: this machine has no usable credential store and the config file could not be written, so the login only lasts for this run. Set DAYFLOW_REFRESH_TOKEN to sign in without a browser.\n')
+  }
 }
 
 function readConfigFile() {
@@ -171,7 +195,7 @@ async function manualLogin(config) {
   const code = await readManualCode()
   await exchangeDayflowCode(attempt.authClient, code, sessionStore)
   warnIfStoreUnavailable()
-  process.stdout.write(`Dayflow CLI is signed in. The refresh token is kept in ${IGNORE_KEYRING || storeUnavailable ? 'memory for this run only' : "this machine's credential store"}.\n`)
+  process.stdout.write(`Dayflow CLI is signed in. The refresh token is kept in ${storeDescription()}.\n`)
 }
 
 // Reads one line from stdin. Deliberately not readline: readline attaches its own listener in the
@@ -276,7 +300,7 @@ async function login(config) {
     })
   })
   warnIfStoreUnavailable()
-  process.stdout.write(`Dayflow CLI is signed in. The refresh token is kept in ${IGNORE_KEYRING || storeUnavailable ? 'memory for this run only' : "this machine's credential store"}.\n`)
+  process.stdout.write(`Dayflow CLI is signed in. The refresh token is kept in ${storeDescription()}.\n`)
 }
 
 function printHelp() {
@@ -315,6 +339,7 @@ function printHelp() {
     '  --manual  print the sign-in URL, then paste the callback URL back (servers, containers, no browser)',
     '  DAYFLOW_REFRESH_TOKEN (env) or "refreshToken" in the config file signs in with no browser at all.',
     '  DAYFLOW_IGNORE_KEYRING=1 ignores the machine credential store and uses only those tokens.',
+    '  Without a credential store (containers, servers), the login is saved to the config file automatically.',
     '',
     'Config: NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY,',
     `or ${CONFIG_PATH} holding {"url": "...", "publishableKey": "..."} (override with DAYFLOW_CONFIG).`,
@@ -327,7 +352,7 @@ async function createSession(config) {
   const candidates = orderRefreshTokenCandidates({
     storedToken: sessionStore.get(),
     envToken: process.env.DAYFLOW_REFRESH_TOKEN,
-    configToken: readConfigFile().refreshToken,
+    configToken: configStore.get(),
   })
   if (!candidates.length) {
     throw new Error('No Dayflow login is stored. Run dayflow auth login (add --manual when this machine has no browser), or set DAYFLOW_REFRESH_TOKEN.')

package/src/dayflow-cli-auth.mjs

@@ -1,4 +1,51 @@
 import { Entry } from '@napi-rs/keyring'
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname } from 'node:path'
+
+// A refresh-token store that persists into the JSON config file. The config file is already a
+// fallback read source for browserless machines; this makes it a write target too, so a sign-in on
+// a machine without a credential store survives across runs instead of dying with the process.
+export function createConfigFileStore(configPath) {
+  const readRaw = () => {
+    try { return readFileSync(configPath, 'utf8') } catch { return '' }
+  }
+  const parse = () => {
+    const raw = readRaw()
+    if (!raw.trim()) return {}
+    let parsed
+    try {
+      parsed = JSON.parse(raw)
+    } catch {
+      throw new Error('Dayflow config file is not valid JSON.')
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+      throw new Error('Dayflow config file is not a JSON object.')
+    }
+    return parsed
+  }
+  const write = (update) => {
+    const next = update(parse())
+    mkdirSync(dirname(configPath), { recursive: true })
+    writeFileSync(configPath, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 })
+  }
+  return {
+    get() {
+      try { return parse().refreshToken ?? null } catch { return null }
+    },
+    set(token) {
+      if (!token) throw new Error('Cannot store an empty Dayflow refresh token.')
+      write((config) => { config.refreshToken = token; return config })
+    },
+    clear() {
+      try {
+        write((config) => { delete config.refreshToken; return config })
+      } catch {
+        return false
+      }
+      return true
+    },
+  }
+}
 
 export function createRefreshTokenStore(entry = new Entry('Dayflow CLI', 'supabase-refresh-token')) {
   return {

package/src/okr.mjs

@@ -33,7 +33,13 @@ export function currentPeriod(cycleType, now = new Date()) {
 export function keyResultProgress(keyResult) {
   const { baseline, current, target } = keyResult ?? {}
   if (![baseline, current, target].every(Number.isFinite) || baseline === target) return 0
-  const progress = (current - baseline) / (target - baseline)
+  const change = current - baseline
+  const distance = target - baseline
+  // Scaling avoids Infinity / Infinity for opposite finite endpoints near MAX_VALUE.
+  const scale = Math.max(Math.abs(baseline), Math.abs(current), Math.abs(target))
+  const progress = Number.isFinite(change) && Number.isFinite(distance)
+    ? change / distance
+    : (current / scale - baseline / scale) / (target / scale - baseline / scale)
   return Math.round(Math.max(0, Math.min(1, progress)) * 100)
 }
 
@@ -46,6 +52,11 @@ export function objectiveProgress(objective) {
 
 const isValidId = (value) => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,199}$/.test(value)
 
+function validId(value) {
+  if (!isValidId(value)) throw new Error('ID must be a nonempty identifier of at most 200 letters, digits, hyphens or underscores.')
+  return value
+}
+
 /** Read-only lookup keeps the original record references. */
 export function findKeyResult(objectives, id) {
   if (!isValidId(id)) return null
@@ -104,11 +115,15 @@ function text(value, label, limit, required = false) {
 /** Pure mutations return a detached payload; callers own persistence. */
 export function mutateGoals(payload, operation, input, options = {}) {
   if (!isRecord(input)) throw new Error('Goal input must be an object.')
+  if (['update_objective', 'archive_objective', 'update_key_result', 'check_in_key_result', 'delete_key_result', 'align_task'].includes(operation)) {
+    validId(input.id)
+  }
+  if (operation === 'add_key_result') validId(input.objectiveId)
   const source = isRecord(payload) ? payload : {}
   const state = structuredClone(source)
   state.objectives = normalizeObjectives(source.objectives)
   state.tasks = Array.isArray(state.tasks) ? state.tasks : []
-  const makeId = options.makeId ?? (() => globalThis.crypto.randomUUID())
+  const makeId = () => validId((options.makeId ?? (() => globalThis.crypto.randomUUID()))())
   const timestamp = () => {
     const now = typeof options.now === 'function' ? options.now() : (options.now ?? new Date())
     if (!(now instanceof Date) || !Number.isFinite(now.getTime())) throw new Error('Current date must be valid.')
@@ -133,8 +148,8 @@ export function mutateGoals(payload, operation, input, options = {}) {
     if (input.title !== undefined) objective.title = text(input.title, 'Objective title', 200, true)
     if (input.description !== undefined) objective.description = text(input.description, 'Objective description', 1000)
     if (input.cycleType !== undefined || input.period !== undefined) {
-      const cycleType = input.cycleType ?? objective.cycleType
-      const period = input.period ?? objective.period
+      const cycleType = input.cycleType !== undefined ? input.cycleType : objective.cycleType
+      const period = input.period !== undefined ? input.period : objective.period
       Object.assign(objective, { cycleType, period }, cycleDates(cycleType, period))
     }
     if (input.status !== undefined) {
@@ -171,7 +186,9 @@ export function mutateGoals(payload, operation, input, options = {}) {
     if (input.title !== undefined) keyResult.title = text(input.title, 'Key result title', 200, true)
     if (input.baseline !== undefined) keyResult.baseline = finiteNumber(input.baseline, 'Baseline')
     if (input.target !== undefined) keyResult.target = finiteNumber(input.target, 'Target')
-    if (keyResult.baseline === keyResult.target) throw new Error('Target must differ from baseline.')
+    if (finiteNumber(keyResult.baseline, 'Baseline') === finiteNumber(keyResult.target, 'Target')) {
+      throw new Error('Target must differ from baseline.')
+    }
     if (input.unit !== undefined) keyResult.unit = text(input.unit, 'Unit', 32)
     return { payload: state, result: keyResult }
   }
@@ -215,6 +232,7 @@ export function mutateGoals(payload, operation, input, options = {}) {
     }
     if (hasChore) task.isChore = input.isChore
     if (hasKeyResult && !unlink) {
+      validId(input.keyResultId)
       const found = findKeyResult(state.objectives, input.keyResultId)
       if (!found) throw new Error('Key result was not found.')
       activeObjective(found.objective)

package/src/task-lists.mjs

@@ -31,7 +31,8 @@ export function attachTaskListIds(tasks, lists) {
   const fallback = normalizedLists[0].id
   return (Array.isArray(tasks) ? tasks : []).map((task) => {
     const listId = String(task?.listId ?? '').trim()
-    return known.has(listId) ? task : { ...task, listId: fallback }
+    const canonicalListId = known.has(listId) ? listId : fallback
+    return task?.listId === canonicalListId ? task : { ...task, listId: canonicalListId }
   })
 }