@pachca/cli 2026.7.1 → 2026.7.2

package/dist/data/workflows.json

@@ -45,7 +45,7 @@
         "steps": [
             {
                 "description": "Получи или создай тред, возьми `thread.id` из ответа",
-                "command": "pachca thread add <ID>",
+                "command": "pachca threads add <ID>",
                 "notes": "Если тред уже существует, вернётся существующий"
             },
             {
@@ -140,7 +140,7 @@
         "steps": [
             {
                 "description": "Получи или создай тред, возьми `chat_id` из ответа",
-                "command": "pachca thread add <ID>"
+                "command": "pachca threads add <ID>"
             },
             {
                 "description": "Добавь бота в участники чата треда",

package/dist/output.js

@@ -45,8 +45,16 @@ function outputCsv(data, opts) {
             const val = item[col];
             if (val == null)
                 return '';
-            const str = String(val);
-            if (str.includes(',') || str.includes('"') || str.includes('\n')) {
+            // Objects/arrays as JSON, matching outputPlain and outputTable —
+            // String() rendered them as "[object Object]" and lost the structure.
+            const str = typeof val === 'object' ? JSON.stringify(val) : String(val);
+            // A cell starting with =, +, - or @ is executed as a formula by Excel,
+            // Sheets and LibreOffice. Values here are user-authored (message text,
+            // names), so prefix a quote to neutralise it.
+            if (/^[=+\-@\t\r]/.test(str)) {
+                return `"'${str.replace(/"/g, '""')}"`;
+            }
+            if (/[",\n\r]/.test(str)) {
                 return `"${str.replace(/"/g, '""')}"`;
             }
             return str;

package/dist/profiles.js

@@ -143,15 +143,19 @@ export function setConfigValue(key, value) {
 }
 /**
  * Resolve the token to use, respecting priority:
- * --token > PACHCA_TOKEN env > --profile/PACHCA_PROFILE > active profile > error
+ * --token > --profile > PACHCA_TOKEN env > PACHCA_PROFILE env > active profile > error
+ *
+ * Explicit flags beat ambient environment. An exported PACHCA_TOKEN (common in
+ * CI and agent shells) used to win over an explicit `--profile staging`, so the
+ * command silently wrote to the wrong workspace with the wrong token.
  */
 export function resolveToken(flags) {
     // 1. --token flag (highest priority)
     if (flags.token) {
         return { token: flags.token };
     }
-    // 2. PACHCA_TOKEN env
-    if (process.env.PACHCA_TOKEN) {
+    // 2. PACHCA_TOKEN env — unless a profile was named explicitly
+    if (!flags.profile && process.env.PACHCA_TOKEN) {
         return { token: process.env.PACHCA_TOKEN };
     }
     // 3. --profile flag or PACHCA_PROFILE env