@sqaoss/flowy 1.3.0 → 1.4.0

package/docker-compose.yml

@@ -5,19 +5,24 @@ services:
       dockerfile_inline: |
         FROM oven/bun:1.3.11
         WORKDIR /app
-        RUN bun init -y && bun add @sqaoss/flowy
+        RUN bun init -y && bun add @sqaoss/flowy@1.3.0
         WORKDIR /app/node_modules/@sqaoss/flowy/server
         RUN bun install --production
         EXPOSE 4000
         VOLUME /data
         CMD ["bun", "src/index.ts"]
+    # Publish on loopback only — the server is unauthenticated, so it must not
+    # be reachable from the LAN. Prefer the native `flowy serve` for local dev.
     ports:
-      - "4000:4000"
+      - "127.0.0.1:4000:4000"
     volumes:
       - flowy-data:/data
     environment:
       - FLOWY_DB_PATH=/data/flowy.sqlite
       - PORT=4000
+      # Bind all interfaces *inside* the container so Docker's loopback-only
+      # host publish above can reach it; the host port stays 127.0.0.1.
+      - HOST=0.0.0.0
     healthcheck:
       test: ["CMD", "bun", "-e", "fetch('http://localhost:4000/health').then(r => r.ok ? process.exit(0) : process.exit(1))"]
       interval: 5s

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sqaoss/flowy",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Agentic persistent planning",
   "type": "module",
   "bin": {

package/server/src/index.errors.test.ts

@@ -75,6 +75,37 @@ describe('server error masking', () => {
     expect(error.extensions?.code).toBe('VALIDATION_ERROR')
   })
 
+  it('surfaces a not-found node query with real message and NOT_FOUND code (no silent null)', async () => {
+    instance = createServer({ dbPath: ':memory:', port: 0 })
+
+    const json = await gql('query ($id: String!) { node(id: $id) { id } }', {
+      id: 'task_nonexistent',
+    })
+
+    expect(json.errors).toBeDefined()
+    const error = json.errors![0]
+    expect(error.message).toBe('Node task_nonexistent not found')
+    expect(error.extensions?.code).toBe('NOT_FOUND')
+    const data = json.data as { node: unknown } | null | undefined
+    expect(data?.node ?? null).toBeNull()
+  })
+
+  it('still returns a node when it exists', async () => {
+    instance = createServer({ dbPath: ':memory:', port: 0 })
+
+    const created = (await gql(
+      'mutation { createNode(type: "task", title: "T") { id } }',
+    )) as { data: { createNode: { id: string } } }
+    const id = created.data.createNode.id
+
+    const json = (await gql('query ($id: String!) { node(id: $id) { id } }', {
+      id,
+    })) as { data: { node: { id: string } }; errors?: unknown[] }
+
+    expect(json.errors).toBeUndefined()
+    expect(json.data.node.id).toBe(id)
+  })
+
   it('surfaces an approve-wrong-status error with CONFLICT code', async () => {
     instance = createServer({ dbPath: ':memory:', port: 0 })
 
@@ -168,13 +199,12 @@ describe('server error masking', () => {
     })) as { data: { deleteNode: boolean } }
     expect(del.data.deleteNode).toBe(true)
 
-    const fetched = (await gql(
-      'query ($id: String!) { node(id: $id) { id } }',
-      {
-        id,
-      },
-    )) as { data: { node: unknown } }
-    expect(fetched.data.node).toBeNull()
+    const fetched = await gql('query ($id: String!) { node(id: $id) { id } }', {
+      id,
+    })
+    // The node is gone: querying it now fails loud with NOT_FOUND.
+    expect(fetched.errors).toBeDefined()
+    expect(fetched.errors![0].extensions?.code).toBe('NOT_FOUND')
   })
 
   it('refuses to delete a parent with children (CONFLICT)', async () => {

package/server/src/index.test.ts

@@ -22,4 +22,33 @@ describe('createServer', () => {
     expect(res.status).toBe(200)
     expect(json).toEqual({ status: 'ok' })
   })
+
+  it('binds to 127.0.0.1 by default, not all interfaces', () => {
+    instance = createServer({ dbPath: ':memory:', port: 0 })
+
+    expect(instance.hostname).toBe('127.0.0.1')
+    expect(instance.server.hostname).toBe('127.0.0.1')
+  })
+
+  it('allows the bind hostname to be overridden via opts', () => {
+    instance = createServer({
+      dbPath: ':memory:',
+      port: 0,
+      hostname: '0.0.0.0',
+    })
+
+    expect(instance.hostname).toBe('0.0.0.0')
+  })
+
+  it('allows the bind hostname to be overridden via HOST env', () => {
+    const prev = process.env.HOST
+    process.env.HOST = '0.0.0.0'
+    try {
+      instance = createServer({ dbPath: ':memory:', port: 0 })
+      expect(instance.hostname).toBe('0.0.0.0')
+    } finally {
+      if (prev === undefined) delete process.env.HOST
+      else process.env.HOST = prev
+    }
+  })
 })

package/server/src/index.ts

@@ -3,9 +3,16 @@ import { createDb } from './db.ts'
 import { createResolvers } from './resolvers.ts'
 import { typeDefs } from './schema.ts'
 
-export function createServer(opts?: { dbPath?: string; port?: number }) {
+export function createServer(opts?: {
+  dbPath?: string
+  port?: number
+  hostname?: string
+}) {
   const dbPath = opts?.dbPath ?? process.env.FLOWY_DB_PATH ?? './flowy.sqlite'
   const port = opts?.port ?? Number(process.env.PORT ?? 4000)
+  // Bind loopback by default so the unauthenticated dev server is not exposed
+  // on the LAN. Override with the `hostname` opt or the HOST env var.
+  const hostname = opts?.hostname ?? process.env.HOST ?? '127.0.0.1'
 
   const db = createDb(dbPath)
   const resolvers = createResolvers(db)
@@ -17,6 +24,7 @@ export function createServer(opts?: { dbPath?: string; port?: number }) {
 
   const server = Bun.serve({
     port,
+    hostname,
     fetch(req) {
       const url = new URL(req.url)
       if (url.pathname === '/health' && req.method === 'GET') {
@@ -29,6 +37,7 @@ export function createServer(opts?: { dbPath?: string; port?: number }) {
   return {
     server,
     port: server.port,
+    hostname: server.hostname,
     db,
     close() {
       server.stop()
@@ -38,8 +47,9 @@ export function createServer(opts?: { dbPath?: string; port?: number }) {
 }
 
 if (import.meta.main) {
-  const { port } = createServer()
-  console.log(`Flowy local server running on http://localhost:${port}`)
-  console.log(`  GraphQL: http://localhost:${port}/graphql`)
-  console.log(`  Health:  http://localhost:${port}/health`)
+  const { port, hostname } = createServer()
+  const host = hostname === '0.0.0.0' ? 'localhost' : hostname
+  console.log(`Flowy local server running on http://${host}:${port}`)
+  console.log(`  GraphQL: http://${host}:${port}/graphql`)
+  console.log(`  Health:  http://${host}:${port}/health`)
 }

package/server/src/resolvers.test.ts

@@ -165,9 +165,17 @@ describe('createResolvers', () => {
       })
     })
 
-    it('returns null for non-existent id', () => {
-      const found = resolvers.Query.node(null, { id: 'nonexistent' })
-      expect(found).toBeNull()
+    it('throws NOT_FOUND for a non-existent id (no silent null)', () => {
+      expect(() => resolvers.Query.node(null, { id: 'nonexistent' })).toThrow(
+        'Node nonexistent not found',
+      )
+      try {
+        resolvers.Query.node(null, { id: 'nonexistent' })
+      } catch (error) {
+        expect(
+          (error as { extensions?: { code?: string } }).extensions?.code,
+        ).toBe('NOT_FOUND')
+      }
     })
   })
 
@@ -321,7 +329,10 @@ describe('createResolvers', () => {
       const node = create(resolvers, { type: 'task', title: 'Leaf' })
       const result = resolvers.Mutation.deleteNode(null, { id: node.id })
       expect(result).toBe(true)
-      expect(resolvers.Query.node(null, { id: node.id })).toBeNull()
+      // After deletion the node is gone: Query.node now fails loud (NOT_FOUND).
+      expect(() => resolvers.Query.node(null, { id: node.id })).toThrow(
+        `Node ${node.id} not found`,
+      )
     })
 
     it('removes incident blocks edges when deleting a leaf', () => {

package/server/src/resolvers.ts

@@ -122,7 +122,9 @@ export function createResolvers(db: Db) {
   return {
     Query: {
       node: (_: unknown, args: { id: string }) => {
-        return selectNode(db, args.id)
+        const node = selectNode(db, args.id)
+        if (!node) throw notFoundError(`Node ${args.id} not found`)
+        return node
       },
 
       nodes: (_: unknown, args: { type?: string }) => {

package/src/commands/feature.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test, vi } from 'vitest'
+import { beforeEach, describe, expect, test, vi } from 'vitest'
 
 const mockUpdateProjectConfig = vi.fn()
 
@@ -22,6 +22,10 @@ vi.mock('../util/format.ts', () => ({
 }))
 
 describe('feature command', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
   test('exports a command group named "feature" with subcommands', async () => {
     const { featureCommand } = await import('./feature.ts')
     expect(featureCommand.name()).toBe('feature')
@@ -31,6 +35,8 @@ describe('feature command', () => {
     expect(subcommandNames).toContain('unset')
     expect(subcommandNames).toContain('list')
     expect(subcommandNames).toContain('show')
+    expect(subcommandNames).toContain('update')
+    expect(subcommandNames).toContain('delete')
   })
 
   test('create calls outputError when no active project', async () => {
@@ -68,4 +74,158 @@ describe('feature command', () => {
 
     expect(output).toHaveBeenCalledWith({ activeFeature: null })
   })
+
+  test('update sends updateNode with only the title when title-only', async () => {
+    const { graphql } = await import('../util/client.ts')
+    const { output } = await import('../util/format.ts')
+    const { featureCommand } = await import('./feature.ts')
+
+    vi.mocked(graphql).mockResolvedValueOnce({
+      updateNode: { id: 'feat_1', title: 'New' },
+    })
+
+    const updateCmd = featureCommand.commands.find(
+      (c) => c.name() === 'update',
+    )!
+    await updateCmd.parseAsync(['feat_1', '--title', 'New'], { from: 'user' })
+
+    expect(graphql).toHaveBeenCalledWith(
+      expect.stringContaining('updateNode'),
+      {
+        id: 'feat_1',
+        title: 'New',
+      },
+    )
+    expect(output).toHaveBeenCalledWith({ id: 'feat_1', title: 'New' })
+  })
+
+  test('update sends updateNode with only the description when description-only', async () => {
+    const { graphql } = await import('../util/client.ts')
+    const { featureCommand } = await import('./feature.ts')
+
+    vi.mocked(graphql).mockResolvedValueOnce({ updateNode: { id: 'feat_1' } })
+
+    const updateCmd = featureCommand.commands.find(
+      (c) => c.name() === 'update',
+    )!
+    await updateCmd.parseAsync(['feat_1', '--description', 'Body'], {
+      from: 'user',
+    })
+
+    expect(graphql).toHaveBeenCalledWith(
+      expect.stringContaining('updateNode'),
+      {
+        id: 'feat_1',
+        description: 'Body',
+      },
+    )
+  })
+
+  test('update sends updateNode with only the metadata when metadata-only', async () => {
+    const { graphql } = await import('../util/client.ts')
+    const { featureCommand } = await import('./feature.ts')
+
+    vi.mocked(graphql).mockResolvedValueOnce({ updateNode: { id: 'feat_1' } })
+
+    const updateCmd = featureCommand.commands.find(
+      (c) => c.name() === 'update',
+    )!
+    await updateCmd.parseAsync(['feat_1', '--metadata', '{"k":"v"}'], {
+      from: 'user',
+    })
+
+    expect(graphql).toHaveBeenCalledWith(
+      expect.stringContaining('updateNode'),
+      {
+        id: 'feat_1',
+        metadata: '{"k":"v"}',
+      },
+    )
+  })
+
+  test('update sends updateNode with combined fields', async () => {
+    const { graphql } = await import('../util/client.ts')
+    const { featureCommand } = await import('./feature.ts')
+
+    vi.mocked(graphql).mockResolvedValueOnce({ updateNode: { id: 'feat_1' } })
+
+    const updateCmd = featureCommand.commands.find(
+      (c) => c.name() === 'update',
+    )!
+    await updateCmd.parseAsync(
+      ['feat_1', '--title', 'New', '--description', 'Body', '--metadata', '{}'],
+      { from: 'user' },
+    )
+
+    expect(graphql).toHaveBeenCalledWith(
+      expect.stringContaining('updateNode'),
+      {
+        id: 'feat_1',
+        title: 'New',
+        description: 'Body',
+        metadata: '{}',
+      },
+    )
+  })
+
+  test('delete sends deleteNode mutation', async () => {
+    const { graphql } = await import('../util/client.ts')
+    const { output } = await import('../util/format.ts')
+    const { featureCommand } = await import('./feature.ts')
+
+    vi.mocked(graphql).mockResolvedValueOnce({ deleteNode: true })
+
+    const deleteCmd = featureCommand.commands.find(
+      (c) => c.name() === 'delete',
+    )!
+    await deleteCmd.parseAsync(['feat_1'], { from: 'user' })
+
+    expect(graphql).toHaveBeenCalledWith(
+      expect.stringContaining('deleteNode'),
+      {
+        id: 'feat_1',
+      },
+    )
+    expect(output).toHaveBeenCalledWith({ deleted: true })
+  })
+
+  test('delete surfaces CONFLICT via outputError with its code', async () => {
+    const { graphql } = await import('../util/client.ts')
+    const { outputError } = await import('../util/format.ts')
+    const { featureCommand } = await import('./feature.ts')
+
+    const conflict = Object.assign(new Error('has children'), {
+      code: 'CONFLICT',
+    })
+    vi.mocked(graphql).mockRejectedValueOnce(conflict)
+
+    const deleteCmd = featureCommand.commands.find(
+      (c) => c.name() === 'delete',
+    )!
+    await deleteCmd.parseAsync(['feat_1'], { from: 'user' })
+
+    expect(outputError).toHaveBeenCalledWith(
+      expect.objectContaining({ code: 'CONFLICT' }),
+    )
+  })
+
+  test('delete surfaces NOT_FOUND via outputError with its code', async () => {
+    const { graphql } = await import('../util/client.ts')
+    const { outputError } = await import('../util/format.ts')
+    const { featureCommand } = await import('./feature.ts')
+
+    const notFound = Object.assign(new Error('Node feat_x not found'), {
+      code: 'NOT_FOUND',
+    })
+    vi.mocked(graphql).mockRejectedValueOnce(notFound)
+
+    const deleteCmd = featureCommand.commands.find(
+      (c) => c.name() === 'delete',
+    )!
+    await deleteCmd.parseAsync(['feat_x'], { from: 'user' })
+
+    expect(outputError).toHaveBeenCalledWith(
+      expect.objectContaining({ code: 'NOT_FOUND' }),
+    )
+  })
 })

package/src/commands/feature.ts

@@ -16,11 +16,21 @@ featureCommand
   .command('create')
   .description('Create a feature in the active project')
   .requiredOption('--title <title>', 'Feature title')
-  .requiredOption('--description <description>', 'Feature description')
+  .option(
+    '--description <text>',
+    'Feature description, used verbatim (never read as a file path)',
+  )
+  .option(
+    '--description-file <path>',
+    'Read the feature description from a file, or "-" for stdin',
+  )
   .action(async (opts) => {
     try {
       const project = requireProject()
-      const description = await resolveDescription(opts.description)
+      const description = await resolveDescription({
+        description: opts.description,
+        descriptionFile: opts.descriptionFile,
+      })
       const nodeData = await graphql<{ createNode: { id: string } }>(
         `mutation CreateNode($type: String!, $title: String!, $description: String) {
           createNode(type: $type, title: $title, description: $description) {
@@ -116,6 +126,75 @@ featureCommand
     }
   })
 
+featureCommand
+  .command('update')
+  .description('Update a feature')
+  .argument('[id]', 'Feature ID (defaults to active feature)')
+  .option('--title <title>', 'New title')
+  .option(
+    '--description <text>',
+    'New description, used verbatim (never read as a file path)',
+  )
+  .option(
+    '--description-file <path>',
+    'Read the new description from a file, or "-" for stdin',
+  )
+  .option('--metadata <json>', 'New metadata as a JSON string')
+  .action(async (id: string | undefined, opts) => {
+    try {
+      const featureId = id ?? resolveFeature()
+      if (!featureId) {
+        throw new Error(
+          'No feature specified. Pass an ID or set an active feature.',
+        )
+      }
+      const variables: Record<string, unknown> = { id: featureId }
+      if (opts.title != null) variables.title = opts.title
+      if (opts.description != null || opts.descriptionFile != null) {
+        variables.description = await resolveDescription({
+          description: opts.description,
+          descriptionFile: opts.descriptionFile,
+        })
+      }
+      if (opts.metadata != null) variables.metadata = opts.metadata
+      const data = await graphql<{ updateNode: unknown }>(
+        `mutation UpdateNode($id: String!, $title: String, $description: String, $metadata: String) {
+          updateNode(id: $id, title: $title, description: $description, metadata: $metadata) {
+            id type title description status metadata createdAt updatedAt
+          }
+        }`,
+        variables,
+      )
+      output(data.updateNode)
+    } catch (error) {
+      outputError(error)
+    }
+  })
+
+featureCommand
+  .command('delete')
+  .description('Delete a feature')
+  .argument('[id]', 'Feature ID (defaults to active feature)')
+  .action(async (id?: string) => {
+    try {
+      const featureId = id ?? resolveFeature()
+      if (!featureId) {
+        throw new Error(
+          'No feature specified. Pass an ID or set an active feature.',
+        )
+      }
+      const data = await graphql<{ deleteNode: boolean }>(
+        `mutation DeleteNode($id: String!) {
+          deleteNode(id: $id)
+        }`,
+        { id: featureId },
+      )
+      output({ deleted: data.deleteNode })
+    } catch (error) {
+      outputError(error)
+    }
+  })
+
 featureCommand
   .command('show')
   .description('Show feature details')