devvami 1.1.0 → 1.1.1

package/oclif.manifest.json

@@ -703,19 +703,14 @@
         "search.js"
       ]
     },
-    "pipeline:logs": {
+    "pr:create": {
       "aliases": [],
-      "args": {
-        "run-id": {
-          "description": "ID del workflow run",
-          "name": "run-id",
-          "required": true
-        }
-      },
-      "description": "Log di un workflow run specifico",
+      "args": {},
+      "description": "Apri Pull Request precompilata con template, label e reviewer",
       "examples": [
-        "<%= config.bin %> pipeline logs 12345",
-        "<%= config.bin %> pipeline logs 12345 --job test"
+        "<%= config.bin %> pr create",
+        "<%= config.bin %> pr create --draft",
+        "<%= config.bin %> pr create --title \"My PR\" --dry-run"
       ],
       "flags": {
         "json": {
@@ -725,17 +720,29 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "job": {
-          "description": "Filtra per job name",
-          "name": "job",
+        "title": {
+          "description": "Titolo PR (default: auto-generated)",
+          "name": "title",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "draft": {
+          "description": "Crea come draft",
+          "name": "draft",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "dry-run": {
+          "description": "Preview senza eseguire",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "pipeline:logs",
+      "id": "pr:create",
       "pluginAlias": "devvami",
       "pluginName": "devvami",
       "pluginType": "core",
@@ -745,18 +752,24 @@
       "relativePath": [
         "src",
         "commands",
-        "pipeline",
-        "logs.js"
+        "pr",
+        "create.js"
       ]
     },
-    "pipeline:rerun": {
+    "pr:detail": {
       "aliases": [],
-      "args": {},
-      "description": "Rilancia l'ultimo workflow fallito",
+      "args": {
+        "number": {
+          "description": "Numero della PR",
+          "name": "number",
+          "required": true
+        }
+      },
+      "description": "Dettaglio PR con commenti QA e checklist degli step",
       "examples": [
-        "<%= config.bin %> pipeline rerun",
-        "<%= config.bin %> pipeline rerun --failed-only",
-        "<%= config.bin %> pipeline rerun --run-id 12345"
+        "<%= config.bin %> pr detail 42",
+        "<%= config.bin %> pr detail 42 --repo devvami/my-api",
+        "<%= config.bin %> pr detail 42 --json"
       ],
       "flags": {
         "json": {
@@ -766,23 +779,17 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "run-id": {
-          "description": "ID specifico del run",
-          "name": "run-id",
+        "repo": {
+          "description": "Repository nel formato owner/repo (default: rilevato da git remote)",
+          "name": "repo",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "failed-only": {
-          "description": "Rilancia solo i job falliti",
-          "name": "failed-only",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "pipeline:rerun",
+      "id": "pr:detail",
       "pluginAlias": "devvami",
       "pluginName": "devvami",
       "pluginType": "core",
@@ -792,18 +799,17 @@
       "relativePath": [
         "src",
         "commands",
-        "pipeline",
-        "rerun.js"
+        "pr",
+        "detail.js"
       ]
     },
-    "pipeline:status": {
+    "pr:review": {
       "aliases": [],
       "args": {},
-      "description": "Stato GitHub Actions per il repo corrente",
+      "description": "Lista PR assegnate a te per la code review",
       "examples": [
-        "<%= config.bin %> pipeline status",
-        "<%= config.bin %> pipeline status --branch main",
-        "<%= config.bin %> pipeline status --limit 20 --json"
+        "<%= config.bin %> pr review",
+        "<%= config.bin %> pr review --json"
       ],
       "flags": {
         "json": {
@@ -812,26 +818,11 @@
           "name": "json",
           "allowNo": false,
           "type": "boolean"
-        },
-        "branch": {
-          "description": "Filtra per branch",
-          "name": "branch",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "limit": {
-          "description": "Numero di run da mostrare",
-          "name": "limit",
-          "default": 10,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "pipeline:status",
+      "id": "pr:review",
       "pluginAlias": "devvami",
       "pluginName": "devvami",
       "pluginType": "core",
@@ -841,18 +832,18 @@
       "relativePath": [
         "src",
         "commands",
-        "pipeline",
-        "status.js"
+        "pr",
+        "review.js"
       ]
     },
-    "pr:create": {
+    "pr:status": {
       "aliases": [],
       "args": {},
-      "description": "Apri Pull Request precompilata con template, label e reviewer",
+      "description": "Stato delle tue PR aperte (come autore e come reviewer)",
       "examples": [
-        "<%= config.bin %> pr create",
-        "<%= config.bin %> pr create --draft",
-        "<%= config.bin %> pr create --title \"My PR\" --dry-run"
+        "<%= config.bin %> pr status",
+        "<%= config.bin %> pr status --author",
+        "<%= config.bin %> pr status --json"
       ],
       "flags": {
         "json": {
@@ -862,29 +853,22 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "title": {
-          "description": "Titolo PR (default: auto-generated)",
-          "name": "title",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "draft": {
-          "description": "Crea come draft",
-          "name": "draft",
+        "author": {
+          "description": "Solo PR dove sei autore",
+          "name": "author",
           "allowNo": false,
           "type": "boolean"
         },
-        "dry-run": {
-          "description": "Preview senza eseguire",
-          "name": "dry-run",
+        "reviewer": {
+          "description": "Solo PR dove sei reviewer",
+          "name": "reviewer",
           "allowNo": false,
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "pr:create",
+      "id": "pr:status",
       "pluginAlias": "devvami",
       "pluginName": "devvami",
       "pluginType": "core",
@@ -895,23 +879,22 @@
         "src",
         "commands",
         "pr",
-        "create.js"
+        "status.js"
       ]
     },
-    "pr:detail": {
+    "pipeline:logs": {
       "aliases": [],
       "args": {
-        "number": {
-          "description": "Numero della PR",
-          "name": "number",
+        "run-id": {
+          "description": "ID del workflow run",
+          "name": "run-id",
           "required": true
         }
       },
-      "description": "Dettaglio PR con commenti QA e checklist degli step",
+      "description": "Log di un workflow run specifico",
       "examples": [
-        "<%= config.bin %> pr detail 42",
-        "<%= config.bin %> pr detail 42 --repo devvami/my-api",
-        "<%= config.bin %> pr detail 42 --json"
+        "<%= config.bin %> pipeline logs 12345",
+        "<%= config.bin %> pipeline logs 12345 --job test"
       ],
       "flags": {
         "json": {
@@ -921,9 +904,9 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "repo": {
-          "description": "Repository nel formato owner/repo (default: rilevato da git remote)",
-          "name": "repo",
+        "job": {
+          "description": "Filtra per job name",
+          "name": "job",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -931,7 +914,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "pr:detail",
+      "id": "pipeline:logs",
       "pluginAlias": "devvami",
       "pluginName": "devvami",
       "pluginType": "core",
@@ -941,17 +924,18 @@
       "relativePath": [
         "src",
         "commands",
-        "pr",
-        "detail.js"
+        "pipeline",
+        "logs.js"
       ]
     },
-    "pr:review": {
+    "pipeline:rerun": {
       "aliases": [],
       "args": {},
-      "description": "Lista PR assegnate a te per la code review",
+      "description": "Rilancia l'ultimo workflow fallito",
       "examples": [
-        "<%= config.bin %> pr review",
-        "<%= config.bin %> pr review --json"
+        "<%= config.bin %> pipeline rerun",
+        "<%= config.bin %> pipeline rerun --failed-only",
+        "<%= config.bin %> pipeline rerun --run-id 12345"
       ],
       "flags": {
         "json": {
@@ -960,11 +944,24 @@
           "name": "json",
           "allowNo": false,
           "type": "boolean"
+        },
+        "run-id": {
+          "description": "ID specifico del run",
+          "name": "run-id",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "failed-only": {
+          "description": "Rilancia solo i job falliti",
+          "name": "failed-only",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "pr:review",
+      "id": "pipeline:rerun",
       "pluginAlias": "devvami",
       "pluginName": "devvami",
       "pluginType": "core",
@@ -974,18 +971,18 @@
       "relativePath": [
         "src",
         "commands",
-        "pr",
-        "review.js"
+        "pipeline",
+        "rerun.js"
       ]
     },
-    "pr:status": {
+    "pipeline:status": {
       "aliases": [],
       "args": {},
-      "description": "Stato delle tue PR aperte (come autore e come reviewer)",
+      "description": "Stato GitHub Actions per il repo corrente",
       "examples": [
-        "<%= config.bin %> pr status",
-        "<%= config.bin %> pr status --author",
-        "<%= config.bin %> pr status --json"
+        "<%= config.bin %> pipeline status",
+        "<%= config.bin %> pipeline status --branch main",
+        "<%= config.bin %> pipeline status --limit 20 --json"
       ],
       "flags": {
         "json": {
@@ -995,22 +992,25 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "author": {
-          "description": "Solo PR dove sei autore",
-          "name": "author",
-          "allowNo": false,
-          "type": "boolean"
+        "branch": {
+          "description": "Filtra per branch",
+          "name": "branch",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
-        "reviewer": {
-          "description": "Solo PR dove sei reviewer",
-          "name": "reviewer",
-          "allowNo": false,
-          "type": "boolean"
+        "limit": {
+          "description": "Numero di run da mostrare",
+          "name": "limit",
+          "default": 10,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "pr:status",
+      "id": "pipeline:status",
       "pluginAlias": "devvami",
       "pluginName": "devvami",
       "pluginType": "core",
@@ -1020,7 +1020,7 @@
       "relativePath": [
         "src",
         "commands",
-        "pr",
+        "pipeline",
         "status.js"
       ]
     },
@@ -1498,5 +1498,5 @@
       ]
     }
   },
-  "version": "1.1.0"
+  "version": "1.1.1"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devvami",
   "description": "DevEx CLI for developers and teams — manage repos, PRs, pipelines, tasks, and costs from the terminal",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "author": "",
   "type": "module",
   "bin": {
@@ -128,6 +128,7 @@
     "commit": "git-cz",
     "release": "semantic-release",
     "release:dry-run": "semantic-release --dry-run",
+    "version:sync": "node scripts/sync-version.js",
     "lint": "eslint src/ tests/",
     "lint:fix": "eslint src/ tests/ --fix",
     "format": "prettier --write src/ tests/",

package/src/commands/open.js

@@ -68,7 +68,7 @@ export default class Open extends Command {
     if (isJson) return result
 
     await openBrowser(url)
-    this.log(chalk.green('✓') + ` Opened ${url}`)
+    this.log(chalk.green('✓') + ' Opened in browser')
 
     return result
   }

package/src/commands/upgrade.js

@@ -22,6 +22,11 @@ export default class Upgrade extends Command {
     const { hasUpdate, current, latest } = await checkForUpdate({ force: true })
     spinner?.stop()
 
+    // Guard against malformed version strings from the GitHub Releases API
+    if (latest && !/^v?\d+\.\d+\.\d+(-[\w.]+)?(\+[\w.]+)?$/.test(latest)) {
+      this.error(`Invalid version received from releases API: "${latest}" — update aborted`)
+    }
+
     if (!hasUpdate) {
       const msg = `You're already on the latest version (${current})`
       if (isJson) return { currentVersion: current, latestVersion: latest, updated: false }

package/src/services/clickup.js

@@ -1,4 +1,5 @@
 import http from 'node:http'
+import { randomBytes } from 'node:crypto'
 import { openBrowser } from '../utils/open-browser.js'
 import { loadConfig } from './config.js'
 
@@ -45,6 +46,10 @@ export async function storeToken(token) {
      await keytar.setPassword('devvami', TOKEN_KEY, token)
    } catch {
     // Fallback: store in config (less secure)
+    process.stderr.write(
+      'Warning: keytar unavailable. ClickUp token will be stored in plaintext.\n' +
+      'Run `dvmi auth logout` after this session on shared machines.\n',
+    )
     const config = await loadConfig()
     await saveConfig({ ...config, clickup: { ...config.clickup, token } })
   }
@@ -57,11 +62,20 @@ export async function storeToken(token) {
  * @returns {Promise<string>} Access token
  */
 export async function oauthFlow(clientId, clientSecret) {
+  const csrfState = randomBytes(16).toString('hex')
   return new Promise((resolve, reject) => {
     const server = http.createServer(async (req, res) => {
       const url = new URL(req.url ?? '/', 'http://localhost')
       const code = url.searchParams.get('code')
+      const returnedState = url.searchParams.get('state')
       if (!code) return
+      if (!returnedState || returnedState !== csrfState) {
+        res.writeHead(400)
+        res.end('State mismatch — possible CSRF attack.')
+        server.close()
+        reject(new Error('OAuth state mismatch — possible CSRF attack'))
+        return
+      }
       res.end('Authorization successful! You can close this tab.')
       server.close()
       try {
@@ -80,7 +94,7 @@ export async function oauthFlow(clientId, clientSecret) {
     server.listen(0, async () => {
       const addr = /** @type {import('node:net').AddressInfo} */ (server.address())
       const callbackUrl = `http://localhost:${addr.port}/callback`
-      const authUrl = `https://app.clickup.com/api?client_id=${clientId}&redirect_uri=${encodeURIComponent(callbackUrl)}`
+      const authUrl = `https://app.clickup.com/api?client_id=${clientId}&redirect_uri=${encodeURIComponent(callbackUrl)}&state=${csrfState}`
       await openBrowser(authUrl)
     })
     server.on('error', reject)

package/src/services/config.js

@@ -1,4 +1,4 @@
-import { readFile, writeFile, mkdir } from 'node:fs/promises'
+import { readFile, writeFile, mkdir, chmod } from 'node:fs/promises'
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
@@ -47,6 +47,7 @@ export async function saveConfig(config, configPath = CONFIG_PATH) {
     await mkdir(dir, { recursive: true })
   }
   await writeFile(configPath, JSON.stringify(config, null, 2), 'utf8')
+  await chmod(configPath, 0o600)
 }
 
 /**

package/src/services/prompts.js

@@ -1,5 +1,5 @@
 import { mkdir, writeFile, readFile, access } from 'node:fs/promises'
-import { join, dirname } from 'node:path'
+import { join, dirname, resolve, sep } from 'node:path'
 import { execa } from 'execa'
 import { createOctokit } from './github.js'
 import { which } from './shell.js'
@@ -204,6 +204,15 @@ export async function fetchPromptByPath(relativePath) {
 export async function downloadPrompt(relativePath, localDir, opts = {}) {
   const destPath = join(localDir, relativePath)
 
+  // Prevent path traversal: destPath must remain within localDir
+  const safeBase = resolve(localDir) + sep
+  if (!resolve(destPath).startsWith(safeBase)) {
+    throw new DvmiError(
+      `Invalid prompt path: "${relativePath}"`,
+      'Path must stay within the prompts directory',
+    )
+  }
+
   // Fast-path: skip without a network round-trip if file exists and no overwrite
   if (!opts.overwrite) {
     try {
@@ -245,6 +254,16 @@ export async function downloadPrompt(relativePath, localDir, opts = {}) {
  */
 export async function resolveLocalPrompt(relativePath, localDir) {
   const fullPath = join(localDir, relativePath)
+
+  // Prevent path traversal: fullPath must remain within localDir
+  const safeBase = resolve(localDir) + sep
+  if (!resolve(fullPath).startsWith(safeBase)) {
+    throw new DvmiError(
+      `Invalid prompt path: "${relativePath}"`,
+      'Path must stay within the prompts directory',
+    )
+  }
+
   let raw
   try {
     raw = await readFile(fullPath, 'utf8')

package/src/services/speckit.js

@@ -2,7 +2,10 @@ import { execa } from 'execa'
 import { which, exec } from './shell.js'
 import { DvmiError } from '../utils/errors.js'
 
-/** GitHub spec-kit package source for uv */
+/** GitHub spec-kit package source for uv.
+ * TODO: pin to a specific tagged release (e.g. #v1.x.x) once one is available upstream.
+ * Tracking: https://github.com/github/spec-kit/releases
+ */
 const SPECKIT_FROM = 'git+https://github.com/github/spec-kit.git'
 
 /**