devvami 1.1.0 → 1.1.2

package/oclif.manifest.json

@@ -1498,5 +1498,5 @@
       ]
     }
   },
-  "version": "1.1.0"
+  "version": "1.1.2"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "devvami",
   "description": "DevEx CLI for developers and teams — manage repos, PRs, pipelines, tasks, and costs from the terminal",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "author": "",
   "type": "module",
   "bin": {
@@ -128,6 +128,7 @@
     "commit": "git-cz",
     "release": "semantic-release",
     "release:dry-run": "semantic-release --dry-run",
+    "version:sync": "node scripts/sync-version.js",
     "lint": "eslint src/ tests/",
     "lint:fix": "eslint src/ tests/ --fix",
     "format": "prettier --write src/ tests/",

package/src/commands/init.js

@@ -80,6 +80,8 @@ export default class Init extends Command {
     let config = await loadConfig()
 
      if (!configExists() && !isDryRun && !isJson) {
+       // Stop the spinner before interactive prompts to avoid TTY contention on macOS
+       configSpinner?.stop()
        const useOrg = await confirm({ message: 'Do you use a GitHub organization? (y/n)', default: true })
        let org = ''
        if (useOrg) {

package/src/commands/open.js

@@ -68,7 +68,7 @@ export default class Open extends Command {
     if (isJson) return result
 
     await openBrowser(url)
-    this.log(chalk.green('✓') + ` Opened ${url}`)
+    this.log(chalk.green('✓') + ' Opened in browser')
 
     return result
   }

package/src/commands/upgrade.js

@@ -22,6 +22,11 @@ export default class Upgrade extends Command {
     const { hasUpdate, current, latest } = await checkForUpdate({ force: true })
     spinner?.stop()
 
+    // Guard against malformed version strings from the GitHub Releases API
+    if (latest && !/^v?\d+\.\d+\.\d+(-[\w.]+)?(\+[\w.]+)?$/.test(latest)) {
+      this.error(`Invalid version received from releases API: "${latest}" — update aborted`)
+    }
+
     if (!hasUpdate) {
       const msg = `You're already on the latest version (${current})`
       if (isJson) return { currentVersion: current, latestVersion: latest, updated: false }

package/src/services/clickup.js

@@ -1,4 +1,5 @@
 import http from 'node:http'
+import { randomBytes } from 'node:crypto'
 import { openBrowser } from '../utils/open-browser.js'
 import { loadConfig } from './config.js'
 
@@ -45,6 +46,10 @@ export async function storeToken(token) {
      await keytar.setPassword('devvami', TOKEN_KEY, token)
    } catch {
     // Fallback: store in config (less secure)
+    process.stderr.write(
+      'Warning: keytar unavailable. ClickUp token will be stored in plaintext.\n' +
+      'Run `dvmi auth logout` after this session on shared machines.\n',
+    )
     const config = await loadConfig()
     await saveConfig({ ...config, clickup: { ...config.clickup, token } })
   }
@@ -57,11 +62,20 @@ export async function storeToken(token) {
  * @returns {Promise<string>} Access token
  */
 export async function oauthFlow(clientId, clientSecret) {
+  const csrfState = randomBytes(16).toString('hex')
   return new Promise((resolve, reject) => {
     const server = http.createServer(async (req, res) => {
       const url = new URL(req.url ?? '/', 'http://localhost')
       const code = url.searchParams.get('code')
+      const returnedState = url.searchParams.get('state')
       if (!code) return
+      if (!returnedState || returnedState !== csrfState) {
+        res.writeHead(400)
+        res.end('State mismatch — possible CSRF attack.')
+        server.close()
+        reject(new Error('OAuth state mismatch — possible CSRF attack'))
+        return
+      }
       res.end('Authorization successful! You can close this tab.')
       server.close()
       try {
@@ -80,7 +94,7 @@ export async function oauthFlow(clientId, clientSecret) {
     server.listen(0, async () => {
       const addr = /** @type {import('node:net').AddressInfo} */ (server.address())
       const callbackUrl = `http://localhost:${addr.port}/callback`
-      const authUrl = `https://app.clickup.com/api?client_id=${clientId}&redirect_uri=${encodeURIComponent(callbackUrl)}`
+      const authUrl = `https://app.clickup.com/api?client_id=${clientId}&redirect_uri=${encodeURIComponent(callbackUrl)}&state=${csrfState}`
       await openBrowser(authUrl)
     })
     server.on('error', reject)

package/src/services/config.js

@@ -1,4 +1,4 @@
-import { readFile, writeFile, mkdir } from 'node:fs/promises'
+import { readFile, writeFile, mkdir, chmod } from 'node:fs/promises'
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { homedir } from 'node:os'
@@ -47,6 +47,7 @@ export async function saveConfig(config, configPath = CONFIG_PATH) {
     await mkdir(dir, { recursive: true })
   }
   await writeFile(configPath, JSON.stringify(config, null, 2), 'utf8')
+  await chmod(configPath, 0o600)
 }
 
 /**

package/src/services/prompts.js

@@ -1,5 +1,5 @@
 import { mkdir, writeFile, readFile, access } from 'node:fs/promises'
-import { join, dirname } from 'node:path'
+import { join, dirname, resolve, sep } from 'node:path'
 import { execa } from 'execa'
 import { createOctokit } from './github.js'
 import { which } from './shell.js'
@@ -204,6 +204,15 @@ export async function fetchPromptByPath(relativePath) {
 export async function downloadPrompt(relativePath, localDir, opts = {}) {
   const destPath = join(localDir, relativePath)
 
+  // Prevent path traversal: destPath must remain within localDir
+  const safeBase = resolve(localDir) + sep
+  if (!resolve(destPath).startsWith(safeBase)) {
+    throw new DvmiError(
+      `Invalid prompt path: "${relativePath}"`,
+      'Path must stay within the prompts directory',
+    )
+  }
+
   // Fast-path: skip without a network round-trip if file exists and no overwrite
   if (!opts.overwrite) {
     try {
@@ -245,6 +254,16 @@ export async function downloadPrompt(relativePath, localDir, opts = {}) {
  */
 export async function resolveLocalPrompt(relativePath, localDir) {
   const fullPath = join(localDir, relativePath)
+
+  // Prevent path traversal: fullPath must remain within localDir
+  const safeBase = resolve(localDir) + sep
+  if (!resolve(fullPath).startsWith(safeBase)) {
+    throw new DvmiError(
+      `Invalid prompt path: "${relativePath}"`,
+      'Path must stay within the prompts directory',
+    )
+  }
+
   let raw
   try {
     raw = await readFile(fullPath, 'utf8')

package/src/services/speckit.js

@@ -2,7 +2,10 @@ import { execa } from 'execa'
 import { which, exec } from './shell.js'
 import { DvmiError } from '../utils/errors.js'
 
-/** GitHub spec-kit package source for uv */
+/** GitHub spec-kit package source for uv.
+ * TODO: pin to a specific tagged release (e.g. #v1.x.x) once one is available upstream.
+ * Tracking: https://github.com/github/spec-kit/releases
+ */
 const SPECKIT_FROM = 'git+https://github.com/github/spec-kit.git'
 
 /**