flowcollab 0.1.0

package/bin/standup.mjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+/* flow:standup — daily standup summary.
+   Shows done-since, in-progress, in-review, active agents, decisions.
+   Suitable for pasting directly into a Slack standup thread.
+
+   Usage:
+     flow-standup                    # last 24 hours
+     flow-standup --since=48      # last 48 hours
+     flow-standup --velocity      # include week-over-week velocity (last 4 weeks)
+*/
+
+import { flowFetch, arg } from './_client.mjs';
+
+function sanitizeText(s, maxLen = 200) {
+  if (!s || typeof s !== 'string') return '';
+  return s
+    .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
+    .replace(/@to:\S+/g, '[mention-stripped]')
+    .replace(/\r?\n|\r/g, ' ')
+    .trim()
+    .slice(0, maxLen);
+}
+
+function pad(s, n) { return String(s).padEnd(n).slice(0, n); }
+
+async function main() {
+  const sinceHours = Math.max(1, parseInt(arg('since') || '24'));
+  const since = new Date(Date.now() - sinceHours * 3600000);
+  const showVelocity = process.argv.includes('--velocity');
+
+  const [tasksRes, decRes, presenceRes, velRes] = await Promise.all([
+    flowFetch('/api/flow/tasks?limit=200'),
+    flowFetch('/api/flow/decisions'),
+    flowFetch('/api/flow/presence').catch(() => null),
+    showVelocity ? flowFetch('/api/flow/velocity?weeks=4').catch(() => null) : Promise.resolve(null),
+  ]);
+
+  const tasks = tasksRes.tasks || [];
+  if (tasksRes.has_more) process.stderr.write('⚠  Board has >200 tasks — standup truncated to most recently updated 200.\n');
+  const timeline = tasksRes.timeline || [];
+  const decisions = decRes.decisions || [];
+  const agents = presenceRes?.agents || [];
+  const taskById = new Map(tasks.map(t => [t.id, t]));
+  const myId = process.env.FLOW_TOKEN_OWNER_ACTOR || process.env.FLOW_TOKEN_CONTRIBUTOR_ACTOR || '';
+
+  // Done since N hours — de-dup by task (most recent close per task)
+  const doneEvents = timeline
+    .filter(ev => ev.kind === 'event' && ev.payload?.act === 'closed' && new Date(ev.ts) >= since)
+    .sort((a, b) => b.ts.localeCompare(a.ts));
+  const seenDone = new Set();
+  const doneItems = [];
+  for (const ev of doneEvents) {
+    if (!seenDone.has(ev.task_id)) { seenDone.add(ev.task_id); doneItems.push(ev); }
+  }
+
+  const inProgress = tasks.filter(t => t.status === 'in_progress');
+  const inReview = tasks.filter(t => t.status === 'in_review');
+
+  const sinceLabel = sinceHours === 24 ? 'since yesterday' : `last ${sinceHours}h`;
+  const out = [];
+  out.push(`=== Flow standup (${sinceLabel}) ===`);
+  out.push('');
+
+  out.push(`[done ${sinceLabel} — ${doneItems.length}]`);
+  if (doneItems.length) {
+    for (const ev of doneItems) {
+      const t = taskById.get(ev.task_id);
+      const ref = t ? `#${t.issue_num ?? t.id.slice(0, 6)}` : `#${ev.task_id.slice(0, 6)}`;
+      out.push(`  ${ref}  ${pad(ev.actor_id || '?', 14)}  ${sanitizeText(t?.title ?? '(unknown)', 65)}`);
+    }
+  } else {
+    out.push('  (nothing closed)');
+  }
+  out.push('');
+
+  out.push(`[in progress — ${inProgress.length}]`);
+  if (inProgress.length) {
+    for (const t of inProgress) {
+      out.push(`  #${t.issue_num ?? t.id.slice(0, 6)}  ${pad(t.assignee_id || 'unassigned', 14)}  ${sanitizeText(t.title, 60)}`);
+    }
+  } else {
+    out.push('  (nothing in progress)');
+  }
+  out.push('');
+
+  if (inReview.length) {
+    out.push(`[in review — ${inReview.length}]`);
+    for (const t of inReview) {
+      out.push(`  #${t.issue_num ?? t.id.slice(0, 6)}  ${pad(t.assignee_id || 'unassigned', 14)}  ${sanitizeText(t.title, 60)}`);
+    }
+    out.push('');
+  }
+
+  if (agents.length) {
+    out.push(`[active agents — ${agents.length} online]`);
+    for (const a of agents) {
+      const t = a.task_id ? taskById.get(a.task_id) : null;
+      const taskPart = t ? `on #${t.issue_num ?? t.id.slice(0, 6)} "${sanitizeText(t.title, 40)}"` : 'idle';
+      const flag = a.actor_id === myId ? ' ← you' : '';
+      out.push(`  ${pad(a.actor_id, 16)}  ${taskPart}${flag}`);
+    }
+    out.push('');
+  }
+
+  out.push(`[decisions pending — ${decisions.length}]`);
+  if (decisions.length) {
+    for (const d of decisions.slice(0, 5)) {
+      out.push(`  #${d.id.slice(0, 6)}  [${d.confidence}]  ${sanitizeText(d.proposal_title, 65)}`);
+    }
+    if (decisions.length > 5) out.push(`  … and ${decisions.length - 5} more`);
+  } else {
+    out.push('  (none)');
+  }
+
+  if (showVelocity && velRes?.weeks?.length) {
+    out.push('');
+    out.push('[velocity — tasks closed per week]');
+    const velWeeks = velRes.weeks;
+    const maxTotal = Math.max(...velWeeks.map(w => w.total), 1);
+    for (const w of velWeeks) {
+      const bar = '█'.repeat(Math.round(w.total / maxTotal * 12));
+      const actors = Object.entries(w.by_actor).map(([a, n]) => `${a}:${n}`).join(', ');
+      out.push(`  ${w.week}  ${String(w.total).padStart(2)} tasks  ${bar.padEnd(12)}  ${actors}`);
+    }
+    const totals = velWeeks.map(w => w.total);
+    if (totals.length >= 2) {
+      const trend = totals[totals.length - 1] - totals[0];
+      out.push(`  trend: ${trend >= 0 ? '+' : ''}${trend} tasks/week over ${velWeeks.length} weeks`);
+    }
+  }
+
+  process.stdout.write(out.join('\n') + '\n');
+}
+
+main().catch(e => { process.stderr.write('standup failed: ' + (e.message || e) + '\n'); process.exit(1); });

package/bin/status.mjs

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+/* flow:status — lightweight board summary at a glance.
+   Usage: flow-status
+*/
+
+import { flowFetch } from './_client.mjs';
+
+function pad(s, n) { return String(s).padEnd(n).slice(0, n); }
+
+function relAgo(ts) {
+  if (!ts) return '?';
+  const m = Math.round((Date.now() - new Date(ts).getTime()) / 60000);
+  if (m < 1) return 'just now';
+  if (m < 60) return `${m}m ago`;
+  return `${Math.round(m / 60)}h ago`;
+}
+
+async function main() {
+  const [tasksRes, decRes, presenceRes] = await Promise.all([
+    flowFetch('/api/flow/tasks?limit=200'),
+    flowFetch('/api/flow/decisions'),
+    flowFetch('/api/flow/presence').catch(() => null),
+  ]);
+
+  const tasks = tasksRes.tasks || [];
+  if (tasksRes.has_more) process.stderr.write('⚠  Board has >200 tasks — status truncated to most recently updated 200.\n');
+  const timeline = tasksRes.timeline || [];
+  const decisions = decRes.decisions || [];
+  const agents = presenceRes?.agents || [];
+
+  const STALE_HOURS = 4;
+  const now = Date.now();
+
+  const cols = ['backlog', 'todo', 'in_progress', 'in_review', 'done'];
+  const byStatus = Object.fromEntries(cols.map(s => [s, tasks.filter(t => t.status === s)]));
+
+  const todayStart = new Date(); todayStart.setHours(0, 0, 0, 0);
+  const doneToday = timeline.filter(ev =>
+    ev.kind === 'event' && ev.payload?.act === 'closed' && new Date(ev.ts || 0) >= todayStart
+  );
+
+  const out = [];
+  out.push('=== Flow board status ===');
+  out.push('');
+
+  out.push('[board]');
+  for (const s of cols) {
+    const arr = byStatus[s] || [];
+    if (!arr.length && s !== 'in_progress' && s !== 'in_review') continue;
+    const label = s.replace(/_/g, ' ');
+    out.push(`  ${pad(label, 14)}  ${arr.length}`);
+    if (s === 'in_progress' || s === 'in_review') {
+      for (const t of arr) {
+        const stale = t.updated_at && (now - new Date(t.updated_at).getTime()) > STALE_HOURS * 3600000;
+        const staleMark = stale ? '  ⚠ STALE' : '';
+        out.push(`    #${t.issue_num ?? t.id.slice(0, 6)}  ${pad(t.assignee_id || 'unassigned', 14)}  ${t.title.slice(0, 50)}${staleMark}`);
+      }
+    }
+  }
+  if (doneToday.length) out.push(`  ${'done today'.padEnd(14)}  ${doneToday.length}`);
+  out.push('');
+
+  if (agents.length) {
+    const taskById = new Map(tasks.map(t => [t.id, t]));
+    const inProgressByActor = {};
+    for (const t of tasks.filter(t => t.status === 'in_progress')) {
+      if (!t.assignee_id) continue;
+      if (!inProgressByActor[t.assignee_id]) inProgressByActor[t.assignee_id] = [];
+      inProgressByActor[t.assignee_id].push(t);
+    }
+    out.push(`[active agents — ${agents.length} online]`);
+    for (const a of agents) {
+      const myTasks = inProgressByActor[a.actor_id] || [];
+      const heartbeatTask = a.task_id ? taskById.get(a.task_id) : null;
+      const displayTask = heartbeatTask || myTasks[0];
+      const taskPart = displayTask
+        ? `#${displayTask.issue_num ?? displayTask.id.slice(0, 6)} "${displayTask.title.slice(0, 38)}"`
+        : 'idle';
+      const extraCount = myTasks.length > 1 ? ` +${myTasks.length - 1} more` : '';
+      out.push(`  ${pad(a.actor_id, 16)}  ${taskPart}${extraCount}  (${relAgo(a.last_seen_at)})`);
+      const claimedFiles = displayTask?.flow_files;
+      if (claimedFiles?.length) {
+        const shown = claimedFiles.slice(0, 5).join(', ');
+        const more = claimedFiles.length > 5 ? ` +${claimedFiles.length - 5} more` : '';
+        out.push(`    files: ${shown}${more}`);
+      }
+    }
+    out.push('');
+  }
+
+  out.push(`[decisions]  ${decisions.length} pending`);
+  if (decisions.length) {
+    for (const d of decisions.slice(0, 5)) {
+      out.push(`  #${d.id.slice(0, 6)}  [${d.confidence}]  ${d.proposal_title.slice(0, 65)}`);
+    }
+    if (decisions.length > 5) out.push(`  … and ${decisions.length - 5} more`);
+  }
+
+  process.stdout.write(out.join('\n') + '\n');
+}
+
+main().catch(e => { process.stderr.write('status failed: ' + (e.message || e) + '\n'); process.exit(1); });

package/bin/sync.mjs

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+/* flow:sync — mid-session delta update.
+   Shows only what changed since N minutes ago:
+   new comments on any task, resolved decisions,
+   newly claimed tasks, and currently active agents.
+
+   Usage:
+     flow-sync                    # last 60 minutes (default)
+     flow-sync --since=30     # last 30 minutes
+*/
+
+import { flowFetch, arg } from './_client.mjs';
+
+// Same sanitizer as pull.mjs — keep parity for injection defense.
+function sanitizeText(s, maxLen = 400) {
+  if (!s || typeof s !== 'string') return '';
+  return s
+    .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
+    .replace(/@to:\S+/g, '[mention-stripped]')
+    .replace(/\r?\n|\r/g, ' ↵ ')
+    .trim()
+    .slice(0, maxLen);
+}
+
+function relAgo(ts) {
+  if (!ts) return '?';
+  const m = Math.round((Date.now() - new Date(ts).getTime()) / 60000);
+  if (m < 1) return 'just now';
+  if (m < 60) return `${m}m ago`;
+  return `${Math.round(m / 60)}h ago`;
+}
+
+function pad(s, n) { return String(s).padEnd(n).slice(0, n); }
+
+async function main() {
+  const sinceMinutes = Math.max(1, parseInt(arg('since') || '60'));
+  const r = await flowFetch(`/api/flow/sync?since_minutes=${sinceMinutes}`);
+
+  const out = [];
+  out.push(`=== Flow sync (last ${r.since_minutes}m — since ${new Date(r.since).toISOString().replace('T', ' ').slice(0, 16)} UTC) ===`);
+
+  // Active agents
+  if (r.agents?.length) {
+    const myId = process.env.FLOW_TOKEN_OWNER_ACTOR || process.env.FLOW_TOKEN_CONTRIBUTOR_ACTOR || '';
+    const others = r.agents.filter(a => a.actor_id !== myId);
+    if (others.length) {
+      out.push(`\n[active agents — ${others.length} online]`);
+      for (const a of others) {
+        const taskPart = a.task_ref != null
+          ? `working on #${a.task_ref}${a.task_title ? ' "' + sanitizeText(a.task_title, 50) + '"' : ''}`
+          : 'idle';
+        out.push(`  ${pad(a.actor_id, 16)}  ${taskPart}  (${relAgo(a.last_seen_at)})`);
+      }
+    }
+  }
+
+  // New comments
+  if (r.new_comments?.length) {
+    out.push(`\n[new comments — ${r.new_comments.length}]`);
+    for (const c of r.new_comments) {
+      const title = c.task_title ? `"${sanitizeText(c.task_title, 55)}"` : '(unknown task)';
+      out.push(`  #${c.task_ref}  ${title}  (${relAgo(c.ts)}, from ${c.actor_id})`);
+      out.push(`    └─ <comment_from_untrusted_user>${sanitizeText(c.body)}</comment_from_untrusted_user>`);
+    }
+  }
+
+  // Resolved decisions
+  if (r.resolved_decisions?.length) {
+    out.push(`\n[decisions resolved — ${r.resolved_decisions.length}]`);
+    for (const d of r.resolved_decisions) {
+      const ts = d.approved_at || d.rejected_at || '';
+      const when = relAgo(ts);
+      if (d.status === 'approved') {
+        out.push(`  APPROVED  "${sanitizeText(d.proposal_title, 70)}"  (${when}, by ${d.approved_by || '?'})`);
+      } else {
+        const reason = d.rejected_reason
+          ? `  — "${sanitizeText(d.rejected_reason, 60)}"`
+          : '';
+        out.push(`  REJECTED  "${sanitizeText(d.proposal_title, 70)}"${reason}  (${when})`);
+      }
+    }
+  }
+
+  // Newly claimed by others
+  if (r.newly_claimed?.length) {
+    out.push(`\n[newly claimed — ${r.newly_claimed.length}]`);
+    for (const c of r.newly_claimed) {
+      const title = c.task_title ? `"${sanitizeText(c.task_title, 55)}"` : '(unknown task)';
+      out.push(`  #${c.task_ref}  ${title}  → ${c.claimed_by}  (${relAgo(c.ts)})`);
+    }
+  }
+
+  const hasActivity = r.new_comments?.length || r.resolved_decisions?.length || r.newly_claimed?.length;
+  if (!hasActivity) {
+    out.push('\nNo new activity in the last ' + r.since_minutes + ' minutes.');
+  }
+
+  out.push('\nRun `flow-pull` for a full board snapshot, or `flow-claim <id>` to pick up work.');
+
+  process.stdout.write(out.join('\n') + '\n');
+}
+
+main().catch(e => { process.stderr.write('sync failed: ' + (e.message || e) + '\n'); process.exit(1); });

package/bin/unblock.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/* flow:unblock — clear the blocked_by dependency on a task.
+   Usage: flow-unblock <task_id>
+*/
+
+import { flowFetch, resolveTaskId, positional, die } from './_client.mjs';
+
+async function main() {
+  const raw = positional(0);
+  if (!raw) die('Usage: flow-unblock <task_id>');
+
+  const id = await resolveTaskId(raw);
+  const res = await flowFetch(`/api/flow/tasks/${id}`, { method: 'PATCH', body: { blocked_by: [] } });
+
+  const title = res.task?.title || id.slice(0, 8);
+  process.stdout.write(`Unblocked: ${title}\n`);
+}
+
+main().catch(e => die(e.message || e));

package/bin/whoami.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+/* flow:whoami — print current session identity and verify API connectivity.
+   Usage: flow-whoami
+   Run at session start to confirm you're acting as the right actor with a live token.
+*/
+
+import 'dotenv/config';
+import { flowFetch } from './_client.mjs';
+
+async function main() {
+  const actor = process.env.FLOW_DEFAULT_ASSIGNEE || '(not set — add FLOW_DEFAULT_ASSIGNEE to .env)';
+  const base = process.env.FLOW_API_BASE || 'http://localhost:3000';
+  const actingVia = (process.env.FLOW_ACTING_VIA || 'claude').toLowerCase();
+
+  const ownerToken = process.env.FLOW_API_TOKEN_OWNER || '';
+  const contribToken = process.env.FLOW_API_TOKEN_CONTRIBUTOR || '';
+  const tokenKind = ownerToken ? 'owner' : contribToken ? 'contributor' : 'none';
+  const rawToken = ownerToken || contribToken;
+  const tokenDisplay = rawToken.length > 4
+    ? `${'*'.repeat(rawToken.length - 4)}${rawToken.slice(-4)}`
+    : rawToken ? '****' : '(missing)';
+
+  process.stdout.write('Flow identity:\n');
+  process.stdout.write(`  actor:      ${actor}\n`);
+  process.stdout.write(`  token:      ${tokenKind} ${tokenDisplay}\n`);
+  process.stdout.write(`  api_base:   ${base}\n`);
+  process.stdout.write(`  acting_via: ${actingVia}\n`);
+
+  try {
+    const res = await flowFetch('/api/flow/tasks?limit=200');
+    const count = res.has_more ? '200+' : (res.tasks || []).length;
+    process.stdout.write(`  status:     connected (${count} task${count === 1 ? '' : 's'} visible)\n`);
+  } catch (e) {
+    process.stdout.write(`  status:     ERROR — ${e.message}\n`);
+    process.exit(1);
+  }
+}
+
+main().catch(e => { process.stderr.write('flow-cli: ' + (e.message || e) + '\n'); process.exit(1); });

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "flowcollab",
+  "version": "0.1.0",
+  "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
+  "type": "module",
+  "files": [
+    "bin/"
+  ],
+  "bin": {
+    "flow-create": "bin/create.mjs",
+    "flow-pull": "bin/pull.mjs",
+    "flow-claim": "bin/claim.mjs",
+    "flow-comment": "bin/comment.mjs",
+    "flow-close": "bin/close.mjs",
+    "flow-propose": "bin/propose.mjs",
+    "flow-approve": "bin/approve.mjs",
+    "flow-reject": "bin/reject.mjs",
+    "flow-assign": "bin/assign.mjs",
+    "flow-decisions": "bin/decisions.mjs",
+    "flow-ping": "bin/ping.mjs",
+    "flow-pr": "bin/pr.mjs",
+    "flow-whoami": "bin/whoami.mjs",
+    "flow-sync": "bin/sync.mjs",
+    "flow-heartbeat": "bin/heartbeat.mjs",
+    "flow-status": "bin/status.mjs",
+    "flow-handoff": "bin/handoff.mjs",
+    "flow-standup": "bin/standup.mjs",
+    "flow-search": "bin/search.mjs",
+    "flow-init": "bin/init.mjs",
+    "flow-project": "bin/project.mjs",
+    "flow-close-sprint": "bin/close-sprint.mjs",
+    "flow-review": "bin/review.mjs",
+    "flow-login": "bin/login.mjs",
+    "flow-edit": "bin/edit.mjs",
+    "flow-unblock": "bin/unblock.mjs",
+    "flow-log": "bin/log.mjs",
+    "flow-completion": "bin/completion.mjs"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "dev": "node scripts/build.mjs --watch",
+    "start": "node scripts/build.mjs && node --use-system-ca server.js",
+    "start:prod": "node scripts/build.mjs && node server.js"
+  },
+  "dependencies": {
+    "dotenv": "^16.4.7"
+  },
+  "devDependencies": {
+    "@supabase/supabase-js": "^2.49.4",
+    "esbuild": "^0.28.0",
+    "express": "^4.0.0 || ^5.0.0",
+    "express-rate-limit": "^7.5.0",
+    "helmet": "^8.0.0",
+    "stripe": "^22.2.0",
+    "zod": "^3.24.1"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "license": "UNLICENSED"
+}