flowcollab 0.3.10 → 0.3.11

package/bin/_client.mjs

@@ -7,7 +7,7 @@
 import { spawnSync } from 'child_process';
 import 'dotenv/config';
 import { homedir } from 'os';
-import { readFileSync, writeFileSync, mkdirSync } from 'fs';
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync } from 'fs';
 import { join } from 'path';
 
 // On Windows, Node's bundled CA store doesn't include certs added by corporate/AV
@@ -15,10 +15,16 @@ import { join } from 'path';
 // --use-system-ca so Node trusts the Windows certificate store instead.
 // Requires Node 22+; on older Node the child exits with "bad option" which tells
 // the user to upgrade.
-if (process.platform === 'win32' && !process.execArgv.includes('--use-system-ca')) {
+// FLOW_TLS_RESPAWNED guards against an infinite re-spawn loop: if a Node build
+// ever drops --use-system-ca from execArgv, the execArgv check alone would
+// re-spawn forever. The env flag survives across the spawn, so we only ever
+// re-spawn once.
+if (process.platform === 'win32'
+    && !process.execArgv.includes('--use-system-ca')
+    && process.env.FLOW_TLS_RESPAWNED !== '1') {
   const r = spawnSync(process.execPath, ['--use-system-ca', ...process.argv.slice(1)], {
     stdio: 'inherit',
-    env: process.env,
+    env: { ...process.env, FLOW_TLS_RESPAWNED: '1' },
   });
   process.exit(r.status ?? 1);
 }
@@ -54,6 +60,24 @@ function loadGlobalConfig() {
 }
 const _gc = loadGlobalConfig();
 
+// Merge `patch` into ~/.flow/config.json and persist atomically. writeFileSync's
+// `mode` is only honoured when the file is *created*, so an existing config keeps
+// its old (possibly world-readable) perms — we chmod 0o600 explicitly. The temp +
+// rename keeps the file from being truncated to garbage if the process dies mid-write.
+export function saveGlobalConfig(patch) {
+  const dir = join(homedir(), '.flow');
+  const target = join(dir, 'config.json');
+  mkdirSync(dir, { recursive: true });
+  let existing = {};
+  try { existing = JSON.parse(readFileSync(target, 'utf8')); } catch {}
+  const merged = { ...existing, ...patch };
+  const tmp = join(dir, `config.json.${process.pid}.tmp`);
+  writeFileSync(tmp, JSON.stringify(merged, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+  try { chmodSync(tmp, 0o600); } catch {}
+  renameSync(tmp, target);
+  return merged;
+}
+
 // flow-login writes apiBase + token to ~/.flow/config.json — both take precedence over
 // env vars so a stale FLOW_API_BASE / FLOW_API_TOKEN_* doesn't silently override the
 // user's authenticated session. Env vars are still honoured when config.json has no value.

package/bin/completion.mjs

@@ -16,7 +16,7 @@ const COMMANDS = [
 ];
 
 const FLAGS = {
-  pull:    ['--focus', '--milestone=', '--sync-md'],
+  pull:    ['--focus', '--milestone=', '--sync-md', '--force'],
   claim:   ['--files=', '--watch'],
   create:  ['--title=', '--type=', '--area=', '--priority=', '--due=', '--blocked-by=', '--milestone=', '--from-issue=', '--from-project-item=', '--template='],
   handoff: ['--task=', '--to=', '--context=', '--branch=', '--questions=', '--next-step='],

package/bin/flow.mjs

@@ -9,12 +9,17 @@ import { readFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { dirname } from 'path';
 
-// Mirror the _client.mjs TLS re-spawn so the child sees --use-system-ca
-// and doesn't re-spawn a third time (checks process.execArgv).
-if (process.platform === 'win32' && !process.execArgv.includes('--use-system-ca')) {
+// Mirror the _client.mjs TLS re-spawn so the child sees --use-system-ca.
+// FLOW_TLS_RESPAWNED is a belt-and-suspenders guard against an infinite loop
+// if a Node build ever drops --use-system-ca from execArgv (the env flag
+// survives the spawn, so we re-spawn at most once). The router child also
+// hands this flag to the subcommand, so _client.mjs won't re-spawn a third time.
+if (process.platform === 'win32'
+    && !process.execArgv.includes('--use-system-ca')
+    && process.env.FLOW_TLS_RESPAWNED !== '1') {
   const r = spawnSync(process.execPath, ['--use-system-ca', ...process.argv.slice(1)], {
     stdio: 'inherit',
-    env: process.env,
+    env: { ...process.env, FLOW_TLS_RESPAWNED: '1' },
   });
   process.exit(r.status ?? 1);
 }

package/bin/login.mjs

@@ -4,7 +4,7 @@
      flow-login [--server=https://flow-production-84b7.up.railway.app]
 */
 import { homedir } from 'os';
-import { mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { mkdirSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { join } from 'path';
 import { exec } from 'child_process';
 
@@ -74,11 +74,17 @@ async function main() {
       const configPath = join(dir, 'config.json');
       let existing = {};
       try { existing = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
+      // Atomic write + explicit chmod: writeFileSync's `mode` is ignored when the
+      // file already exists, so an old config would keep looser perms; the temp +
+      // rename avoids a truncated config if the process dies mid-write.
+      const tmp = join(dir, `config.json.${process.pid}.tmp`);
       writeFileSync(
-        configPath,
+        tmp,
         JSON.stringify({ ...existing, apiBase: api_base || base, token, actorId: actor_id, orgId: org_id }, null, 2) + '\n',
         { encoding: 'utf8', mode: 0o600 },
       );
+      try { chmodSync(tmp, 0o600); } catch {}
+      renameSync(tmp, configPath);
       process.stdout.write('\n\n');
       process.stdout.write(`✓ Logged in as ${actor_id}\n`);
       process.stdout.write(`  Config saved to ~/.flow/config.json\n`);

package/bin/pull.mjs

@@ -12,9 +12,8 @@
      3. Recent timeline activity on YOUR tasks (last 5 per task)
 */
 
-import { flowFetch, arg, RESOLVED_ACTOR, RESOLVED_PROJECT } from './_client.mjs';
+import { flowFetch, arg, saveGlobalConfig, RESOLVED_ACTOR, RESOLVED_PROJECT } from './_client.mjs';
 import { existsSync, readFileSync, writeFileSync } from 'fs';
-import { homedir } from 'os';
 import { join } from 'path';
 
 // Per-status age threshold (days) before pull flags a task as aging.
@@ -399,22 +398,33 @@ async function main() {
       const mdText = mdRes.raw || (typeof mdRes === 'string' ? mdRes : null);
       if (!mdText) throw new Error('empty response');
       const dest = join(process.cwd(), 'CLAUDE.md');
-      writeFileSync(dest, mdText, 'utf8');
-      process.stdout.write(`\n✓ CLAUDE.md updated (${dest})\n`);
+      const force = arg('force') !== undefined;
+      // Don't blindly clobber a CLAUDE.md that has local edits — back it up first
+      // (unless --force) so a sync can never silently destroy hand-written context.
+      if (existsSync(dest) && !force) {
+        const current = readFileSync(dest, 'utf8');
+        if (current === mdText) {
+          process.stdout.write(`\n✓ CLAUDE.md already up to date (${dest})\n`);
+        } else {
+          const backup = dest + '.bak';
+          writeFileSync(backup, current, 'utf8');
+          writeFileSync(dest, mdText, 'utf8');
+          process.stdout.write(`\n✓ CLAUDE.md updated (${dest})\n  Previous version backed up → ${backup} (pass --force to skip the backup)\n`);
+        }
+      } else {
+        writeFileSync(dest, mdText, 'utf8');
+        process.stdout.write(`\n✓ CLAUDE.md ${force && existsSync(dest) ? 'overwritten (--force)' : 'written'} (${dest})\n`);
+      }
     } catch (e) {
       process.stderr.write(`flow-pull: --sync-md failed: ${e.message}\n`);
     }
 
-    // Write project_id to global config
+    // Write project_id to global config (atomic, 0o600-enforced — see saveGlobalConfig)
     try {
       const { projects } = await flowFetch('/api/flow/projects');
       const defaultProject = projects?.find(p => p.slug === 'main') || projects?.[0];
       if (defaultProject?.id) {
-        const configPath = join(homedir(), '.flow', 'config.json');
-        let gc = {};
-        try { gc = JSON.parse(readFileSync(configPath, 'utf8')); } catch {}
-        gc.projectId = defaultProject.id;
-        writeFileSync(configPath, JSON.stringify(gc, null, 2), { encoding: 'utf8', mode: 0o600 });
+        saveGlobalConfig({ projectId: defaultProject.id });
         process.stdout.write(`  project_id → ~/.flow/config.json (project: ${defaultProject.slug})\n`);
       }
     } catch { /* non-fatal */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [