flowcollab 0.3.14 → 0.3.16

package/bin/_client.mjs

@@ -44,14 +44,21 @@ process.on('exit', () => {
 });
 
 if (!_uc.checkedAt || (Date.now() - _uc.checkedAt) > 86_400_000) {
-  fetch('https://registry.npmjs.org/flowcollab/latest', { signal: AbortSignal.timeout(4000) })
+  // B21 (audit): AbortSignal.timeout keeps a 4s timer alive that pins the event loop open AFTER the
+  // command is done (up to 4s of dead time on exit). Use a manual controller with an UNREF'd timer so
+  // the process can exit as soon as the real work finishes — the check is fire-and-forget either way.
+  const _uctrl = new AbortController();
+  const _utimer = setTimeout(() => _uctrl.abort(), 4000);
+  _utimer.unref?.();
+  fetch('https://registry.npmjs.org/flowcollab/latest', { signal: _uctrl.signal })
     .then(r => r.json())
     .then(({ version: latest }) => {
       mkdirSync(join(homedir(), '.flow'), { recursive: true });
       writeFileSync(_updateCache, JSON.stringify({ checkedAt: Date.now(), latest }));
       _uc = { checkedAt: Date.now(), latest };
     })
-    .catch(() => {});
+    .catch(() => {})
+    .finally(() => clearTimeout(_utimer));
 }
 
 function loadGlobalConfig() {
@@ -155,6 +162,7 @@ export function sanitizeText(s, maxLen = 120) {
     .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
     .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
     .replace(/@to:\S+/g, '[mention-stripped]')
+    .replace(/comment_from_untrusted_user/gi, '[marker]') // S4: neutralize the untrusted-text fence marker
     .replace(/\r?\n|\r/g, ' ')
     .trim()
     .slice(0, maxLen);

package/bin/create.mjs

@@ -21,7 +21,7 @@
 */
 
 import 'dotenv/config';
-import { flowFetch, arg, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, arg, die } from './_client.mjs';
 import { githubHeaders, fetchProjectItem, labelsToType } from './_github.mjs';
 
 async function fetchGithubIssue(issueNum) {
@@ -84,6 +84,12 @@ async function main() {
   const title = arg('title') || prefill.title;
   if (!title) die('Required: --title="..." (or use --from-issue=<num> / --template=<id>)\n\nUsage: flow-create --title="..." [--type=bug|feature|chore|docs] [--area=<area>] [--priority=P0-now|P1-soon|P2-later] [--status=backlog|todo] [--assignee=<actor_id>] [--from-issue=<num>] [--template=<id>]');
 
+  // B9 (audit): --blocked-by accepts a comma list + 6-char id prefixes (like the positional id
+  // everywhere else) — resolve each to a full UUID before sending; the server expects array(uuid).
+  const blockedBy = arg('blocked-by')
+    ? await Promise.all(arg('blocked-by').split(',').map(s => s.trim()).filter(Boolean).map(x => resolveTaskId(x)))
+    : null;
+
   const body = {
     ...prefill,
     title,
@@ -93,8 +99,8 @@ async function main() {
     ...(arg('priority')   ? { priority:          arg('priority')   } : {}),
     ...(arg('status')     ? { status:            arg('status')     } : {}),
     ...(arg('assignee')   ? { assignee_id:       arg('assignee')   } : {}),
-    ...(arg('due')        ? (() => { const d = new Date(arg('due')); if (isNaN(d.getTime())) die(`Invalid --due date: "${arg('due')}". Use YYYY-MM-DD format.`); return { due_at: d.toISOString() }; })() : {}),
-    ...(arg('blocked-by') ? { blocked_by: arg('blocked-by').split(',').map(s => s.trim()).filter(Boolean) } : {}),
+    ...(arg('due')        ? (() => { const v = arg('due'); if (/^\d{4}-\d{2}-\d{2}$/.test(v)) return { due_at: v + 'T12:00:00Z' }; const d = new Date(v); if (isNaN(d.getTime())) die(`Invalid --due date: "${v}". Use YYYY-MM-DD format.`); return { due_at: d.toISOString() }; })() : {}), // B15: noon-UTC for a date-only value (new Date('YYYY-MM-DD') is midnight UTC → shows the previous day for negative-UTC users)
+    ...(blockedBy ? { blocked_by: blockedBy } : {}),
     ...(arg('milestone')  ? { milestone:         arg('milestone')  } : {}),
   };
 

package/bin/decisions.mjs

@@ -87,16 +87,32 @@ async function watch(rawId) {
   const short = `#${id.slice(0, 6)}`;
   process.stdout.write(`Watching decision ${short} — polling every ${interval}s${timeout ? `, timeout ${timeout}s` : ' (no timeout)'}.\n`);
 
+  let consecutiveErrors = 0;            // B4: transient blips must not abandon the watch
+  const MAX_CONSECUTIVE_ERRORS = 5;
   for (;;) {
     let decision;
     try {
       const r = await flowFetch(`/api/flow/decisions/${id}`);
       decision = r.decision;
+      consecutiveErrors = 0;            // clean poll — reset the budget
     } catch (e) {
-      // 404 means the decision is gone (deleted/org mismatch) — treat as error.
-      process.stderr.write(`flow: watch failed for ${short}: ${e.message || e}\n`);
-      process.exitCode = 4;
-      return;
+      const msg = e?.message || String(e);
+      if (e?.status === 404 || /\b404\b/.test(msg)) {
+        // Definitively gone (deleted / org mismatch) — fatal.
+        process.stderr.write(`flow: decision ${short} not found: ${msg}\n`);
+        process.exitCode = 4;
+        return;
+      }
+      // B4 (audit): a transient network/5xx blip must NOT abandon a task a human may have just
+      // approved — warn and keep polling, giving up only after several consecutive failures.
+      if (++consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+        process.stderr.write(`flow: watch ${short} gave up after ${consecutiveErrors} consecutive errors (last: ${msg}).\n`);
+        process.exitCode = 4;
+        return;
+      }
+      process.stderr.write(`flow: watch ${short} transient error ${consecutiveErrors}/${MAX_CONSECUTIVE_ERRORS} (${msg}) — retrying in ${interval}s.\n`);
+      await sleep(interval * 1000);
+      continue;
     }
 
     const status = decision?.status;

package/bin/edit.mjs

@@ -22,7 +22,7 @@ const FIELD_MAP = {
   area:       v => ({ area: v }),
   due:        v => ({ due_at: /^\d{4}-\d{2}-\d{2}$/.test(v) ? v + 'T12:00:00Z' : v }),
   milestone:  v => ({ milestone: v }),
-  'blocked-by': v => ({ blocked_by: v === 'null' ? [] : [v] }),
+  'blocked-by': v => ({ blocked_by: v === 'null' ? [] : v.split(',').map(s => s.trim()).filter(Boolean) }), // B9: split the comma list; prefixes are resolved after the loop
 };
 
 async function main() {
@@ -35,6 +35,12 @@ async function main() {
     if (val !== undefined && val !== '') Object.assign(changes, toField(val));
   }
 
+  // B9 (audit): --blocked-by accepts a comma list + 6-char id prefixes (like the positional id
+  // everywhere else) — resolve each to a full UUID before sending; the server expects array(uuid).
+  if (Array.isArray(changes.blocked_by) && changes.blocked_by.length) {
+    changes.blocked_by = await Promise.all(changes.blocked_by.map(x => resolveTaskId(x)));
+  }
+
   if (Object.keys(changes).length === 0) die('No fields to update. Pass at least one flag like --title="..." or --priority=P1-soon');
 
   const id = await resolveTaskId(raw);

package/bin/pull.mjs

@@ -33,6 +33,7 @@ function sanitizeText(s, maxLen = 400) {
     .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')             // strip ANSI escape sequences
     .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')  // strip control chars (keep \t \n)
     .replace(/@to:\S+/g, '[mention-stripped]')           // prevent nested @to: injection
+    .replace(/comment_from_untrusted_user/gi, '[marker]') // S4: neutralize the wrapper marker so a comment can't inject </comment_from_untrusted_user> and break out of the untrusted-text fence
     .replace(/\r?\n|\r/g, ' ↵ ')                         // collapse newlines to visible marker
     .trim()
     .slice(0, maxLen);
@@ -79,7 +80,7 @@ function fmtTimeline(ev, taskTitle) {
   const ts = _d && !isNaN(_d) ? _d.toISOString().replace('T', ' ').slice(0, 16) : '?';
   const who = ev.slot_label || ev.actor_id || '?';
   const actingAs = ev.acting_as_id && ev.acting_as_id !== ev.actor_id ? `(as ${ev.acting_as_id})` : '';
-  const body = extractBody(ev);
+  const body = sanitizeText(extractBody(ev)); // S4: sanitize BEFORE wrapping — the marker neutralization can't fence text that was interpolated raw
   // Wrap user-generated comments in XML markers so Claude distinguishes them
   // from structured pull output and cannot be injected via timeline text.
   const wrapped = ev.kind === 'comment'
@@ -165,8 +166,8 @@ async function main() {
         const taskRef = t ? `#${t.issue_num ?? t.id.slice(0, 6)}` : `#${ev.task_id.slice(0, 6)}`;
         const _md = ev.ts ? new Date(ev.ts) : null;
         const ts = _md && !isNaN(_md) ? _md.toISOString().replace('T', ' ').slice(0, 16) : '?';
-        out.push(`  ${taskRef}  ${title}  (${ts}, from ${ev.actor_id || '?'})`);
-        out.push(`    └─ <comment_from_untrusted_user>${extractBody(ev)}</comment_from_untrusted_user>`);
+        out.push(`  ${taskRef}  ${sanitizeText(title, 80)}  (${ts}, from ${ev.actor_id || '?'})`);
+        out.push(`    └─ <comment_from_untrusted_user>${sanitizeText(extractBody(ev))}</comment_from_untrusted_user>`); // S4: sanitize before wrapping
       });
       if (mentions.length > 10) out.push(`  … and ${mentions.length - 10} older mention${mentions.length - 10 === 1 ? '' : 's'} not shown`);
       out.push('');
@@ -419,15 +420,19 @@ async function main() {
       process.stderr.write(`flow-pull: --sync-md failed: ${e.message}\n`);
     }
 
-    // Write project_id to global config (atomic, 0o600-enforced — see saveGlobalConfig)
-    try {
-      const { projects } = await flowFetch('/api/flow/projects');
-      const defaultProject = projects?.find(p => p.slug === 'main') || projects?.[0];
-      if (defaultProject?.id) {
-        saveGlobalConfig({ projectId: defaultProject.id });
-        process.stdout.write(`  project_id → ~/.flow/config.json (project: ${defaultProject.slug})\n`);
-      }
-    } catch { /* non-fatal */ }
+    // Write project_id to global config (atomic, 0o600-enforced — see saveGlobalConfig).
+    // CLI-1 (audit): only SEED it when none is resolved yet — don't clobber a project the user already
+    // selected (the old code overwrote it with 'main'/the oldest project on every --sync-md).
+    if (!RESOLVED_PROJECT) {
+      try {
+        const { projects } = await flowFetch('/api/flow/projects');
+        const defaultProject = projects?.find(p => p.slug === 'main') || projects?.[0];
+        if (defaultProject?.id) {
+          saveGlobalConfig({ projectId: defaultProject.id });
+          process.stdout.write(`  project_id → ~/.flow/config.json (project: ${defaultProject.slug})\n`);
+        }
+      } catch { /* non-fatal */ }
+    }
   }
 }
 

package/bin/scan.mjs

@@ -96,13 +96,28 @@ async function fetchGitHubIssues(repo) {
   return all;
 }
 
+// B14 (audit): the coverage set must span ALL tasks, not just the first 500 — else an issue/PR
+// tracked by a task beyond page 1 reads as "untracked" and prompts a duplicate tracking task.
+async function fetchAllTasksForCoverage() {
+  const all = [];
+  let cursor = null;
+  for (let i = 0; i < 50; i++) {            // hard cap (50 * 500 = 25k tasks)
+    const qs = cursor ? `?limit=500&cursor=${encodeURIComponent(cursor)}` : '?limit=500';
+    const resp = await flowFetch('/api/flow/tasks' + qs);
+    all.push(...(resp.tasks || []));
+    if (!resp.has_more || !resp.next_cursor) break;
+    cursor = resp.next_cursor;
+  }
+  return all;
+}
+
 async function scanIssues(repo) {
   if (!repo) return null;
-  const [ghIssues, flowResp] = await Promise.all([
+  const [ghIssues, allTasks] = await Promise.all([
     fetchGitHubIssues(repo),
-    flowFetch('/api/flow/tasks?limit=500'),
+    fetchAllTasksForCoverage(),
   ]);
-  const tracked = new Set((flowResp.tasks || []).filter(t => t.github_issue_num).map(t => t.github_issue_num));
+  const tracked = new Set(allTasks.filter(t => t.github_issue_num).map(t => t.github_issue_num));
   const untracked = ghIssues.filter(i => !tracked.has(i.number));
   return untracked.slice(0, 15).map(i => {
     const labels = (i.labels || []).map(l => l.name.toLowerCase());
@@ -128,11 +143,11 @@ async function fetchGitHubPRs(repo) {
 
 async function scanPRs(repo) {
   if (!repo) return null;
-  const [ghPRs, flowResp] = await Promise.all([
+  const [ghPRs, allTasks] = await Promise.all([
     fetchGitHubPRs(repo),
-    flowFetch('/api/flow/tasks?limit=500'),
+    fetchAllTasksForCoverage(),
   ]);
-  const trackedPRs = new Set((flowResp.tasks || []).filter(t => t.pr_num).map(t => t.pr_num));
+  const trackedPRs = new Set(allTasks.filter(t => t.pr_num).map(t => t.pr_num));
   const unlinked = ghPRs.filter(pr => !trackedPRs.has(pr.number));
   return unlinked.slice(0, 10).map(pr => {
     const title = pr.title.replace(/"/g, '\\"').slice(0, 55);
@@ -222,22 +237,27 @@ async function main() {
     process.stdout.write('  [issues] fetching GitHub Issues vs Flow tasks...\n');
     let s, issueErr = false;
     try { s = await scanIssues(repo); } catch (e) { process.stdout.write(`  [issues] Error: ${e.message}\n`); issueErr = true; s = []; }
-    if (doIssues) { printSection('Untracked GitHub Issues', s || []); return; }
+    // B14 (audit): handle the no-repo / error cases BEFORE the explicit-flag return, so `--issues` with
+    // no FLOW_GITHUB_REPO reports "Skipped" instead of a misleading "Untracked Issues (0) None found".
     if (s === null) process.stdout.write('\n[issues] Skipped — FLOW_GITHUB_REPO not set.\n');
     else if (issueErr) process.stdout.write('\n[issues] Scan failed — check FLOW_GITHUB_REPO and token.\n');
+    else if (doIssues) { printSection('Untracked GitHub Issues', s); return; }
     else if (all && s.length) printSection('Untracked GitHub Issues', s);
     else if (all) process.stdout.write('\n[issues] All open Issues are tracked in Flow.\n');
+    if (doIssues) return; // explicit --issues exits after its own report (Skipped/error already printed)
   }
 
   if (all || doPRs) {
     process.stdout.write('  [prs] fetching open PRs vs Flow tasks...\n');
     let s, prErr = false;
     try { s = await scanPRs(repo); } catch (e) { process.stdout.write(`  [prs] Error: ${e.message}\n`); prErr = true; s = []; }
-    if (doPRs) { printSection('Unlinked open PRs', s || []); return; }
+    // B14 (audit): null/error before the explicit-flag return (see the issues block above).
     if (s === null) process.stdout.write('\n[prs] Skipped — FLOW_GITHUB_REPO not set.\n');
     else if (prErr) process.stdout.write('\n[prs] Scan failed — check FLOW_GITHUB_REPO and token.\n');
+    else if (doPRs) { printSection('Unlinked open PRs', s); return; }
     else if (all && s.length) printSection('Unlinked open PRs', s);
     else if (all) process.stdout.write('\n[prs] All open PRs are linked to Flow tasks.\n');
+    if (doPRs) return; // explicit --prs exits after its own report
   }
 
   if (all || doSecurity) {

package/bin/standup.mjs

@@ -17,6 +17,7 @@ function sanitizeText(s, maxLen = 200) {
     .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
     .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
     .replace(/@to:\S+/g, '[mention-stripped]')
+    .replace(/comment_from_untrusted_user/gi, '[marker]') // S4: neutralize the untrusted-text fence marker
     .replace(/\r?\n|\r/g, ' ')
     .trim()
     .slice(0, maxLen);

package/bin/sync.mjs

@@ -18,6 +18,7 @@ function sanitizeText(s, maxLen = 400) {
     .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
     .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
     .replace(/@to:\S+/g, '[mention-stripped]')
+    .replace(/comment_from_untrusted_user/gi, '[marker]') // S4: neutralize the untrusted-text fence marker
     .replace(/\r?\n|\r/g, ' ↵ ')
     .trim()
     .slice(0, maxLen);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.14",
+  "version": "0.3.16",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [
@@ -48,7 +48,8 @@
     "test:ui": "node --test test/*.browser.test.mjs"
   },
   "dependencies": {
-    "dotenv": "^16.4.7"
+    "dotenv": "^16.4.7",
+    "web-push": "^3.6.7"
   },
   "devDependencies": {
     "@supabase/supabase-js": "^2.49.4",