flowcollab 0.3.15 → 0.3.17

package/bin/_client.mjs

@@ -110,9 +110,11 @@ export async function flowFetch(path, { method = 'GET', body } = {}) {
     'content-type': 'application/json',
   };
   if (actingViaClaude()) headers['x-flow-acting-via'] = 'claude';
-  const org = process.env.FLOW_ORG_ID || _gc.orgId || '';
+  // CLI-5 (audit): config-first then env (consistent with token at 94 + actor at 138) so a stale env
+  // var can't override a logged-in session's org/project.
+  const org = _gc.orgId || process.env.FLOW_ORG_ID || '';
   if (org) headers['x-flow-org'] = org;
-  const proj = process.env.FLOW_PROJECT_ID || _gc.projectId || '';
+  const proj = _gc.projectId || process.env.FLOW_PROJECT_ID || '';
   if (proj) headers['x-flow-project'] = proj;
 
   const res = await fetch(url, {
@@ -179,7 +181,9 @@ export function arg(name, fallback) {
 }
 
 export function positional(idx) {
-  const pos = process.argv.slice(2).filter(a => !a.startsWith('--'));
+  // CLI-3 (audit): only filter REAL flag tokens (--word / --word=value), not a free-text positional that
+  // merely begins with '--' (e.g. a flow-comment body "-- reverted the change" was being dropped).
+  const pos = process.argv.slice(2).filter(a => !/^--[a-zA-Z][\w-]*(=|$)/.test(a));
   return pos[idx];
 }
 

package/bin/create.mjs

@@ -29,7 +29,12 @@ async function fetchGithubIssue(issueNum) {
   if (!repo) die('FLOW_GITHUB_REPO is not set. Set it in .env to use --from-issue.');
   const url = `https://api.github.com/repos/${repo}/issues/${issueNum}`;
   const res = await fetch(url, { headers: githubHeaders() });
-  if (res.status === 404) die(`GitHub Issue #${issueNum} not found in ${repo}.`);
+  // CLI-4 (audit): a PRIVATE repo with no token returns 404 (unauthenticated) — make that legible
+  // instead of a misleading "not found" (githubHeaders() omits Authorization when no token is set).
+  if (res.status === 404) {
+    const hint = process.env.FLOW_GITHUB_TOKEN ? '' : ' — if it is a PRIVATE repo, set FLOW_GITHUB_TOKEN (none is set)';
+    die(`GitHub Issue #${issueNum} not found in ${repo}${hint}.`);
+  }
   if (!res.ok) die(`GitHub API error ${res.status} fetching issue #${issueNum}.`);
   return res.json();
 }

package/bin/edit.mjs

@@ -20,7 +20,7 @@ const FIELD_MAP = {
   title:      v => ({ title: v }),
   priority:   v => ({ priority: normalizePriority(v) }),
   area:       v => ({ area: v }),
-  due:        v => ({ due_at: /^\d{4}-\d{2}-\d{2}$/.test(v) ? v + 'T12:00:00Z' : v }),
+  due:        v => { if (!/^\d{4}-\d{2}-\d{2}$/.test(v)) die(`--due must be YYYY-MM-DD (got: ${v})`); return { due_at: v + 'T12:00:00Z' }; }, // CLI-7 (audit): validate instead of sending a bad string (e.g. "tomorrow") through raw
   milestone:  v => ({ milestone: v }),
   'blocked-by': v => ({ blocked_by: v === 'null' ? [] : v.split(',').map(s => s.trim()).filter(Boolean) }), // B9: split the comma list; prefixes are resolved after the loop
 };

package/bin/pull.mjs

@@ -420,15 +420,19 @@ async function main() {
       process.stderr.write(`flow-pull: --sync-md failed: ${e.message}\n`);
     }
 
-    // Write project_id to global config (atomic, 0o600-enforced — see saveGlobalConfig)
-    try {
-      const { projects } = await flowFetch('/api/flow/projects');
-      const defaultProject = projects?.find(p => p.slug === 'main') || projects?.[0];
-      if (defaultProject?.id) {
-        saveGlobalConfig({ projectId: defaultProject.id });
-        process.stdout.write(`  project_id → ~/.flow/config.json (project: ${defaultProject.slug})\n`);
-      }
-    } catch { /* non-fatal */ }
+    // Write project_id to global config (atomic, 0o600-enforced — see saveGlobalConfig).
+    // CLI-1 (audit): only SEED it when none is resolved yet — don't clobber a project the user already
+    // selected (the old code overwrote it with 'main'/the oldest project on every --sync-md).
+    if (!RESOLVED_PROJECT) {
+      try {
+        const { projects } = await flowFetch('/api/flow/projects');
+        const defaultProject = projects?.find(p => p.slug === 'main') || projects?.[0];
+        if (defaultProject?.id) {
+          saveGlobalConfig({ projectId: defaultProject.id });
+          process.stdout.write(`  project_id → ~/.flow/config.json (project: ${defaultProject.slug})\n`);
+        }
+      } catch { /* non-fatal */ }
+    }
   }
 }
 

package/bin/scan.mjs

@@ -228,8 +228,9 @@ async function main() {
   if (all || doTodos) {
     process.stdout.write('  [todos] scanning...\n');
     const s = scanTodos(files, dir);
-    if (doTodos) { printSection('TODO / FIXME items', s); return; }
-    if (all && s.length) printSection('TODO / FIXME items', s);
+    // CLI-2 (audit): print when explicitly requested OR (all + results); NO early return, so combining
+    // focused flags (e.g. `flow-scan --todos --issues`) runs every requested scan, not only the first.
+    if (doTodos || (all && s.length)) printSection('TODO / FIXME items', s);
     else if (all) process.stdout.write('\n[todos] None found.\n');
   }
 
@@ -241,10 +242,8 @@ async function main() {
     // no FLOW_GITHUB_REPO reports "Skipped" instead of a misleading "Untracked Issues (0) None found".
     if (s === null) process.stdout.write('\n[issues] Skipped — FLOW_GITHUB_REPO not set.\n');
     else if (issueErr) process.stdout.write('\n[issues] Scan failed — check FLOW_GITHUB_REPO and token.\n');
-    else if (doIssues) { printSection('Untracked GitHub Issues', s); return; }
-    else if (all && s.length) printSection('Untracked GitHub Issues', s);
+    else if (doIssues || (all && s.length)) printSection('Untracked GitHub Issues', s); // CLI-2 (audit): no early return — flags combine
     else if (all) process.stdout.write('\n[issues] All open Issues are tracked in Flow.\n');
-    if (doIssues) return; // explicit --issues exits after its own report (Skipped/error already printed)
   }
 
   if (all || doPRs) {
@@ -254,17 +253,14 @@ async function main() {
     // B14 (audit): null/error before the explicit-flag return (see the issues block above).
     if (s === null) process.stdout.write('\n[prs] Skipped — FLOW_GITHUB_REPO not set.\n');
     else if (prErr) process.stdout.write('\n[prs] Scan failed — check FLOW_GITHUB_REPO and token.\n');
-    else if (doPRs) { printSection('Unlinked open PRs', s); return; }
-    else if (all && s.length) printSection('Unlinked open PRs', s);
+    else if (doPRs || (all && s.length)) printSection('Unlinked open PRs', s); // CLI-2 (audit): no early return — flags combine
     else if (all) process.stdout.write('\n[prs] All open PRs are linked to Flow tasks.\n');
-    if (doPRs) return; // explicit --prs exits after its own report
   }
 
   if (all || doSecurity) {
     process.stdout.write('  [security] scanning patterns...\n');
     const s = scanSecurity(dir);
-    if (doSecurity) { printSection('Security concerns', s); return; }
-    if (all && s.length) printSection('Security concerns', s);
+    if (doSecurity || (all && s.length)) printSection('Security concerns', s); // CLI-2 (audit): no early return — flags combine
     else if (all) process.stdout.write('\n[security] No common patterns found.\n');
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [