flowcollab 0.3.16 → 0.3.18

package/bin/_client.mjs

@@ -9,6 +9,7 @@ import 'dotenv/config';
 import { homedir } from 'os';
 import { readFileSync, writeFileSync, mkdirSync, chmodSync, renameSync } from 'fs';
 import { join } from 'path';
+import { get as httpsGet } from 'https';
 
 // On Windows, Node's bundled CA store doesn't include certs added by corporate/AV
 // TLS inspection software, causing fetch() to throw "fetch failed". Re-spawn with
@@ -44,21 +45,31 @@ process.on('exit', () => {
 });
 
 if (!_uc.checkedAt || (Date.now() - _uc.checkedAt) > 86_400_000) {
-  // B21 (audit): AbortSignal.timeout keeps a 4s timer alive that pins the event loop open AFTER the
-  // command is done (up to 4s of dead time on exit). Use a manual controller with an UNREF'd timer so
-  // the process can exit as soon as the real work finishes — the check is fire-and-forget either way.
-  const _uctrl = new AbortController();
-  const _utimer = setTimeout(() => _uctrl.abort(), 4000);
-  _utimer.unref?.();
-  fetch('https://registry.npmjs.org/flowcollab/latest', { signal: _uctrl.signal })
-    .then(r => r.json())
-    .then(({ version: latest }) => {
-      mkdirSync(join(homedir(), '.flow'), { recursive: true });
-      writeFileSync(_updateCache, JSON.stringify({ checkedAt: Date.now(), latest }));
-      _uc = { checkedAt: Date.now(), latest };
-    })
-    .catch(() => {})
-    .finally(() => clearTimeout(_utimer));
+  // B21/CLI-6 (audit): a pending network request pins the event loop open AFTER the command is done.
+  // fetch()'s undici socket can't be unref'd per-request, so use https.get + UNREF the socket — the
+  // request never delays the CLI's exit. Stamp checkedAt SYNCHRONOUSLY first so the 24h gate holds
+  // even for instant commands that exit before the request finishes (else unref'ing would re-check
+  // every run); the request just updates `latest` in the background when it completes.
+  try {
+    mkdirSync(join(homedir(), '.flow'), { recursive: true });
+    writeFileSync(_updateCache, JSON.stringify({ checkedAt: Date.now(), latest: _uc.latest ?? null }));
+  } catch {}
+  try {
+    const _ureq = httpsGet('https://registry.npmjs.org/flowcollab/latest', { headers: { accept: 'application/json' } }, (res) => {
+      if (res.statusCode !== 200) { res.resume(); return; }
+      let buf = '';
+      res.on('data', d => { buf += d; });
+      res.on('end', () => {
+        try {
+          const { version: latest } = JSON.parse(buf);
+          if (latest) { writeFileSync(_updateCache, JSON.stringify({ checkedAt: Date.now(), latest })); _uc = { checkedAt: Date.now(), latest }; }
+        } catch {}
+      });
+    });
+    _ureq.on('socket', s => s.unref?.()); // don't let the update check hold the CLI's exit
+    _ureq.on('error', () => {});
+    _ureq.setTimeout(4000, () => _ureq.destroy());
+  } catch {}
 }
 
 function loadGlobalConfig() {
@@ -110,9 +121,11 @@ export async function flowFetch(path, { method = 'GET', body } = {}) {
     'content-type': 'application/json',
   };
   if (actingViaClaude()) headers['x-flow-acting-via'] = 'claude';
-  const org = process.env.FLOW_ORG_ID || _gc.orgId || '';
+  // CLI-5 (audit): config-first then env (consistent with token at 94 + actor at 138) so a stale env
+  // var can't override a logged-in session's org/project.
+  const org = _gc.orgId || process.env.FLOW_ORG_ID || '';
   if (org) headers['x-flow-org'] = org;
-  const proj = process.env.FLOW_PROJECT_ID || _gc.projectId || '';
+  const proj = _gc.projectId || process.env.FLOW_PROJECT_ID || '';
   if (proj) headers['x-flow-project'] = proj;
 
   const res = await fetch(url, {
@@ -179,7 +192,9 @@ export function arg(name, fallback) {
 }
 
 export function positional(idx) {
-  const pos = process.argv.slice(2).filter(a => !a.startsWith('--'));
+  // CLI-3 (audit): only filter REAL flag tokens (--word / --word=value), not a free-text positional that
+  // merely begins with '--' (e.g. a flow-comment body "-- reverted the change" was being dropped).
+  const pos = process.argv.slice(2).filter(a => !/^--[a-zA-Z][\w-]*(=|$)/.test(a));
   return pos[idx];
 }
 

package/bin/create.mjs

@@ -29,7 +29,12 @@ async function fetchGithubIssue(issueNum) {
   if (!repo) die('FLOW_GITHUB_REPO is not set. Set it in .env to use --from-issue.');
   const url = `https://api.github.com/repos/${repo}/issues/${issueNum}`;
   const res = await fetch(url, { headers: githubHeaders() });
-  if (res.status === 404) die(`GitHub Issue #${issueNum} not found in ${repo}.`);
+  // CLI-4 (audit): a PRIVATE repo with no token returns 404 (unauthenticated) — make that legible
+  // instead of a misleading "not found" (githubHeaders() omits Authorization when no token is set).
+  if (res.status === 404) {
+    const hint = process.env.FLOW_GITHUB_TOKEN ? '' : ' — if it is a PRIVATE repo, set FLOW_GITHUB_TOKEN (none is set)';
+    die(`GitHub Issue #${issueNum} not found in ${repo}${hint}.`);
+  }
   if (!res.ok) die(`GitHub API error ${res.status} fetching issue #${issueNum}.`);
   return res.json();
 }

package/bin/edit.mjs

@@ -20,7 +20,7 @@ const FIELD_MAP = {
   title:      v => ({ title: v }),
   priority:   v => ({ priority: normalizePriority(v) }),
   area:       v => ({ area: v }),
-  due:        v => ({ due_at: /^\d{4}-\d{2}-\d{2}$/.test(v) ? v + 'T12:00:00Z' : v }),
+  due:        v => { if (!/^\d{4}-\d{2}-\d{2}$/.test(v)) die(`--due must be YYYY-MM-DD (got: ${v})`); return { due_at: v + 'T12:00:00Z' }; }, // CLI-7 (audit): validate instead of sending a bad string (e.g. "tomorrow") through raw
   milestone:  v => ({ milestone: v }),
   'blocked-by': v => ({ blocked_by: v === 'null' ? [] : v.split(',').map(s => s.trim()).filter(Boolean) }), // B9: split the comma list; prefixes are resolved after the loop
 };

package/bin/scan.mjs

@@ -228,8 +228,9 @@ async function main() {
   if (all || doTodos) {
     process.stdout.write('  [todos] scanning...\n');
     const s = scanTodos(files, dir);
-    if (doTodos) { printSection('TODO / FIXME items', s); return; }
-    if (all && s.length) printSection('TODO / FIXME items', s);
+    // CLI-2 (audit): print when explicitly requested OR (all + results); NO early return, so combining
+    // focused flags (e.g. `flow-scan --todos --issues`) runs every requested scan, not only the first.
+    if (doTodos || (all && s.length)) printSection('TODO / FIXME items', s);
     else if (all) process.stdout.write('\n[todos] None found.\n');
   }
 
@@ -241,10 +242,8 @@ async function main() {
     // no FLOW_GITHUB_REPO reports "Skipped" instead of a misleading "Untracked Issues (0) None found".
     if (s === null) process.stdout.write('\n[issues] Skipped — FLOW_GITHUB_REPO not set.\n');
     else if (issueErr) process.stdout.write('\n[issues] Scan failed — check FLOW_GITHUB_REPO and token.\n');
-    else if (doIssues) { printSection('Untracked GitHub Issues', s); return; }
-    else if (all && s.length) printSection('Untracked GitHub Issues', s);
+    else if (doIssues || (all && s.length)) printSection('Untracked GitHub Issues', s); // CLI-2 (audit): no early return — flags combine
     else if (all) process.stdout.write('\n[issues] All open Issues are tracked in Flow.\n');
-    if (doIssues) return; // explicit --issues exits after its own report (Skipped/error already printed)
   }
 
   if (all || doPRs) {
@@ -254,17 +253,14 @@ async function main() {
     // B14 (audit): null/error before the explicit-flag return (see the issues block above).
     if (s === null) process.stdout.write('\n[prs] Skipped — FLOW_GITHUB_REPO not set.\n');
     else if (prErr) process.stdout.write('\n[prs] Scan failed — check FLOW_GITHUB_REPO and token.\n');
-    else if (doPRs) { printSection('Unlinked open PRs', s); return; }
-    else if (all && s.length) printSection('Unlinked open PRs', s);
+    else if (doPRs || (all && s.length)) printSection('Unlinked open PRs', s); // CLI-2 (audit): no early return — flags combine
     else if (all) process.stdout.write('\n[prs] All open PRs are linked to Flow tasks.\n');
-    if (doPRs) return; // explicit --prs exits after its own report
   }
 
   if (all || doSecurity) {
     process.stdout.write('  [security] scanning patterns...\n');
     const s = scanSecurity(dir);
-    if (doSecurity) { printSection('Security concerns', s); return; }
-    if (all && s.length) printSection('Security concerns', s);
+    if (doSecurity || (all && s.length)) printSection('Security concerns', s); // CLI-2 (audit): no early return — flags combine
     else if (all) process.stdout.write('\n[security] No common patterns found.\n');
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [