flowcollab 0.3.19 → 0.3.21

package/bin/_client.mjs

@@ -215,9 +215,17 @@ export async function resolveTaskId(input) {
     cursor = page.has_more ? page.next_cursor : null;
   } while (cursor);
   const decRes = await flowFetch('/api/flow/decisions');
+  // B5: a bare integer is the human-friendly per-project task number (#42), not a UUID prefix.
+  // Match it exactly first so `flow claim 42` works; if no num matches we still fall through to
+  // UUID-prefix matching below (a purely-numeric UUID prefix is vanishingly unlikely).
+  if (/^\d+$/.test(stripped)) {
+    const numMatches = allTasks.filter(t => t.num != null && String(t.num) === stripped);
+    if (numMatches.length === 1) return numMatches[0].id;
+    if (numMatches.length > 1) throw new Error(`Ambiguous number #${stripped} matches ${numMatches.length} tasks (across projects):\n${numMatches.map(t => `  ${t.id.slice(0, 6)}  ${sanitizeText(t.title)}`).join('\n')}\nPass the id prefix instead.`);
+  }
   const taskMatches = allTasks.filter(t => typeof t.id === 'string' && t.id.startsWith(stripped));
   if (taskMatches.length === 1) return taskMatches[0].id;
-  if (taskMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${taskMatches.length} tasks:\n${taskMatches.map(t => `  #${t.id.slice(0, 6)}  ${sanitizeText(t.title)}`).join('\n')}`);
+  if (taskMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${taskMatches.length} tasks:\n${taskMatches.map(t => `  ${t.num != null ? '#' + t.num : t.id.slice(0, 6)}  ${sanitizeText(t.title)}`).join('\n')}`);
   const decisions = decRes.decisions || [];
   const decMatches = decisions.filter(d => d.id.startsWith(stripped));
   if (decMatches.length === 0) throw new Error(`No task or decision found with ID prefix "${stripped}". Run \`flow-pull\` to see your current tasks.`);

package/bin/approve.mjs

@@ -5,7 +5,7 @@
      flow-approve <decision_id> --title="override" --assignee=...
 */
 
-import { flowFetch, resolveTaskId, positional, arg, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, positional, arg, die, sanitizeText } from './_client.mjs';
 
 async function main() {
   const raw = positional(0);
@@ -21,7 +21,7 @@ async function main() {
   const r = await flowFetch(`/api/flow/decisions/${id}/approve`, {
     method: 'POST', body: overrides,
   });
-  process.stdout.write(`Promoted to task #${r.task.id.slice(0, 6)} — "${r.task.title}"\n`);
+  process.stdout.write(`Promoted to task #${r.task.id.slice(0, 6)} — "${sanitizeText(r.task.title, 80)}"\n`);
 }
 
 main().catch(e => die(e.message || e));

package/bin/archive.mjs

@@ -8,7 +8,7 @@
      flow-archive <task-id> --undo   # unarchive
 */
 
-import { flowFetch, RESOLVED_ACTOR } from './_client.mjs';
+import { flowFetch, RESOLVED_ACTOR, sanitizeText } from './_client.mjs';
 
 const [,, taskId, ...rest] = process.argv;
 const undo = rest.includes('--undo');
@@ -30,4 +30,4 @@ const res = await flowFetch(endpoint, { method: 'POST' }).catch(e => {
 const t = res.task;
 const ref = `#${t.issue_num ?? taskId.slice(0, 6)}`;
 const verb = undo ? 'Unarchived' : 'Archived';
-process.stdout.write(`${verb} ${ref}: ${t.title}\n`);
+process.stdout.write(`${verb} ${ref}: ${sanitizeText(t.title, 80)}\n`);

package/bin/assign.mjs

@@ -8,7 +8,7 @@
    Server-side: human-only (claude alone cannot push work onto humans).
 */
 
-import { flowFetch, resolveTaskId, positional, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, positional, die, sanitizeText } from './_client.mjs';
 
 async function main() {
   const raw = positional(0);
@@ -23,7 +23,7 @@ async function main() {
       method: 'POST',
       body: { assignee_id },
     });
-    process.stdout.write(`Assigned: ${r.task.title}\n`);
+    process.stdout.write(`Assigned: ${sanitizeText(r.task.title, 80)}\n`);
     process.stdout.write(`  Now assignee: ${r.task.assignee_id || '(unassigned)'}\n`);
   } catch (e) {
     if (e.status === 403) die('Assignment requires a human actor (FLOW_ACTING_VIA=self or no claude header).');

package/bin/claim.mjs

@@ -3,7 +3,7 @@
    Usage: flow-claim <task_id>
 */
 
-import { flowFetch, resolveTaskId, positional, arg, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, positional, arg, die, sanitizeText } from './_client.mjs';
 
 async function main() {
   const raw = positional(0);
@@ -36,13 +36,13 @@ async function main() {
     r = await flowFetch('/api/flow/claim', { method: 'POST', body });
   }
   if (!r?.task?.id) throw new Error('Server returned no task. Check your connection and try again.');
-  process.stdout.write(`Claimed #${r.task.issue_num ?? r.task.id.slice(0, 6)} — "${r.task.title}"\n`);
+  process.stdout.write(`Claimed #${r.task.issue_num ?? r.task.id.slice(0, 6)} — "${sanitizeText(r.task.title, 80)}"\n`);
 
   // Warn on file conflicts
   if (r.conflict_warnings?.length) {
     process.stdout.write(`\n⚠  File conflict${r.conflict_warnings.length === 1 ? '' : 's'} detected:\n`);
     for (const w of r.conflict_warnings) {
-      process.stdout.write(`  #${w.task_ref}  "${w.title}"  (${w.claimed_by || 'unassigned'})\n`);
+      process.stdout.write(`  #${w.task_ref}  "${sanitizeText(w.title, 60)}"  (${w.claimed_by || 'unassigned'})\n`);
       process.stdout.write(`    overlapping files: ${w.overlapping_files.join(', ')}\n`);
     }
     process.stdout.write('Consider coordinating before editing these files.\n\n');

package/bin/close.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 /* flow:close — mark a task done.
-   Usage: flow-close <task_id> [--summary="..."]
+   Usage: flow-close <task_id> "<summary>"   (--summary="..." also accepted)
 */
 
-import { flowFetch, resolveTaskId, positional, arg, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, positional, arg, die, sanitizeText } from './_client.mjs';
 
 async function main() {
   const raw = positional(0);
-  if (!raw) die('Usage: flow-close <task_id> [--summary="..."]');
+  if (!raw) die('Usage: flow-close <task_id> "<summary>"');
   const id = await resolveTaskId(raw);
-  const summary = arg('summary');
+  const summary = positional(1) || arg('summary');
 
   const r = await flowFetch('/api/flow/close', {
     method: 'POST',
@@ -17,7 +17,7 @@ async function main() {
   });
 
   const ref = r.task.issue_num != null ? r.task.issue_num : r.task.id.slice(0, 6);
-  process.stdout.write(`Closed #${ref} — "${r.task.title}"\n`);
+  process.stdout.write(`Closed #${ref} — "${sanitizeText(r.task.title, 80)}"\n`);
 }
 
 main().catch(e => die(e.message || e));

package/bin/comment.mjs

@@ -30,13 +30,14 @@ async function main() {
   let commit;
   const hasEq = process.argv.some(a => a.startsWith('--commit='));
   if (process.argv.includes('--commit') || hasEq) {
-    // B14: --commit= with an empty value is a typo, not "use HEAD". Bare --commit means HEAD.
-    if (hasEq) {
-      commit = arg('commit');
-      if (!commit) die('--commit= was given with no value. Use --commit (HEAD) or --commit=<sha>.');
-    } else {
-      commit = headSha();
-    }
+    // arg('commit') resolves BOTH --commit=<sha> and the space form --commit <sha>; '' means bare
+    // --commit with nothing after it → link the current HEAD. B14: the space form previously fell
+    // into the bare branch and silently linked HEAD instead of the SHA passed. --commit= with an
+    // empty value is a typo, not "use HEAD".
+    const val = arg('commit');
+    if (val) commit = val;
+    else if (hasEq) die('--commit= was given with no value. Use --commit (HEAD) or --commit=<sha>.');
+    else commit = headSha();
     if (!/^[0-9a-f]{7,64}$/i.test(commit)) die(`Invalid commit SHA: ${commit}`);
   }
 

package/bin/completion.mjs

@@ -7,13 +7,11 @@
 */
 
 import { positional, die } from './_client.mjs';
+import { CLI_COMMANDS } from './_commands.mjs';
 
-const COMMANDS = [
-  'login', 'pull', 'claim', 'comment', 'close', 'create', 'edit', 'unblock',
-  'propose', 'approve', 'reject', 'assign', 'decisions', 'handoff', 'review',
-  'search', 'status', 'standup', 'sync', 'log', 'heartbeat', 'ping', 'pr',
-  'project', 'archive', 'close-sprint', 'whoami', 'completion',
-];
+// B14: derive the command list from the single source of truth so completion can't drift.
+// (It previously hardcoded the list and had already lost `scan`, so `flow scan` had no completion.)
+const COMMANDS = CLI_COMMANDS.map((c) => c.name);
 
 const FLAGS = {
   pull:    ['--focus', '--milestone=', '--sync-md', '--force'],

package/bin/create.mjs

@@ -21,7 +21,7 @@
 */
 
 import 'dotenv/config';
-import { flowFetch, resolveTaskId, arg, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, arg, die, sanitizeText } from './_client.mjs';
 import { githubHeaders, fetchProjectItem, labelsToType } from './_github.mjs';
 
 async function fetchGithubIssue(issueNum) {
@@ -113,7 +113,7 @@ async function main() {
     const r = await flowFetch('/api/flow/tasks', { method: 'POST', body });
     const t = r.task || r;
     if (!t?.id) throw new Error('Server returned no task. Check your connection and try again.');
-    process.stdout.write(`Created #${t.id.slice(0, 6)} — "${t.title}"\n`);
+    process.stdout.write(`Created #${t.id.slice(0, 6)} — "${sanitizeText(t.title, 80)}"\n`);
     process.stdout.write(`  id:       ${t.id}\n`);
     process.stdout.write(`  status:   ${t.status}\n`);
     process.stdout.write(`  priority: ${t.priority}  type: ${t.type}  area: ${t.area}\n`);

package/bin/edit.mjs

@@ -8,7 +8,7 @@
      flow-edit <id> --blocked-by=<uuid>
 */
 
-import { flowFetch, resolveTaskId, positional, arg, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, positional, arg, die, sanitizeText } from './_client.mjs';
 
 // B16: the server enum is P0-now / P1-soon / P2-later. Accept p0/p1/p2 (and any case of the
 // canonical form) so the documented shorthand isn't rejected; pass anything else through for
@@ -47,7 +47,7 @@ async function main() {
   const res = await flowFetch(`/api/flow/tasks/${id}`, { method: 'PATCH', body: changes });
 
   const updated = res.task || res;
-  const label = updated.title || id.slice(0, 8);
+  const label = sanitizeText(updated.title, 80) || id.slice(0, 8);
   process.stdout.write(`Updated: ${label}\n`);
   for (const [k, v] of Object.entries(changes)) {
     const display = v === null || (Array.isArray(v) && v.length === 0) ? '(cleared)' : v;

package/bin/log.mjs

@@ -6,17 +6,7 @@
      flow-log --limit=50             # more events
 */
 
-import { flowFetch, resolveTaskId, arg, die } from './_client.mjs';
-
-function sanitize(s) {
-  if (!s || typeof s !== 'string') return '';
-  return s
-    .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
-    .replace(/@to:\S+/g, '[mention]')
-    .replace(/\r?\n|\r/g, ' ')
-    .trim()
-    .slice(0, 120);
-}
+import { flowFetch, resolveTaskId, arg, die, sanitizeText } from './_client.mjs';
 
 function fmt(ts) {
   if (!ts) return '         ';
@@ -29,8 +19,10 @@ function pad(s, n) { return String(s ?? '').padEnd(n).slice(0, n); }
 
 function fmtEvent(e) {
   const p = e.payload || {};
-  if (p.comment) return sanitize(p.comment);
-  if (p.act) return `[${p.act}${p.summary ? ': ' + sanitize(p.summary, 80) : ''}]`;
+  // Wrap untrusted comment bodies in the fence marker (sanitize BEFORE wrapping so a
+  // crafted comment can't inject a closing tag) — matches pull.mjs.
+  if (p.comment) return `<comment_from_untrusted_user>${sanitizeText(p.comment)}</comment_from_untrusted_user>`;
+  if (p.act) return `[${p.act}${p.summary ? ': ' + sanitizeText(p.summary, 80) : ''}]`;
   return `[${e.kind || 'event'}]`;
 }
 
@@ -53,7 +45,7 @@ async function main() {
 
     if (events.length === 0) { process.stdout.write('No timeline events.\n'); return; }
 
-    process.stdout.write(`Timeline for #${task.issue_num ?? id.slice(0, 6)}: ${task.title}\n\n`);
+    process.stdout.write(`Timeline for #${task.issue_num ?? id.slice(0, 6)}: ${sanitizeText(task.title, 120)}\n\n`);
     for (const e of events) {
       const who = e.acting_as_id ? `${e.acting_as_id}(${e.actor_id})` : (e.actor_id || '?');
       process.stdout.write(`  ${fmt(e.ts)}  ${pad(who, 18)}  ${fmtEvent(e)}\n`);

package/bin/login.mjs

@@ -6,17 +6,37 @@
 import { homedir } from 'os';
 import { mkdirSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { join } from 'path';
-import { exec } from 'child_process';
+import { execFile, spawnSync } from 'child_process';
+
+// BUG-6: mirror the _client.mjs Windows TLS re-spawn. flow-login does NOT import _client.mjs
+// (it has its own fetch loop), so run directly as `flow-login` it never got --use-system-ca and
+// would throw "fetch failed" behind corporate/AV TLS inspection. Invoked via `flow login` the
+// router already re-spawned, so FLOW_TLS_RESPAWNED=1 makes this a no-op.
+if (process.platform === 'win32'
+    && !process.execArgv.includes('--use-system-ca')
+    && process.env.FLOW_TLS_RESPAWNED !== '1') {
+  const r = spawnSync(process.execPath, ['--use-system-ca', ...process.argv.slice(1)], {
+    stdio: 'inherit',
+    env: { ...process.env, FLOW_TLS_RESPAWNED: '1' },
+  });
+  process.exit(r.status ?? 1);
+}
 
 const serverArg = process.argv.find(a => a.startsWith('--server='))?.slice(9);
 const base = (serverArg || process.env.FLOW_API_BASE || 'https://flowcollab.dev').replace(/\/+$/, '');
 
 function openBrowser(url) {
+  // SEC-9: `url` comes from the server's device-code response. Open it WITHOUT a shell —
+  // execFile passes the URL as a plain argument to the opener, so shell metacharacters in a
+  // tampered response (MITM / rogue --server) can't be interpreted. Only http(s) is opened, and
+  // the URL is also printed for manual use, so a rejected one never blocks login.
   try {
-    const cmd = process.platform === 'darwin' ? `open "${url}"`
-      : process.platform === 'win32' ? `start "" "${url}"`
-      : `xdg-open "${url}"`;
-    exec(cmd);
+    const u = new URL(url);
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') return;
+    const [file, args] = process.platform === 'darwin' ? ['open', [url]]
+      : process.platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]]
+      : ['xdg-open', [url]];
+    execFile(file, args);
   } catch { /* best-effort */ }
 }
 

package/bin/project.mjs

@@ -10,7 +10,7 @@
 */
 
 import 'dotenv/config';
-import { die } from './_client.mjs';
+import { die, sanitizeText } from './_client.mjs';
 import { fetchProjectItems, contentKind } from './_github.mjs';
 
 async function main() {
@@ -30,7 +30,7 @@ async function main() {
 
   const { title, items } = await fetchProjectItems(projectId);
 
-  process.stdout.write(`Project: ${title}\n`);
+  process.stdout.write(`Project: ${sanitizeText(title, 100)}\n`);
   process.stdout.write(`  ${items.length} item${items.length !== 1 ? 's' : ''}\n\n`);
 
   if (!items.length) {
@@ -41,7 +41,7 @@ async function main() {
   for (const { id, content } of items) {
     const kind = contentKind(content);
     const num = content.number ? ` #${content.number}` : '';
-    process.stdout.write(`  [${id}]  ${content.title}${num ? ` (${kind}${num})` : ` (${kind})`}\n`);
+    process.stdout.write(`  [${id}]  ${sanitizeText(content.title, 80)}${num ? ` (${kind}${num})` : ` (${kind})`}\n`);
   }
 
   process.stdout.write(`\nTo import an item:\n  flow-create --from-project-item=<id above>\n`);

package/bin/propose.mjs

@@ -19,7 +19,7 @@
    - Dedup on title (HTTP 409)
 */
 
-import { flowFetch, resolveTaskId, arg, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, arg, die, sanitizeText } from './_client.mjs';
 
 async function main() {
   const parent = arg('parent') ? await resolveTaskId(arg('parent')) : null;
@@ -42,7 +42,7 @@ async function main() {
   try {
     const r = await flowFetch('/api/flow/propose', { method: 'POST', body });
     process.stdout.write(`Proposal accepted: #${r.decision.id.slice(0, 6)}\n`);
-    process.stdout.write(`  Title: ${r.decision.proposal_title}\n`);
+    process.stdout.write(`  Title: ${sanitizeText(r.decision.proposal_title, 100)}\n`);
     process.stdout.write(`  Suggested assignee: ${r.decision.suggested_assignee_id || '-'}\n`);
     process.stdout.write(`  Source refs: ${(r.decision.source_refs || []).join(', ') || '-'}\n`);
     process.stdout.write('\nThe user will see this in the "Awaiting Direction" column.\n');

package/bin/pull.mjs

@@ -45,14 +45,14 @@ const PRIO_RANK = { 'P0-now': 0, 'P1-soon': 1, 'P2-later': 2 };
 const STATUS_RANK = { in_progress: 0, in_review: 1, todo: 2, backlog: 3, awaiting_direction: 4 };
 
 function fmtTask(t) {
-  const miTag = t.milestone ? ` [${t.milestone}]` : '';
+  const miTag = t.milestone ? ` [${sanitizeText(t.milestone, 40)}]` : '';
   const prTag = t.pr_num ? ` [PR #${t.pr_num}: ${t.pr_state || 'open'}]` : '';
   const parts = [
     pad(`#${t.issue_num ?? t.id.slice(0, 6)}`, 8),
     pad(t.status, 12),
     pad(t.priority || '-', 9),
     pad(t.assignee_id || '(unassigned)', 14),
-    t.title + miTag + prTag,
+    sanitizeText(t.title, 100) + miTag + prTag,
   ];
   return parts.join('  ');
 }
@@ -361,7 +361,7 @@ async function main() {
   // 4. Recent timeline on YOUR tasks (last 5 per task, newest first)
   const activeTaskIds = new Set([...myTaskIds].filter(id => {
     const t = taskById.get(id);
-    return t && t.status !== 'closed';
+    return t && t.status !== 'done'; // B14: was !== 'closed', a status that never exists → dead no-op
   }));
   if (activeTaskIds.size && allTimeline.length) {
     const recentByTask = new Map();

package/bin/reject.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 /* flow:reject — reject a pending decision.
-   Usage: flow-reject <decision_id> [--reason="..."]
+   Usage: flow-reject <decision_id> "<reason>"   (--reason="..." also accepted)
 */
 
 import { flowFetch, resolveTaskId, positional, arg, die } from './_client.mjs';
 
 async function main() {
   const raw = positional(0);
-  if (!raw) die('Usage: flow-reject <decision_id> [--reason="..."]');
+  if (!raw) die('Usage: flow-reject <decision_id> "<reason>"');
   const id = await resolveTaskId(raw);
-  const reason = arg('reason');
+  const reason = positional(1) || arg('reason');
   await flowFetch(`/api/flow/decisions/${id}/reject`, {
     method: 'POST', body: reason ? { reason } : {},
   });

package/bin/scan.mjs

@@ -10,7 +10,7 @@
 */
 
 import 'dotenv/config';
-import { flowFetch, arg, die } from './_client.mjs';
+import { flowFetch, arg, die, sanitizeText } from './_client.mjs';
 import { githubHeaders } from './_github.mjs';
 import { readFileSync, readdirSync } from 'node:fs';
 import { join, extname, relative } from 'node:path';
@@ -77,11 +77,16 @@ function scanTodos(files, dir) {
 // ── GitHub Issues scan ─────────────────────────────────────────────────────────
 async function fetchGitHub(url) {
   const res = await fetch(url, { headers: githubHeaders() });
-  if (res.status === 429 || res.status === 403) {
+  // B14: GitHub returns 403 for BOTH rate limiting (x-ratelimit-remaining: 0) AND auth/permission
+  // failures. Only call it a rate limit when the remaining count is actually 0 — otherwise a bad or
+  // unscoped token was mislabeled as "rate limit exceeded", sending users down the wrong path.
+  const rateLimited = res.status === 429 || (res.status === 403 && res.headers.get('x-ratelimit-remaining') === '0');
+  if (rateLimited) {
     const reset = res.headers.get('x-ratelimit-reset');
     const wait = reset ? new Date(Number(reset) * 1000).toLocaleTimeString() : 'soon';
     throw new Error(`GitHub rate limit exceeded — resets at ${wait}`);
   }
+  if (res.status === 403) throw new Error('GitHub API 403 — token lacks access to this repo (check FLOW_GITHUB_TOKEN scope / GitHub App install).');
   if (!res.ok) throw new Error(`GitHub API ${res.status}: ${res.statusText}`);
   return res.json();
 }
@@ -123,7 +128,7 @@ async function scanIssues(repo) {
     const labels = (i.labels || []).map(l => l.name.toLowerCase());
     const type = labels.includes('bug') ? 'bug' : labels.includes('documentation') ? 'docs' : 'feature';
     return {
-      label: `GitHub Issue #${i.number}: ${i.title}`,
+      label: `GitHub Issue #${i.number}: ${sanitizeText(i.title, 80)}`,
       detail: `  ${i.html_url}`,
       cmd: `flow-create --from-issue=${i.number} --type=${type}`,
     };
@@ -150,9 +155,9 @@ async function scanPRs(repo) {
   const trackedPRs = new Set(allTasks.filter(t => t.pr_num).map(t => t.pr_num));
   const unlinked = ghPRs.filter(pr => !trackedPRs.has(pr.number));
   return unlinked.slice(0, 10).map(pr => {
-    const title = pr.title.replace(/"/g, '\\"').slice(0, 55);
+    const title = sanitizeText(pr.title, 55).replace(/"/g, '\\"');
     return {
-      label: `Unlinked PR #${pr.number}: ${pr.title}`,
+      label: `Unlinked PR #${pr.number}: ${sanitizeText(pr.title, 80)}`,
       detail: `  ${pr.html_url}  (${pr.draft ? 'draft' : 'open'})`,
       cmd: `flow-create --title="Track PR #${pr.number}: ${title}" --type=chore --area=backend`,
     };
@@ -176,6 +181,16 @@ const SEC_PATTERNS = [
   { re: /(?:password|secret|apikey|api_key|access_token)\s*(?:=|:)\s*['"`][^'"`]{6,}/i, label: 'Possible hardcoded credential' },
 ];
 
+// SEC-3: `flow scan --security` prints a snippet of each matched line. For the credential
+// pattern the match IS the secret, so mask any secret-ish assigned value before it reaches
+// stdout / a created task / a shell history. Enough of the line stays to locate the finding.
+function redactSecrets(s) {
+  return s.replace(
+    /((?:password|passwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token|token|bearer)['"`]?\s*[:=]\s*['"`]?)([^\s'"`]{4,})/gi,
+    (_m, pre) => `${pre}***REDACTED***`,
+  );
+}
+
 function scanSecurity(dir) {
   const files = walkFiles(dir, secMatch); // S13: include config/.env/secret files
   const out = [];
@@ -183,7 +198,7 @@ function scanSecurity(dir) {
     const hits = grepLines(files, re);
     for (const h of hits.slice(0, 3)) {
       const rel = relative(dir, h.file);
-      const snippet = h.text.slice(0, 70);
+      const snippet = redactSecrets(h.text.slice(0, 70));
       out.push({
         label: `${label} — ${rel}:${h.lineNo}`,
         detail: `  ${rel}:${h.lineNo}: ${snippet}`,

package/bin/search.mjs

@@ -6,7 +6,7 @@
      flow-search "ui" --area=frontend --assignee=nate
 */
 
-import { flowFetch, arg, positional } from './_client.mjs';
+import { flowFetch, arg, positional, sanitizeText } from './_client.mjs';
 
 function pad(s, n) { return String(s).padEnd(n).slice(0, n); }
 
@@ -40,7 +40,7 @@ async function main() {
     const ref = `#${t.issue_num ?? t.id.slice(0, 6)}`;
     const due = t.due_at ? `  due:${t.due_at.slice(0, 10)}` : '';
     process.stdout.write(
-      `${pad(ref, 8)}  ${pad(t.status, 12)}  ${pad(t.priority || '-', 9)}  ${pad(t.assignee_id || '-', 14)}  ${t.title}${due}\n`
+      `${pad(ref, 8)}  ${pad(t.status, 12)}  ${pad(t.priority || '-', 9)}  ${pad(t.assignee_id || '-', 14)}  ${sanitizeText(t.title, 60)}${due}\n`
     );
   }
 }

package/bin/status.mjs

@@ -3,7 +3,7 @@
    Usage: flow-status
 */
 
-import { flowFetch } from './_client.mjs';
+import { flowFetch, sanitizeText } from './_client.mjs';
 
 function pad(s, n) { return String(s).padEnd(n).slice(0, n); }
 
@@ -53,7 +53,7 @@ async function main() {
       for (const t of arr) {
         const stale = t.updated_at && (now - new Date(t.updated_at).getTime()) > STALE_HOURS * 3600000;
         const staleMark = stale ? '  ⚠ STALE' : '';
-        out.push(`    #${t.issue_num ?? t.id.slice(0, 6)}  ${pad(t.assignee_id || 'unassigned', 14)}  ${t.title.slice(0, 50)}${staleMark}`);
+        out.push(`    #${t.issue_num ?? t.id.slice(0, 6)}  ${pad(t.assignee_id || 'unassigned', 14)}  ${sanitizeText(t.title, 50)}${staleMark}`);
       }
     }
   }
@@ -74,7 +74,7 @@ async function main() {
       const heartbeatTask = a.task_id ? taskById.get(a.task_id) : null;
       const displayTask = heartbeatTask || myTasks[0];
       const taskPart = displayTask
-        ? `#${displayTask.issue_num ?? displayTask.id.slice(0, 6)} "${displayTask.title.slice(0, 38)}"`
+        ? `#${displayTask.issue_num ?? displayTask.id.slice(0, 6)} "${sanitizeText(displayTask.title, 38)}"`
         : 'idle';
       const extraCount = myTasks.length > 1 ? ` +${myTasks.length - 1} more` : '';
       out.push(`  ${pad(a.actor_id, 16)}  ${taskPart}${extraCount}  (${relAgo(a.last_seen_at)})`);
@@ -91,7 +91,7 @@ async function main() {
   out.push(`[decisions]  ${decisions.length} pending`);
   if (decisions.length) {
     for (const d of decisions.slice(0, 5)) {
-      out.push(`  #${d.id.slice(0, 6)}  [${d.confidence}]  ${d.proposal_title.slice(0, 65)}`);
+      out.push(`  #${d.id.slice(0, 6)}  [${d.confidence}]  ${sanitizeText(d.proposal_title, 65)}`);
     }
     if (decisions.length > 5) out.push(`  … and ${decisions.length - 5} more`);
   }

package/bin/unblock.mjs

@@ -3,7 +3,7 @@
    Usage: flow-unblock <task_id>
 */
 
-import { flowFetch, resolveTaskId, positional, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, positional, die, sanitizeText } from './_client.mjs';
 
 async function main() {
   const raw = positional(0);
@@ -12,7 +12,7 @@ async function main() {
   const id = await resolveTaskId(raw);
   const res = await flowFetch(`/api/flow/tasks/${id}`, { method: 'PATCH', body: { blocked_by: [] } });
 
-  const title = res.task?.title || id.slice(0, 8);
+  const title = sanitizeText(res.task?.title, 80) || id.slice(0, 8);
   process.stdout.write(`Unblocked: ${title}\n`);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [