flowcollab 0.3.20 → 0.3.21

package/bin/_client.mjs

@@ -215,9 +215,17 @@ export async function resolveTaskId(input) {
     cursor = page.has_more ? page.next_cursor : null;
   } while (cursor);
   const decRes = await flowFetch('/api/flow/decisions');
+  // B5: a bare integer is the human-friendly per-project task number (#42), not a UUID prefix.
+  // Match it exactly first so `flow claim 42` works; if no num matches we still fall through to
+  // UUID-prefix matching below (a purely-numeric UUID prefix is vanishingly unlikely).
+  if (/^\d+$/.test(stripped)) {
+    const numMatches = allTasks.filter(t => t.num != null && String(t.num) === stripped);
+    if (numMatches.length === 1) return numMatches[0].id;
+    if (numMatches.length > 1) throw new Error(`Ambiguous number #${stripped} matches ${numMatches.length} tasks (across projects):\n${numMatches.map(t => `  ${t.id.slice(0, 6)}  ${sanitizeText(t.title)}`).join('\n')}\nPass the id prefix instead.`);
+  }
   const taskMatches = allTasks.filter(t => typeof t.id === 'string' && t.id.startsWith(stripped));
   if (taskMatches.length === 1) return taskMatches[0].id;
-  if (taskMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${taskMatches.length} tasks:\n${taskMatches.map(t => `  #${t.id.slice(0, 6)}  ${sanitizeText(t.title)}`).join('\n')}`);
+  if (taskMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${taskMatches.length} tasks:\n${taskMatches.map(t => `  ${t.num != null ? '#' + t.num : t.id.slice(0, 6)}  ${sanitizeText(t.title)}`).join('\n')}`);
   const decisions = decRes.decisions || [];
   const decMatches = decisions.filter(d => d.id.startsWith(stripped));
   if (decMatches.length === 0) throw new Error(`No task or decision found with ID prefix "${stripped}". Run \`flow-pull\` to see your current tasks.`);

package/bin/comment.mjs

@@ -30,13 +30,14 @@ async function main() {
   let commit;
   const hasEq = process.argv.some(a => a.startsWith('--commit='));
   if (process.argv.includes('--commit') || hasEq) {
-    // B14: --commit= with an empty value is a typo, not "use HEAD". Bare --commit means HEAD.
-    if (hasEq) {
-      commit = arg('commit');
-      if (!commit) die('--commit= was given with no value. Use --commit (HEAD) or --commit=<sha>.');
-    } else {
-      commit = headSha();
-    }
+    // arg('commit') resolves BOTH --commit=<sha> and the space form --commit <sha>; '' means bare
+    // --commit with nothing after it → link the current HEAD. B14: the space form previously fell
+    // into the bare branch and silently linked HEAD instead of the SHA passed. --commit= with an
+    // empty value is a typo, not "use HEAD".
+    const val = arg('commit');
+    if (val) commit = val;
+    else if (hasEq) die('--commit= was given with no value. Use --commit (HEAD) or --commit=<sha>.');
+    else commit = headSha();
     if (!/^[0-9a-f]{7,64}$/i.test(commit)) die(`Invalid commit SHA: ${commit}`);
   }
 

package/bin/completion.mjs

@@ -7,13 +7,11 @@
 */
 
 import { positional, die } from './_client.mjs';
+import { CLI_COMMANDS } from './_commands.mjs';
 
-const COMMANDS = [
-  'login', 'pull', 'claim', 'comment', 'close', 'create', 'edit', 'unblock',
-  'propose', 'approve', 'reject', 'assign', 'decisions', 'handoff', 'review',
-  'search', 'status', 'standup', 'sync', 'log', 'heartbeat', 'ping', 'pr',
-  'project', 'archive', 'close-sprint', 'whoami', 'completion',
-];
+// B14: derive the command list from the single source of truth so completion can't drift.
+// (It previously hardcoded the list and had already lost `scan`, so `flow scan` had no completion.)
+const COMMANDS = CLI_COMMANDS.map((c) => c.name);
 
 const FLAGS = {
   pull:    ['--focus', '--milestone=', '--sync-md', '--force'],

package/bin/login.mjs

@@ -6,17 +6,37 @@
 import { homedir } from 'os';
 import { mkdirSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { join } from 'path';
-import { exec } from 'child_process';
+import { execFile, spawnSync } from 'child_process';
+
+// BUG-6: mirror the _client.mjs Windows TLS re-spawn. flow-login does NOT import _client.mjs
+// (it has its own fetch loop), so run directly as `flow-login` it never got --use-system-ca and
+// would throw "fetch failed" behind corporate/AV TLS inspection. Invoked via `flow login` the
+// router already re-spawned, so FLOW_TLS_RESPAWNED=1 makes this a no-op.
+if (process.platform === 'win32'
+    && !process.execArgv.includes('--use-system-ca')
+    && process.env.FLOW_TLS_RESPAWNED !== '1') {
+  const r = spawnSync(process.execPath, ['--use-system-ca', ...process.argv.slice(1)], {
+    stdio: 'inherit',
+    env: { ...process.env, FLOW_TLS_RESPAWNED: '1' },
+  });
+  process.exit(r.status ?? 1);
+}
 
 const serverArg = process.argv.find(a => a.startsWith('--server='))?.slice(9);
 const base = (serverArg || process.env.FLOW_API_BASE || 'https://flowcollab.dev').replace(/\/+$/, '');
 
 function openBrowser(url) {
+  // SEC-9: `url` comes from the server's device-code response. Open it WITHOUT a shell —
+  // execFile passes the URL as a plain argument to the opener, so shell metacharacters in a
+  // tampered response (MITM / rogue --server) can't be interpreted. Only http(s) is opened, and
+  // the URL is also printed for manual use, so a rejected one never blocks login.
   try {
-    const cmd = process.platform === 'darwin' ? `open "${url}"`
-      : process.platform === 'win32' ? `start "" "${url}"`
-      : `xdg-open "${url}"`;
-    exec(cmd);
+    const u = new URL(url);
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') return;
+    const [file, args] = process.platform === 'darwin' ? ['open', [url]]
+      : process.platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]]
+      : ['xdg-open', [url]];
+    execFile(file, args);
   } catch { /* best-effort */ }
 }
 

package/bin/pull.mjs

@@ -361,7 +361,7 @@ async function main() {
   // 4. Recent timeline on YOUR tasks (last 5 per task, newest first)
   const activeTaskIds = new Set([...myTaskIds].filter(id => {
     const t = taskById.get(id);
-    return t && t.status !== 'closed';
+    return t && t.status !== 'done'; // B14: was !== 'closed', a status that never exists → dead no-op
   }));
   if (activeTaskIds.size && allTimeline.length) {
     const recentByTask = new Map();

package/bin/scan.mjs

@@ -77,11 +77,16 @@ function scanTodos(files, dir) {
 // ── GitHub Issues scan ─────────────────────────────────────────────────────────
 async function fetchGitHub(url) {
   const res = await fetch(url, { headers: githubHeaders() });
-  if (res.status === 429 || res.status === 403) {
+  // B14: GitHub returns 403 for BOTH rate limiting (x-ratelimit-remaining: 0) AND auth/permission
+  // failures. Only call it a rate limit when the remaining count is actually 0 — otherwise a bad or
+  // unscoped token was mislabeled as "rate limit exceeded", sending users down the wrong path.
+  const rateLimited = res.status === 429 || (res.status === 403 && res.headers.get('x-ratelimit-remaining') === '0');
+  if (rateLimited) {
     const reset = res.headers.get('x-ratelimit-reset');
     const wait = reset ? new Date(Number(reset) * 1000).toLocaleTimeString() : 'soon';
     throw new Error(`GitHub rate limit exceeded — resets at ${wait}`);
   }
+  if (res.status === 403) throw new Error('GitHub API 403 — token lacks access to this repo (check FLOW_GITHUB_TOKEN scope / GitHub App install).');
   if (!res.ok) throw new Error(`GitHub API ${res.status}: ${res.statusText}`);
   return res.json();
 }
@@ -176,6 +181,16 @@ const SEC_PATTERNS = [
   { re: /(?:password|secret|apikey|api_key|access_token)\s*(?:=|:)\s*['"`][^'"`]{6,}/i, label: 'Possible hardcoded credential' },
 ];
 
+// SEC-3: `flow scan --security` prints a snippet of each matched line. For the credential
+// pattern the match IS the secret, so mask any secret-ish assigned value before it reaches
+// stdout / a created task / a shell history. Enough of the line stays to locate the finding.
+function redactSecrets(s) {
+  return s.replace(
+    /((?:password|passwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token|token|bearer)['"`]?\s*[:=]\s*['"`]?)([^\s'"`]{4,})/gi,
+    (_m, pre) => `${pre}***REDACTED***`,
+  );
+}
+
 function scanSecurity(dir) {
   const files = walkFiles(dir, secMatch); // S13: include config/.env/secret files
   const out = [];
@@ -183,7 +198,7 @@ function scanSecurity(dir) {
     const hits = grepLines(files, re);
     for (const h of hits.slice(0, 3)) {
       const rel = relative(dir, h.file);
-      const snippet = h.text.slice(0, 70);
+      const snippet = redactSecrets(h.text.slice(0, 70));
       out.push({
         label: `${label} — ${rel}:${h.lineNo}`,
         detail: `  ${rel}:${h.lineNo}: ${snippet}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [