flowcollab 0.3.21 → 0.3.23

package/bin/_commands.mjs

@@ -44,6 +44,8 @@ export const CLI_COMMANDS = [
     usage: 'flow-handoff --task=<id> --to=<actor> --context="..." [--branch=] [--questions="q1|q2"] [--next-step="..."]' },
   { name: 'review',       file: 'review.mjs',        summary: 'Request code review; moves task to in-review',
     usage: 'flow-review <id> [--pr=<num>] [--reviewer=<actor>] [--context="..."]' },
+  { name: 'verify',       file: 'verify.mjs',        summary: 'Run the project test command + record a pass/fail on the task',
+    usage: 'flow-verify <id> [--cmd="npm test"] [--close]   — run tests, post a verification event; --close closes on pass' },
   { name: 'search',       file: 'search.mjs',        summary: 'Search tasks by text, status, area, or assignee',
     usage: 'flow-search "query" [--status=] [--area=] [--assignee=]' },
   { name: 'status',       file: 'status.mjs',        summary: 'Quick board summary',
@@ -64,8 +66,10 @@ export const CLI_COMMANDS = [
     usage: 'flow-project [--project=<node_id>]             — list GitHub Projects v2 items' },
   { name: 'archive',      file: 'archive.mjs',       summary: 'Archive or unarchive a task (--undo to restore)',
     usage: 'flow-archive <id> [--undo]                     — archive/unarchive a task (owner only)' },
-  { name: 'scan',         file: 'scan.mjs',          summary: 'Audit for TODOs, untracked Issues, unlinked PRs, security patterns',
-    usage: 'flow-scan [--todos] [--issues] [--prs] [--security]  — audit codebase for untracked work' },
+  { name: 'scan',         file: 'scan.mjs',          summary: 'Audit for TODOs, Issues, PRs, security patterns, untested changes',
+    usage: 'flow-scan [--todos] [--issues] [--prs] [--security] [--untested]  — audit codebase for untracked work' },
+  { name: 'scaffold-ci',  file: 'scaffold-ci.mjs',   summary: 'Drop a starter CI workflow + test skeleton into the repo',
+    usage: 'flow-scaffold-ci [--force] [--print]           — write .github/workflows/ci.yml + a test skeleton (Theme 35 P4)' },
   { name: 'close-sprint', file: 'close-sprint.mjs',  summary: 'Close a sprint milestone (owner only)',
     usage: 'flow-close-sprint --milestone=<name> [--archive-done]  — owner only' },
   { name: 'whoami',       file: 'whoami.mjs',        summary: 'Verify token and show current identity',

package/bin/scaffold-ci.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/* flow:scaffold-ci — drop a starter CI workflow + a test skeleton into the current repo, so a
+   Flow team gets a test/CI safety net by default instead of discovering it has none. Mirrors the
+   pattern Flow itself dogfoods: `node --check` over the code surface + `node --test`.
+
+   Usage: flow-scaffold-ci [--force] [--print]
+     --print   write nothing; print the files to stdout
+     --force   overwrite existing files (default: skip + warn)
+   Purely local — writes files, makes no network/API calls.
+*/
+
+import { writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+function die(msg) { process.stderr.write('flow-scaffold-ci: ' + msg + '\n'); process.exit(1); }
+
+const CI_YML = `name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install deps
+        if: \${{ hashFiles('package-lock.json') != '' }}
+        run: npm ci
+      - name: Syntax-check JS
+        run: git ls-files '*.js' '*.mjs' | xargs -r -n1 node --check
+      - name: Test
+        run: node --test
+`;
+
+const SMOKE_TEST = `/* Smoke test — the seed of your suite. Runs with \`node --test\` (no deps).
+   Replace with real tests as you build; \`flow scan --untested\` flags changed
+   files that still have none. */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+test('the test runner works', () => {
+  assert.equal(1 + 1, 2);
+});
+`;
+
+const FILES = [
+  { path: '.github/workflows/ci.yml', body: CI_YML },
+  { path: 'test/smoke.test.mjs', body: SMOKE_TEST },
+];
+
+function main() {
+  const args = process.argv.slice(2);
+
+  if (args.includes('--print')) {
+    for (const f of FILES) process.stdout.write(`\n===== ${f.path} =====\n${f.body}`);
+    return;
+  }
+
+  const force = args.includes('--force');
+  let wrote = 0, skipped = 0;
+  for (const f of FILES) {
+    if (existsSync(f.path) && !force) {
+      process.stdout.write(`skip  ${f.path} (exists — pass --force to overwrite)\n`);
+      skipped++;
+      continue;
+    }
+    mkdirSync(dirname(f.path), { recursive: true });
+    writeFileSync(f.path, f.body);
+    process.stdout.write(`write ${f.path}\n`);
+    wrote++;
+  }
+  process.stdout.write(`\n${wrote} written, ${skipped} skipped.`);
+  if (wrote) process.stdout.write(` Ensure package.json has a "test" script (or rely on \`node --test\`), commit, and push.`);
+  process.stdout.write('\n');
+}
+
+try { main(); } catch (e) { die(e.message || e); }

package/bin/scan.mjs

@@ -3,16 +3,17 @@
    Outputs numbered suggestions with ready-to-run flow-create commands.
 
    Usage:
-     flow-scan [--todos] [--issues] [--prs] [--security]
+     flow-scan [--todos] [--issues] [--prs] [--security] [--untested]
                [--dir=<path>]          default: cwd
                [--repo=<owner/repo>]   default: FLOW_GITHUB_REPO env var
-     (no flags = run all four scans)
+     (no flags = run all scans)
 */
 
 import 'dotenv/config';
 import { flowFetch, arg, die, sanitizeText } from './_client.mjs';
 import { githubHeaders } from './_github.mjs';
 import { readFileSync, readdirSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { join, extname, relative } from 'node:path';
 
 // ── File walker ────────────────────────────────────────────────────────────────
@@ -209,6 +210,52 @@ function scanSecurity(dir) {
   return out;
 }
 
+// ── Untested-changes scan (Theme 35 P4) ─────────────────────────────────────────
+// Flag changed source files that have no corresponding test. "Covered" = a *.test.* / *.spec.*
+// file, or any file under a test/tests/__tests__/spec dir, whose basename matches the source's.
+function isTestFile(p) {
+  return /\.(test|spec)\.[cm]?[jt]sx?$/i.test(p) || /(^|\/)(test|tests|__tests__|spec)\//i.test(p);
+}
+function coveredBasename(p) {
+  const base = p.split('/').pop();
+  // drop the test/spec suffix, then the extension, then a leading underscore (the `_helper.mjs`
+  // convention) so `_commands.mjs` matches `commands.test.js`.
+  return base.replace(/\.(test|spec)\.[cm]?[jt]sx?$/i, '').replace(/\.[cm]?[jt]sx?$/i, '').replace(/^_+/, '').toLowerCase();
+}
+function gitLines(dir, args) {
+  const r = spawnSync('git', args, { cwd: dir, encoding: 'utf8' });
+  return r.status === 0 ? r.stdout.split('\n').map(s => s.trim()).filter(Boolean) : null;
+}
+function changedFiles(dir) {
+  // prefer the diff vs the default branch's merge-base (the branch's work); fall back to the working tree
+  const base = (gitLines(dir, ['merge-base', 'HEAD', 'origin/main']) || gitLines(dir, ['merge-base', 'HEAD', 'main']) || [])[0];
+  if (base) { const d = gitLines(dir, ['diff', '--name-only', `${base}...HEAD`]); if (d && d.length) return d; }
+  const staged = gitLines(dir, ['diff', '--name-only', '--cached']) || [];
+  const unstaged = gitLines(dir, ['diff', '--name-only']) || [];
+  return [...new Set([...staged, ...unstaged])];
+}
+function scanUntested(dir) {
+  const changed = changedFiles(dir).map(f => f.replace(/\\/g, '/'));
+  const src = changed.filter(f => CODE_EXTS.has(extname(f)) && !isTestFile(f));
+  if (!src.length) return [];
+  // basenames that already have a test somewhere in the repo
+  const covered = new Set(
+    walkFiles(dir, () => true).map(f => relative(dir, f).replace(/\\/g, '/')).filter(isTestFile).map(coveredBasename),
+  );
+  const out = [];
+  for (const f of src) {
+    const bn = coveredBasename(f);
+    if (covered.has(bn)) continue;
+    const title = `Add tests for ${f.split('/').pop()}`.replace(/"/g, '\\"');
+    out.push({
+      label: `No test for ${f}`,
+      detail: `  ${f} — changed, but no *.test.* / test-dir file covers "${bn}"`,
+      cmd: `flow-create --title="${title}" --type=chore --area=infra`,
+    });
+  }
+  return out.slice(0, 25);
+}
+
 // ── Output ─────────────────────────────────────────────────────────────────────
 function printSection(heading, suggestions) {
   process.stdout.write(`\n${heading} (${suggestions.length})\n`);
@@ -227,7 +274,8 @@ async function main() {
   const doIssues   = argv.includes('--issues');
   const doPRs      = argv.includes('--prs');
   const doSecurity = argv.includes('--security');
-  const all = !doTodos && !doIssues && !doPRs && !doSecurity;
+  const doUntested = argv.includes('--untested');
+  const all = !doTodos && !doIssues && !doPRs && !doSecurity && !doUntested;
 
   const dir  = arg('dir') || process.cwd();
   const repo = arg('repo') || process.env.FLOW_GITHUB_REPO;
@@ -279,8 +327,15 @@ async function main() {
     else if (all) process.stdout.write('\n[security] No common patterns found.\n');
   }
 
+  if (all || doUntested) {
+    process.stdout.write('  [untested] checking changed files for tests...\n');
+    const s = scanUntested(dir);
+    if (doUntested || (all && s.length)) printSection('Changed files with no test', s); // CLI-2: flags combine
+    else if (all) process.stdout.write('\n[untested] All changed source files have a test (or no changes detected).\n');
+  }
+
   if (all) {
-    process.stdout.write('\nRun "flow-scan --todos / --issues / --prs / --security" for focused output.\n');
+    process.stdout.write('\nRun "flow-scan --todos / --issues / --prs / --security / --untested" for focused output.\n');
     process.stdout.write('Use any "$ flow-create ..." command above to create a tracking task.\n');
   }
 }

package/bin/verify.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+/* flow:verify — run the project's test command, record a pass/fail verification on the task
+   timeline, and exit with the command's status so an agent's harness can branch on the result.
+   Usage: flow-verify <task_id> [--cmd="npm test"] [--close]
+     command resolution:  --cmd  >  ./flow.config.json "verify_command"  >  "npm test"
+     --close  closes the task (flow-close) on a PASSING run.
+*/
+
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { flowFetch, resolveTaskId, positional, arg, die, sanitizeText } from './_client.mjs';
+
+function resolveCommand() {
+  const c = arg('cmd');
+  if (c) return c;
+  try {
+    const cfg = JSON.parse(readFileSync('flow.config.json', 'utf8'));
+    if (typeof cfg.verify_command === 'string' && cfg.verify_command.trim()) return cfg.verify_command;
+  } catch { /* no local config — fall through to the default */ }
+  return 'npm test';
+}
+
+async function main() {
+  const rawId = positional(0);
+  if (!rawId) die('Usage: flow-verify <task_id> [--cmd="npm test"] [--close]');
+  const id = await resolveTaskId(rawId);
+  const command = resolveCommand();
+  const doClose = process.argv.slice(2).includes('--close');
+  const shortRef = '#' + rawId.replace(/^#/, '').slice(0, 6);
+
+  process.stdout.write(`Running: ${command}\n`);
+  // spawnSync is blocking, so output is buffered then printed; the snippet below is what we record.
+  const r = spawnSync(command, { shell: true, stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8' });
+  const out = (r.stdout || '') + (r.stderr || '');
+  if (out) process.stdout.write(out.endsWith('\n') ? out : out + '\n');
+  const passed = r.status === 0;
+
+  // record the trailing ~20 non-empty lines as the audit snippet
+  const snippet = out.split('\n').filter(l => l.trim()).slice(-20).join('\n').slice(0, 4000);
+  await flowFetch('/api/flow/verify', { method: 'POST', body: { task_id: id, passed, command, summary: snippet } });
+  process.stdout.write(`${passed ? '✓ PASS' : '✗ FAIL'} — recorded on ${shortRef}\n`);
+
+  if (passed && doClose) {
+    await flowFetch('/api/flow/close', { method: 'POST', body: { task_id: id, summary: `Verified: ${sanitizeText(command, 100)}` } });
+    process.stdout.write(`Closed ${shortRef}.\n`);
+  }
+  process.exitCode = r.status ?? 1;
+}
+
+main().catch(e => die(e.message || e));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [
@@ -30,6 +30,8 @@
     "flow-project": "bin/project.mjs",
     "flow-close-sprint": "bin/close-sprint.mjs",
     "flow-review": "bin/review.mjs",
+    "flow-verify": "bin/verify.mjs",
+    "flow-scaffold-ci": "bin/scaffold-ci.mjs",
     "flow-login": "bin/login.mjs",
     "flow-edit": "bin/edit.mjs",
     "flow-unblock": "bin/unblock.mjs",