flowcollab 0.3.22 → 0.3.24

package/bin/_commands.mjs

@@ -66,8 +66,10 @@ export const CLI_COMMANDS = [
     usage: 'flow-project [--project=<node_id>]             — list GitHub Projects v2 items' },
   { name: 'archive',      file: 'archive.mjs',       summary: 'Archive or unarchive a task (--undo to restore)',
     usage: 'flow-archive <id> [--undo]                     — archive/unarchive a task (owner only)' },
-  { name: 'scan',         file: 'scan.mjs',          summary: 'Audit for TODOs, untracked Issues, unlinked PRs, security patterns',
-    usage: 'flow-scan [--todos] [--issues] [--prs] [--security]  — audit codebase for untracked work' },
+  { name: 'scan',         file: 'scan.mjs',          summary: 'Audit for TODOs, Issues, PRs, security patterns, untested changes',
+    usage: 'flow-scan [--todos] [--issues] [--prs] [--security] [--untested]  — audit codebase for untracked work' },
+  { name: 'scaffold-ci',  file: 'scaffold-ci.mjs',   summary: 'Drop a starter CI workflow + test skeleton into the repo',
+    usage: 'flow-scaffold-ci [--force] [--print]           — write .github/workflows/ci.yml + a test skeleton (Theme 35 P4)' },
   { name: 'close-sprint', file: 'close-sprint.mjs',  summary: 'Close a sprint milestone (owner only)',
     usage: 'flow-close-sprint --milestone=<name> [--archive-done]  — owner only' },
   { name: 'whoami',       file: 'whoami.mjs',        summary: 'Verify token and show current identity',

package/bin/scaffold-ci.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/* flow:scaffold-ci — drop a starter CI workflow + a test skeleton into the current repo, so a
+   Flow team gets a test/CI safety net by default instead of discovering it has none. Mirrors the
+   pattern Flow itself dogfoods: `node --check` over the code surface + `node --test`.
+
+   Usage: flow-scaffold-ci [--force] [--print]
+     --print   write nothing; print the files to stdout
+     --force   overwrite existing files (default: skip + warn)
+   Purely local — writes files, makes no network/API calls.
+*/
+
+import { writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+function die(msg) { process.stderr.write('flow-scaffold-ci: ' + msg + '\n'); process.exit(1); }
+
+const CI_YML = `name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Install deps
+        if: \${{ hashFiles('package-lock.json') != '' }}
+        run: npm ci
+      - name: Syntax-check JS
+        run: git ls-files '*.js' '*.mjs' | xargs -r -n1 node --check
+      - name: Test
+        run: node --test
+`;
+
+const SMOKE_TEST = `/* Smoke test — the seed of your suite. Runs with \`node --test\` (no deps).
+   Replace with real tests as you build; \`flow scan --untested\` flags changed
+   files that still have none. */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+test('the test runner works', () => {
+  assert.equal(1 + 1, 2);
+});
+`;
+
+const FILES = [
+  { path: '.github/workflows/ci.yml', body: CI_YML },
+  { path: 'test/smoke.test.mjs', body: SMOKE_TEST },
+];
+
+function main() {
+  const args = process.argv.slice(2);
+
+  if (args.includes('--print')) {
+    for (const f of FILES) process.stdout.write(`\n===== ${f.path} =====\n${f.body}`);
+    return;
+  }
+
+  const force = args.includes('--force');
+  let wrote = 0, skipped = 0;
+  for (const f of FILES) {
+    if (existsSync(f.path) && !force) {
+      process.stdout.write(`skip  ${f.path} (exists — pass --force to overwrite)\n`);
+      skipped++;
+      continue;
+    }
+    mkdirSync(dirname(f.path), { recursive: true });
+    writeFileSync(f.path, f.body);
+    process.stdout.write(`write ${f.path}\n`);
+    wrote++;
+  }
+  process.stdout.write(`\n${wrote} written, ${skipped} skipped.`);
+  if (wrote) process.stdout.write(` Ensure package.json has a "test" script (or rely on \`node --test\`), commit, and push.`);
+  process.stdout.write('\n');
+}
+
+try { main(); } catch (e) { die(e.message || e); }

package/bin/scan.mjs

@@ -3,16 +3,17 @@
    Outputs numbered suggestions with ready-to-run flow-create commands.
 
    Usage:
-     flow-scan [--todos] [--issues] [--prs] [--security]
+     flow-scan [--todos] [--issues] [--prs] [--security] [--untested]
                [--dir=<path>]          default: cwd
                [--repo=<owner/repo>]   default: FLOW_GITHUB_REPO env var
-     (no flags = run all four scans)
+     (no flags = run all scans)
 */
 
 import 'dotenv/config';
 import { flowFetch, arg, die, sanitizeText } from './_client.mjs';
 import { githubHeaders } from './_github.mjs';
 import { readFileSync, readdirSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { join, extname, relative } from 'node:path';
 
 // ── File walker ────────────────────────────────────────────────────────────────
@@ -209,6 +210,52 @@ function scanSecurity(dir) {
   return out;
 }
 
+// ── Untested-changes scan (Theme 35 P4) ─────────────────────────────────────────
+// Flag changed source files that have no corresponding test. "Covered" = a *.test.* / *.spec.*
+// file, or any file under a test/tests/__tests__/spec dir, whose basename matches the source's.
+function isTestFile(p) {
+  return /\.(test|spec)\.[cm]?[jt]sx?$/i.test(p) || /(^|\/)(test|tests|__tests__|spec)\//i.test(p);
+}
+function coveredBasename(p) {
+  const base = p.split('/').pop();
+  // drop the test/spec suffix, then the extension, then a leading underscore (the `_helper.mjs`
+  // convention) so `_commands.mjs` matches `commands.test.js`.
+  return base.replace(/\.(test|spec)\.[cm]?[jt]sx?$/i, '').replace(/\.[cm]?[jt]sx?$/i, '').replace(/^_+/, '').toLowerCase();
+}
+function gitLines(dir, args) {
+  const r = spawnSync('git', args, { cwd: dir, encoding: 'utf8' });
+  return r.status === 0 ? r.stdout.split('\n').map(s => s.trim()).filter(Boolean) : null;
+}
+function changedFiles(dir) {
+  // prefer the diff vs the default branch's merge-base (the branch's work); fall back to the working tree
+  const base = (gitLines(dir, ['merge-base', 'HEAD', 'origin/main']) || gitLines(dir, ['merge-base', 'HEAD', 'main']) || [])[0];
+  if (base) { const d = gitLines(dir, ['diff', '--name-only', `${base}...HEAD`]); if (d && d.length) return d; }
+  const staged = gitLines(dir, ['diff', '--name-only', '--cached']) || [];
+  const unstaged = gitLines(dir, ['diff', '--name-only']) || [];
+  return [...new Set([...staged, ...unstaged])];
+}
+function scanUntested(dir) {
+  const changed = changedFiles(dir).map(f => f.replace(/\\/g, '/'));
+  const src = changed.filter(f => CODE_EXTS.has(extname(f)) && !isTestFile(f));
+  if (!src.length) return [];
+  // basenames that already have a test somewhere in the repo
+  const covered = new Set(
+    walkFiles(dir, () => true).map(f => relative(dir, f).replace(/\\/g, '/')).filter(isTestFile).map(coveredBasename),
+  );
+  const out = [];
+  for (const f of src) {
+    const bn = coveredBasename(f);
+    if (covered.has(bn)) continue;
+    const title = `Add tests for ${f.split('/').pop()}`.replace(/"/g, '\\"');
+    out.push({
+      label: `No test for ${f}`,
+      detail: `  ${f} — changed, but no *.test.* / test-dir file covers "${bn}"`,
+      cmd: `flow-create --title="${title}" --type=chore --area=infra`,
+    });
+  }
+  return out.slice(0, 25);
+}
+
 // ── Output ─────────────────────────────────────────────────────────────────────
 function printSection(heading, suggestions) {
   process.stdout.write(`\n${heading} (${suggestions.length})\n`);
@@ -227,7 +274,8 @@ async function main() {
   const doIssues   = argv.includes('--issues');
   const doPRs      = argv.includes('--prs');
   const doSecurity = argv.includes('--security');
-  const all = !doTodos && !doIssues && !doPRs && !doSecurity;
+  const doUntested = argv.includes('--untested');
+  const all = !doTodos && !doIssues && !doPRs && !doSecurity && !doUntested;
 
   const dir  = arg('dir') || process.cwd();
   const repo = arg('repo') || process.env.FLOW_GITHUB_REPO;
@@ -279,8 +327,15 @@ async function main() {
     else if (all) process.stdout.write('\n[security] No common patterns found.\n');
   }
 
+  if (all || doUntested) {
+    process.stdout.write('  [untested] checking changed files for tests...\n');
+    const s = scanUntested(dir);
+    if (doUntested || (all && s.length)) printSection('Changed files with no test', s); // CLI-2: flags combine
+    else if (all) process.stdout.write('\n[untested] All changed source files have a test (or no changes detected).\n');
+  }
+
   if (all) {
-    process.stdout.write('\nRun "flow-scan --todos / --issues / --prs / --security" for focused output.\n');
+    process.stdout.write('\nRun "flow-scan --todos / --issues / --prs / --security / --untested" for focused output.\n');
     process.stdout.write('Use any "$ flow-create ..." command above to create a tracking task.\n');
   }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flowcollab",
-  "version": "0.3.22",
-  "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
+  "version": "0.3.24",
+  "description": "Multi-Claude coordination layer — shared task board CLI for teams running Claude Code",
   "type": "module",
   "files": [
     "bin/"
@@ -31,6 +31,7 @@
     "flow-close-sprint": "bin/close-sprint.mjs",
     "flow-review": "bin/review.mjs",
     "flow-verify": "bin/verify.mjs",
+    "flow-scaffold-ci": "bin/scaffold-ci.mjs",
     "flow-login": "bin/login.mjs",
     "flow-edit": "bin/edit.mjs",
     "flow-unblock": "bin/unblock.mjs",
@@ -39,28 +40,8 @@
     "flow-archive": "bin/archive.mjs",
     "flow-scan": "bin/scan.mjs"
   },
-  "scripts": {
-    "build": "node scripts/build.mjs",
-    "dev": "node scripts/build.mjs --watch",
-    "start": "node scripts/build.mjs && node --use-system-ca server.js",
-    "start:prod": "node scripts/build.mjs && node server.js",
-    "test": "node --test test/*.test.js",
-    "test:integration": "node --test test/*.integration.test.mjs",
-    "test:ui": "node --test test/*.browser.test.mjs"
-  },
   "dependencies": {
-    "dotenv": "^16.4.7",
-    "web-push": "^3.6.7"
-  },
-  "devDependencies": {
-    "@supabase/supabase-js": "^2.49.4",
-    "esbuild": "^0.28.0",
-    "express": "^4.0.0 || ^5.0.0",
-    "express-rate-limit": "^7.5.0",
-    "helmet": "^8.0.0",
-    "playwright": "^1.60.0",
-    "stripe": "^22.2.0",
-    "zod": "^3.24.1"
+    "dotenv": "^16.4.7"
   },
   "engines": {
     "node": ">=22"

package/LICENSE

@@ -1,6 +0,0 @@
-Copyright (c) 2026 Greylock Labs. All rights reserved.
-
-Permission is granted to download and use this CLI software solely for the
-purpose of accessing the Flow hosted service. No part of this software may be
-reproduced, distributed, modified, or transmitted in any form or by any means
-without the prior written permission of the copyright holder.