flowcollab 0.3.5 → 0.3.6

package/bin/_client.mjs

@@ -144,12 +144,18 @@ export async function resolveTaskId(input) {
   if (!input) return input;
   const stripped = input.replace(/^#/, '');
   if (UUID_RE.test(stripped)) return stripped;
-  const [tasksRes, decRes] = await Promise.all([
-    flowFetch('/api/flow/tasks?limit=500'),
-    flowFetch('/api/flow/decisions'),
-  ]);
-  const list = Array.isArray(tasksRes) ? tasksRes : (tasksRes.tasks ?? []);
-  const taskMatches = list.filter(t => t.id.startsWith(stripped));
+  // Paginate through all tasks (boards > 500 tasks would silently miss with a single page)
+  let allTasks = [];
+  let cursor = null;
+  do {
+    const url = '/api/flow/tasks?limit=200' + (cursor ? `&cursor=${encodeURIComponent(cursor)}` : '');
+    const page = await flowFetch(url);
+    const items = Array.isArray(page) ? page : (page.tasks ?? []);
+    allTasks = allTasks.concat(items);
+    cursor = page.has_more ? page.next_cursor : null;
+  } while (cursor);
+  const decRes = await flowFetch('/api/flow/decisions');
+  const taskMatches = allTasks.filter(t => typeof t.id === 'string' && t.id.startsWith(stripped));
   if (taskMatches.length === 1) return taskMatches[0].id;
   if (taskMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${taskMatches.length} tasks:\n${taskMatches.map(t => `  #${t.id.slice(0, 6)}  ${t.title}`).join('\n')}`);
   const decisions = decRes.decisions || [];

package/bin/flow.mjs

@@ -105,4 +105,9 @@ if (!target) {
 // read [--focus] — identical to what flow-pull sees when called directly.
 process.argv.splice(2, 1);
 
-await import(new URL(target, import.meta.url));
+try {
+  await import(new URL(target, import.meta.url));
+} catch (e) {
+  process.stderr.write(`flow ${sub}: ${e.message || e}\n`);
+  process.exit(1);
+}

package/bin/scan.mjs

@@ -68,14 +68,21 @@ function scanTodos(files, dir) {
 }
 
 // ── GitHub Issues scan ─────────────────────────────────────────────────────────
+async function fetchGitHub(url) {
+  const res = await fetch(url, { headers: githubHeaders() });
+  if (res.status === 429 || res.status === 403) {
+    const reset = res.headers.get('x-ratelimit-reset');
+    const wait = reset ? new Date(Number(reset) * 1000).toLocaleTimeString() : 'soon';
+    throw new Error(`GitHub rate limit exceeded — resets at ${wait}`);
+  }
+  if (!res.ok) throw new Error(`GitHub API ${res.status}: ${res.statusText}`);
+  return res.json();
+}
+
 async function fetchGitHubIssues(repo) {
   const all = [];
   for (let page = 1; page <= 5; page++) {
-    const res = await fetch(`https://api.github.com/repos/${repo}/issues?state=open&per_page=100&page=${page}`, {
-      headers: githubHeaders(),
-    });
-    if (!res.ok) throw new Error(`GitHub API ${res.status}`);
-    const batch = await res.json();
+    const batch = await fetchGitHub(`https://api.github.com/repos/${repo}/issues?state=open&per_page=100&page=${page}`);
     all.push(...batch.filter(i => !i.pull_request));
     if (batch.length < 100) break;
   }
@@ -105,11 +112,7 @@ async function scanIssues(repo) {
 async function fetchGitHubPRs(repo) {
   const all = [];
   for (let page = 1; page <= 3; page++) {
-    const res = await fetch(`https://api.github.com/repos/${repo}/pulls?state=open&per_page=100&page=${page}`, {
-      headers: githubHeaders(),
-    });
-    if (!res.ok) throw new Error(`GitHub API ${res.status}`);
-    const batch = await res.json();
+    const batch = await fetchGitHub(`https://api.github.com/repos/${repo}/pulls?state=open&per_page=100&page=${page}`);
     all.push(...batch);
     if (batch.length < 100) break;
   }
@@ -136,14 +139,15 @@ async function scanPRs(repo) {
 
 // ── Security scan ──────────────────────────────────────────────────────────────
 const SEC_PATTERNS = [
-  { re: /(['"`])(sk_live_|AKIA[0-9A-Z]{16}|ghp_[0-9A-Za-z]{36})[0-9A-Za-z]+\1/i, label: 'Hardcoded secret (live key pattern)' },
+  { re: /(['"`])(sk_live_|AKIA[0-9A-Z]{16}|ghp_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z]{36}|glpat-[0-9A-Za-z]{20}|xox[bpas]-[0-9A-Za-z-]{10,})[0-9A-Za-z-]*\1/i, label: 'Hardcoded secret (live key pattern)' },
   { re: /\beval\s*\(/,                                                               label: 'eval() usage (code injection risk)' },
   { re: /dangerouslySetInnerHTML/,                                                   label: 'dangerouslySetInnerHTML (XSS risk)' },
-  { re: /child_process.*\.exec\s*\(/,                                                label: 'exec() call (command injection risk)' },
+  { re: /(?:child_process.*\.(?:exec|execSync|spawn|spawnSync)\s*\(|execSync\s*\(|require\(['"]child_process['"]\))/,  label: 'exec/spawn call (command injection risk)' },
   { re: /\.query\s*\(`[^`]*\$\{/,                                                   label: 'Template literal in SQL query (injection risk)' },
+  { re: /['"`]\s*\+\s*(?:req\.|request\.|body\.|params\.|query\.|input)/,           label: 'String concatenation in query (injection risk)' },
   { re: /new\s+Function\s*\(/,                                                       label: 'new Function() (eval-equivalent)' },
   { re: /require\s*\(\s*(?:req\.|request\.|body\.|params\.|query\.)/,               label: 'Dynamic require() from request input' },
-  { re: /(?:password|secret|apikey)\s*(?:=|:)\s*['"`][^'"`]{6,}/i,                 label: 'Possible hardcoded credential' },
+  { re: /(?:password|secret|apikey|api_key|access_token)\s*(?:=|:)\s*['"`][^'"`]{6,}/i, label: 'Possible hardcoded credential' },
 ];
 
 function scanSecurity(files, dir) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [