flowcollab 0.3.8 → 0.3.9

package/bin/_client.mjs

@@ -123,6 +123,19 @@ export function die(msg, code = 1) {
   process.exit(code);
 }
 
+// S14: strip ANSI / control chars and @to: tokens from server-supplied text (task
+// titles, decision titles) before printing — they reach another agent's trusted stdout.
+export function sanitizeText(s, maxLen = 120) {
+  if (!s || typeof s !== 'string') return '';
+  return s
+    .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
+    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
+    .replace(/@to:\S+/g, '[mention-stripped]')
+    .replace(/\r?\n|\r/g, ' ')
+    .trim()
+    .slice(0, maxLen);
+}
+
 export function arg(name, fallback) {
   const argv = process.argv.slice(2);
   for (let i = 0; i < argv.length; i++) {
@@ -157,10 +170,10 @@ export async function resolveTaskId(input) {
   const decRes = await flowFetch('/api/flow/decisions');
   const taskMatches = allTasks.filter(t => typeof t.id === 'string' && t.id.startsWith(stripped));
   if (taskMatches.length === 1) return taskMatches[0].id;
-  if (taskMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${taskMatches.length} tasks:\n${taskMatches.map(t => `  #${t.id.slice(0, 6)}  ${t.title}`).join('\n')}`);
+  if (taskMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${taskMatches.length} tasks:\n${taskMatches.map(t => `  #${t.id.slice(0, 6)}  ${sanitizeText(t.title)}`).join('\n')}`);
   const decisions = decRes.decisions || [];
   const decMatches = decisions.filter(d => d.id.startsWith(stripped));
   if (decMatches.length === 0) throw new Error(`No task or decision found with ID prefix "${stripped}". Run \`flow-pull\` to see your current tasks.`);
-  if (decMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${decMatches.length} decisions:\n${decMatches.map(d => `  #${d.id.slice(0, 6)}  ${d.proposal_title || ''}`).join('\n')}`);
+  if (decMatches.length > 1) throw new Error(`Ambiguous prefix "${stripped}" matches ${decMatches.length} decisions:\n${decMatches.map(d => `  #${d.id.slice(0, 6)}  ${sanitizeText(d.proposal_title || '')}`).join('\n')}`);
   return decMatches[0].id;
 }

package/bin/decisions.mjs

@@ -19,7 +19,7 @@
      --timeout=<sec>     give up after N seconds, default 1800 (30 min); 0 = forever
 */
 
-import { flowFetch, resolveTaskId, arg, positional, die } from './_client.mjs';
+import { flowFetch, resolveTaskId, arg, positional, die, sanitizeText } from './_client.mjs';
 
 const sleep = (ms) => new Promise(r => setTimeout(r, ms));
 
@@ -36,10 +36,10 @@ async function list() {
   }
   process.stdout.write(`${decisions.length} pending decision${decisions.length === 1 ? '' : 's'}:\n\n`);
   for (const d of decisions) {
-    process.stdout.write(`#${d.id.slice(0, 6)}  ${d.proposal_title}\n`);
+    process.stdout.write(`#${d.id.slice(0, 6)}  ${sanitizeText(d.proposal_title)}\n`);
     if (d.parent_task_id) {
       const p = taskById.get(d.parent_task_id);
-      const ref = p ? `#${p.id.slice(0, 6)} — "${p.title}"` : `#${d.parent_task_id.slice(0, 6)}`;
+      const ref = p ? `#${p.id.slice(0, 6)} — "${sanitizeText(p.title)}"` : `#${d.parent_task_id.slice(0, 6)}`;
       process.stdout.write(`  Parent: ${ref}\n`);
     }
     process.stdout.write(`  Confidence: ${d.confidence}  |  Suggest: ${d.suggested_assignee_id || '-'} / ${d.suggested_priority || '-'} / ${d.suggested_type || '-'}\n`);

package/bin/scan.mjs

@@ -19,16 +19,23 @@ import { join, extname, relative } from 'node:path';
 const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.next', '__pycache__', 'vendor', '.cache', 'out']);
 const CODE_EXTS = new Set(['.js', '.mjs', '.ts', '.tsx', '.jsx', '.py', '.go', '.rb', '.java', '.sh', '.rs', '.c', '.cpp', '.h', '.cs', '.php', '.vue', '.svelte']);
 
-function walkFiles(dir, base) {
+// S13: the security scan also looks at config/secret files (where keys actually live).
+const SEC_EXTS = new Set([...CODE_EXTS, '.json', '.yml', '.yaml', '.toml', '.ini', '.cfg', '.conf', '.properties', '.xml', '.pem', '.key']);
+function secMatch(name) {
+  return SEC_EXTS.has(extname(name)) || name.startsWith('.env') || name === '.npmrc' || name === '.netrc';
+}
+
+function walkFiles(dir, match, base) {
   base = base || dir;
+  match = match || ((name) => CODE_EXTS.has(extname(name)));
   const out = [];
   let entries;
   try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return out; }
   for (const e of entries) {
     if (SKIP_DIRS.has(e.name)) continue;
     const full = join(dir, e.name);
-    if (e.isDirectory()) { out.push(...walkFiles(full, base)); continue; }
-    if (CODE_EXTS.has(extname(e.name))) out.push(full);
+    if (e.isDirectory()) { out.push(...walkFiles(full, match, base)); continue; }
+    if (match(e.name)) out.push(full);
   }
   return out;
 }
@@ -140,6 +147,10 @@ async function scanPRs(repo) {
 // ── Security scan ──────────────────────────────────────────────────────────────
 const SEC_PATTERNS = [
   { re: /(['"`])(sk_live_|AKIA[0-9A-Z]{16}|ghp_[0-9A-Za-z]{36}|github_pat_[0-9A-Za-z]{36}|glpat-[0-9A-Za-z]{20}|xox[bpas]-[0-9A-Za-z-]{10,})[0-9A-Za-z-]*\1/i, label: 'Hardcoded secret (live key pattern)' },
+  // S13: same prefixes but UNQUOTED (e.g. KEY=value in .env), variable length
+  { re: /\b(sk_(?:live|test)_[0-9A-Za-z]{10,}|whsec_[0-9A-Za-z]{10,}|ghp_[0-9A-Za-z]{20,}|github_pat_[0-9A-Za-z_]{20,}|glpat-[0-9A-Za-z_-]{15,}|xox[bpas]-[0-9A-Za-z-]{10,}|AKIA[0-9A-Z]{16})\b/, label: 'Secret token (unquoted key prefix)' },
+  // S13: env-style assignment of a secret-named variable (KEY=value, no quotes needed)
+  { re: /(?:^|\b)[A-Za-z][A-Za-z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|API_?KEY|PRIVATE_KEY|ACCESS_KEY)\s*=\s*\S{6,}/i, label: 'Secret in env-style assignment' },
   { re: /\beval\s*\(/,                                                               label: 'eval() usage (code injection risk)' },
   { re: /dangerouslySetInnerHTML/,                                                   label: 'dangerouslySetInnerHTML (XSS risk)' },
   { re: /(?:child_process.*\.(?:exec|execSync|spawn|spawnSync)\s*\(|execSync\s*\(|require\(['"]child_process['"]\))/,  label: 'exec/spawn call (command injection risk)' },
@@ -150,7 +161,8 @@ const SEC_PATTERNS = [
   { re: /(?:password|secret|apikey|api_key|access_token)\s*(?:=|:)\s*['"`][^'"`]{6,}/i, label: 'Possible hardcoded credential' },
 ];
 
-function scanSecurity(files, dir) {
+function scanSecurity(dir) {
+  const files = walkFiles(dir, secMatch); // S13: include config/.env/secret files
   const out = [];
   for (const { re, label } of SEC_PATTERNS) {
     const hits = grepLines(files, re);
@@ -194,7 +206,7 @@ async function main() {
   if (repo) process.stdout.write(`  repo: ${repo}\n`);
   process.stdout.write('\n');
 
-  const needFiles = all || doTodos || doSecurity;
+  const needFiles = all || doTodos; // security walks its own (broader) file set
   const files = needFiles ? walkFiles(dir) : [];
   if (needFiles) process.stdout.write(`  scanning ${files.length} source files...\n`);
 
@@ -230,7 +242,7 @@ async function main() {
 
   if (all || doSecurity) {
     process.stdout.write('  [security] scanning patterns...\n');
-    const s = scanSecurity(files, dir);
+    const s = scanSecurity(dir);
     if (doSecurity) { printSection('Security concerns', s); return; }
     if (all && s.length) printSection('Security concerns', s);
     else if (all) process.stdout.write('\n[security] No common patterns found.\n');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowcollab",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Multi-Claude coordination layer — shared task board + CLI for teams running Claude Code",
   "type": "module",
   "files": [