specweave 1.0.351 → 1.0.352

package/plugins/specweave-github/lib/enhanced-github-sync.js

@@ -27,9 +27,10 @@ async function syncSpecWithEnhancedContent(options) {
       console.log(`\u{1F517} Found ${mapping.increments.length} related increments`);
       console.log(`\u{1F4CB} Mapped ${Object.keys(mapping.userStoryMappings).length} user stories to tasks`);
     }
-    const taskMapping = buildTaskMapping(mapping.increments, owner, repo);
+    const defaultBranch = (owner && repo) ? await getDefaultBranch(owner, repo) : null;
+    const taskMapping = buildTaskMapping(mapping.increments, owner, repo, defaultBranch);
     const architectureDocs = await findArchitectureDocs(rootDir, specId);
-    const sourceLinks = buildSourceLinks(mapping.increments[0]?.id, owner, repo);
+    const sourceLinks = buildSourceLinks(mapping.increments[0]?.id, owner, repo, defaultBranch);
     const enhancedSpec = {
       ...baseSpec,
       summary: baseSpec.description,
@@ -153,7 +154,33 @@ async function findSpecWeaveRoot(specPath) {
     }
   }
 }
-function buildTaskMapping(increments, owner, repo) {
+// Cache for default branch per repo per session
+const defaultBranchCache = new Map();
+
+async function getDefaultBranch(owner, repo) {
+  const cacheKey = `${owner}/${repo}`;
+  if (defaultBranchCache.has(cacheKey)) {
+    return defaultBranchCache.get(cacheKey);
+  }
+  try {
+    const { execFileSync } = await import("child_process");
+    const result = execFileSync("gh", [
+      "repo", "view", `${owner}/${repo}`,
+      "--json", "defaultBranchRef",
+      "--jq", ".defaultBranchRef.name"
+    ], { encoding: "utf-8", timeout: 10000 }).trim();
+    if (result) {
+      defaultBranchCache.set(cacheKey, result);
+      return result;
+    }
+  } catch {
+    // On failure, return null — callers omit branch segment
+  }
+  defaultBranchCache.set(cacheKey, null);
+  return null;
+}
+
+function buildTaskMapping(increments, owner, repo, defaultBranch) {
   if (increments.length === 0) return void 0;
   const firstIncrement = increments[0];
   const tasks = firstIncrement.tasks.map((task) => ({
@@ -162,10 +189,11 @@ function buildTaskMapping(increments, owner, repo) {
     userStories: task.userStories,
     githubIssue: task.githubIssue
   }));
+  const branchSegment = defaultBranch ? `/blob/${defaultBranch}` : "";
   return {
     incrementId: firstIncrement.id,
     tasks,
-    tasksUrl: `https://github.com/${owner}/${repo}/blob/develop/.specweave/increments/${firstIncrement.id}/tasks.md`
+    tasksUrl: `https://github.com/${owner}/${repo}${branchSegment}/.specweave/increments/${firstIncrement.id}/tasks.md`
   };
 }
 async function findArchitectureDocs(rootDir, specId) {
@@ -198,9 +226,10 @@ async function findArchitectureDocs(rootDir, specId) {
   }
   return docs;
 }
-function buildSourceLinks(incrementId, owner, repo) {
+function buildSourceLinks(incrementId, owner, repo, defaultBranch) {
   if (!incrementId) return void 0;
-  const baseUrl = `https://github.com/${owner}/${repo}/blob/develop/.specweave`;
+  const branchSegment = defaultBranch ? `/blob/${defaultBranch}` : "";
+  const baseUrl = `https://github.com/${owner}/${repo}${branchSegment}/.specweave`;
   return {
     spec: `${baseUrl}/docs/internal/specs/default/spec-${incrementId.replace(/^\d+-/, "")}.md`,
     plan: `${baseUrl}/increments/${incrementId}/plan.md`,

package/plugins/specweave-github/lib/github-board-resolver.js

@@ -15,9 +15,9 @@ async function fetchBoardsForRepo(owner, repo) {
       "-H",
       "Accept: application/vnd.github+json"
     ], { env: getGhEnv() });
-    if (result.status !== 0) {
+    if (result.exitCode !== 0) {
       console.error(`\u274C Failed to fetch boards for ${owner}/${repo}:`, result.stderr);
-      throw new Error(`GitHub API error: ${result.status} ${result.stderr}`);
+      throw new Error(`GitHub API error (exit code ${result.exitCode}): ${result.stderr}`);
     }
     const boards = result.stdout.trim().split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
     console.log(`\u2705 Found ${boards.length} board(s) for repo ${owner}/${repo}`);
@@ -38,9 +38,9 @@ async function fetchBoardsForOrg(org) {
       "-H",
       "Accept: application/vnd.github+json"
     ], { env: getGhEnv() });
-    if (result.status !== 0) {
+    if (result.exitCode !== 0) {
       console.error(`\u274C Failed to fetch boards for org ${org}:`, result.stderr);
-      throw new Error(`GitHub API error: ${result.status} ${result.stderr}`);
+      throw new Error(`GitHub API error (exit code ${result.exitCode}): ${result.stderr}`);
     }
     const boards = result.stdout.trim().split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
     console.log(`\u2705 Found ${boards.length} board(s) for org ${org}`);

package/plugins/specweave-github/lib/github-board-resolver.ts

@@ -54,9 +54,9 @@ export async function fetchBoardsForRepo(
       'Accept: application/vnd.github+json',
     ], { env: getGhEnv() });
 
-    if (result.status !== 0) {
+    if (result.exitCode !== 0) {
       console.error(`❌ Failed to fetch boards for ${owner}/${repo}:`, result.stderr);
-      throw new Error(`GitHub API error: ${result.status} ${result.stderr}`);
+      throw new Error(`GitHub API error (exit code ${result.exitCode}): ${result.stderr}`);
     }
 
     // Parse JSONL (one JSON object per line)
@@ -98,9 +98,9 @@ export async function fetchBoardsForOrg(
       'Accept: application/vnd.github+json',
     ], { env: getGhEnv() });
 
-    if (result.status !== 0) {
+    if (result.exitCode !== 0) {
       console.error(`❌ Failed to fetch boards for org ${org}:`, result.stderr);
-      throw new Error(`GitHub API error: ${result.status} ${result.stderr}`);
+      throw new Error(`GitHub API error (exit code ${result.exitCode}): ${result.stderr}`);
     }
 
     // Parse JSONL

package/plugins/specweave-github/lib/github-client-v2.js

@@ -103,13 +103,14 @@ class GitHubClientV2 {
   /**
    * Create or get existing milestone
    */
-  async createOrGetMilestone(title, description, daysFromNow = 2) {
+  async createOrGetMilestone(title, description, daysFromNow) {
+    const dueDays = daysFromNow ?? 2;
     const existing = await this.getMilestoneByTitle(title);
     if (existing) {
       return existing;
     }
     const dueDate = /* @__PURE__ */ new Date();
-    dueDate.setDate(dueDate.getDate() + daysFromNow);
+    dueDate.setDate(dueDate.getDate() + dueDays);
     const dueDateISO = dueDate.toISOString();
     const args = [
       "api",
@@ -136,7 +137,7 @@ class GitHubClientV2 {
   async getMilestoneByTitle(title) {
     const result = await execFileNoThrow("gh", [
       "api",
-      `repos/${this.fullRepo}/milestones`,
+      `repos/${this.fullRepo}/milestones?per_page=100&state=all`,
       "--jq",
       `.[] | select(.title=="${title}") | {number: .number, title: .title, description: .description, state: .state}`
     ], { env: this.getGhEnv() });
@@ -477,10 +478,9 @@ ${body}`;
   async getLastComment(issueNumber) {
     const result = await execFileNoThrow("gh", [
       "api",
-      `repos/${this.fullRepo}/issues/${issueNumber}/comments`,
+      `repos/${this.fullRepo}/issues/${issueNumber}/comments?sort=created&direction=desc&per_page=1`,
       "--jq",
-      ".[-1] | {body: .body, author: .user.login}"
-      // Get last comment only
+      ".[0] | {body: .body, author: .user.login}"
     ], { env: this.getGhEnv() });
     if (result.exitCode !== 0) {
       return null;

package/plugins/specweave-github/lib/github-client-v2.ts

@@ -148,17 +148,20 @@ export class GitHubClientV2 {
   async createOrGetMilestone(
     title: string,
     description?: string,
-    daysFromNow: number = 2
+    daysFromNow?: number
   ): Promise<GitHubMilestone> {
+    // Use configured value or default to 2 days
+    const dueDays = daysFromNow ?? 2;
+
     // Check if milestone already exists
     const existing = await this.getMilestoneByTitle(title);
     if (existing) {
       return existing;
     }
 
-    // Calculate due date
+    // Calculate due date from creation timestamp
     const dueDate = new Date();
-    dueDate.setDate(dueDate.getDate() + daysFromNow);
+    dueDate.setDate(dueDate.getDate() + dueDays);
     const dueDateISO = dueDate.toISOString();
 
     // Build API request
@@ -194,7 +197,7 @@ export class GitHubClientV2 {
   ): Promise<GitHubMilestone | null> {
     const result = await execFileNoThrow('gh', [
       'api',
-      `repos/${this.fullRepo}/milestones`,
+      `repos/${this.fullRepo}/milestones?per_page=100&state=all`,
       '--jq',
       `.[] | select(.title=="${title}") | {number: .number, title: .title, description: .description, state: .state}`,
     ], { env: this.getGhEnv() });
@@ -607,12 +610,13 @@ export class GitHubClientV2 {
    * Returns the most recent comment body, or null if no comments exist
    */
   async getLastComment(issueNumber: number): Promise<{body: string; author: string} | null> {
-    // Get all comments (sorted by creation date, newest last)
+    // Query the last comment directly using per_page=1 + page from last page
+    // sort=created&direction=desc gives newest first, per_page=1 returns just one
     const result = await execFileNoThrow('gh', [
       'api',
-      `repos/${this.fullRepo}/issues/${issueNumber}/comments`,
+      `repos/${this.fullRepo}/issues/${issueNumber}/comments?sort=created&direction=desc&per_page=1`,
       '--jq',
-      '.[-1] | {body: .body, author: .user.login}',  // Get last comment only
+      '.[0] | {body: .body, author: .user.login}',
     ], { env: this.getGhEnv() });
 
     if (result.exitCode !== 0) {

package/plugins/specweave-github/lib/github-client.js

@@ -40,15 +40,16 @@ class GitHubClient {
    *
    * @param title Milestone title
    * @param description Milestone description
-   * @param daysFromNow Days until milestone due (default: 2 days - SpecWeave AI velocity)
+   * @param daysFromNow Days until milestone due (configurable via github.milestoneDueDays, default: 2)
    */
-  async createOrGetMilestone(title, description, daysFromNow = 2) {
+  async createOrGetMilestone(title, description, daysFromNow) {
+    const dueDays = daysFromNow ?? 2;
     const existing = await this.getMilestoneByTitle(title);
     if (existing) {
       return existing;
     }
     const dueDate = /* @__PURE__ */ new Date();
-    dueDate.setDate(dueDate.getDate() + daysFromNow);
+    dueDate.setDate(dueDate.getDate() + dueDays);
     const dueDateISO = dueDate.toISOString();
     const cmd = `gh api repos/${this.repo}/milestones -f title="${title}" ${description ? `-f description="${description}"` : ""} -f due_on="${dueDateISO}" --jq '{number: .number, title: .title, description: .description, state: .state, due_on: .due_on}'`;
     try {
@@ -63,7 +64,7 @@ class GitHubClient {
    */
   async getMilestoneByTitle(title) {
     try {
-      const cmd = `gh api repos/${this.repo}/milestones --jq '.[] | select(.title=="${title}") | {number: .number, title: .title, description: .description, state: .state}'`;
+      const cmd = `gh api "repos/${this.repo}/milestones?per_page=100&state=all" --jq '.[] | select(.title=="${title}") | {number: .number, title: .title, description: .description, state: .state}'`;
       const output = execSync(cmd, { encoding: "utf-8" }).trim();
       return output ? JSON.parse(output) : null;
     } catch {

package/plugins/specweave-github/lib/github-client.ts

@@ -54,22 +54,24 @@ export class GitHubClient {
    *
    * @param title Milestone title
    * @param description Milestone description
-   * @param daysFromNow Days until milestone due (default: 2 days - SpecWeave AI velocity)
+   * @param daysFromNow Days until milestone due (configurable via github.milestoneDueDays, default: 2)
    */
   async createOrGetMilestone(
     title: string,
     description?: string,
-    daysFromNow: number = 2
+    daysFromNow?: number
   ): Promise<GitHubMilestone> {
+    // Use configured value or default to 2 days
+    const dueDays = daysFromNow ?? 2;
     // Check if milestone already exists
     const existing = await this.getMilestoneByTitle(title);
     if (existing) {
       return existing;
     }
 
-    // Calculate due date (SpecWeave default: 1-2 days with AI assistance)
+    // Calculate due date from creation timestamp
     const dueDate = new Date();
-    dueDate.setDate(dueDate.getDate() + daysFromNow);
+    dueDate.setDate(dueDate.getDate() + dueDays);
     const dueDateISO = dueDate.toISOString();
 
     // Create new milestone with due date
@@ -88,7 +90,7 @@ export class GitHubClient {
    */
   private async getMilestoneByTitle(title: string): Promise<GitHubMilestone | null> {
     try {
-      const cmd = `gh api repos/${this.repo}/milestones --jq '.[] | select(.title=="${title}") | {number: .number, title: .title, description: .description, state: .state}'`;
+      const cmd = `gh api "repos/${this.repo}/milestones?per_page=100&state=all" --jq '.[] | select(.title=="${title}") | {number: .number, title: .title, description: .description, state: .state}'`;
       const output = execSync(cmd, { encoding: 'utf-8' }).trim();
       return output ? JSON.parse(output) : null;
     } catch {

package/plugins/specweave-github/lib/github-cross-repo-sync.js

@@ -134,6 +134,22 @@ async function updateIssue(issueNumber, title, body, repo, env) {
   }
 }
 async function appendToIssueBody(issueNumber, repo, section, env) {
+  const viewRes = await execFileNoThrow("gh", [
+    "issue",
+    "view",
+    String(issueNumber),
+    "--repo",
+    repo,
+    "--json",
+    "body",
+    "-q",
+    ".body"
+  ], { env });
+  const existingBody = viewRes.success ? (viewRes.stdout || "").trim() : "";
+  const combinedBody = existingBody ? `${existingBody}
+
+---
+${section}` : section;
   const res = await execFileNoThrow("gh", [
     "issue",
     "edit",
@@ -141,9 +157,7 @@ async function appendToIssueBody(issueNumber, repo, section, env) {
     "--repo",
     repo,
     "--body",
-    section,
-    "--json",
-    "number,url"
+    combinedBody
   ], { env });
   if (!res.success) {
     throw new Error(`Cross-ref update failed: ${res.stderr}`);

package/plugins/specweave-github/lib/github-cross-repo-sync.ts

@@ -226,12 +226,25 @@ async function appendToIssueBody(
   section: string,
   env: NodeJS.ProcessEnv,
 ): Promise<void> {
-  // Use gh issue edit with --add-body
+  // Read existing body first to avoid overwriting it
+  const viewRes = await execFileNoThrow('gh', [
+    'issue', 'view', String(issueNumber),
+    '--repo', repo,
+    '--json', 'body',
+    '-q', '.body',
+  ], { env });
+
+  const existingBody = viewRes.success ? (viewRes.stdout || '').trim() : '';
+
+  // Concatenate: if existing body is empty, use section directly (no leading separator)
+  const combinedBody = existingBody
+    ? `${existingBody}\n\n---\n${section}`
+    : section;
+
   const res = await execFileNoThrow('gh', [
     'issue', 'edit', String(issueNumber),
     '--repo', repo,
-    '--body', section,
-    '--json', 'number,url',
+    '--body', combinedBody,
   ], { env });
 
   if (!res.success) {

package/plugins/specweave-github/lib/github-feature-sync-cli.js

@@ -3,19 +3,20 @@ import { existsSync, readFileSync } from "fs";
 import * as path from "path";
 import { GitHubFeatureSync } from "./github-feature-sync.js";
 import { GitHubClientV2 } from "./github-client-v2.js";
-async function loadGitHubConfig() {
-  const projectRoot = process.cwd();
+async function resolveGitHubConfig(options) {
+  const projectRoot = options?.projectRoot || process.cwd();
   const configPath = path.join(projectRoot, ".specweave/config.json");
-  let owner = process.env.GITHUB_OWNER || "";
-  let repo = process.env.GITHUB_REPO || "";
-  const token = process.env.GITHUB_TOKEN || "";
-  if (existsSync(configPath)) {
+  let owner = options?.cliOwner || process.env.GITHUB_OWNER || "";
+  let repo = options?.cliRepo || process.env.GITHUB_REPO || "";
+  const token = options?.cliToken || process.env.GITHUB_TOKEN || "";
+  if ((!owner || !repo) && existsSync(configPath)) {
     try {
       const config = JSON.parse(readFileSync(configPath, "utf-8"));
-      if (config.sync?.github?.owner && config.sync?.github?.repo) {
+      if (!owner && !repo && config.sync?.github?.owner && config.sync?.github?.repo) {
         owner = config.sync.github.owner;
         repo = config.sync.github.repo;
-      } else if (config.multiProject?.enabled && config.multiProject?.activeProject) {
+      }
+      if (!owner && !repo && config.multiProject?.enabled && config.multiProject?.activeProject) {
         const activeProject = config.multiProject.activeProject;
         const projectConfig = config.multiProject.projects?.[activeProject];
         if (projectConfig?.externalTools?.github?.repository) {
@@ -25,13 +26,15 @@ async function loadGitHubConfig() {
             repo = parts[1];
           }
         }
-      } else if (config.sync?.defaultProfile && config.sync?.profiles) {
+      }
+      if (!owner && !repo && config.sync?.defaultProfile && config.sync?.profiles) {
         const profile = config.sync.profiles[config.sync.defaultProfile];
         if (profile?.config?.owner && profile?.config?.repo) {
           owner = profile.config.owner;
           repo = profile.config.repo;
         }
-      } else if (config.sync?.profiles) {
+      }
+      if (!owner && !repo && config.sync?.profiles) {
         const profileNames = Object.keys(config.sync.profiles);
         for (const name of profileNames) {
           const profile = config.sync.profiles[name];
@@ -74,6 +77,9 @@ async function loadGitHubConfig() {
   }
   return { owner, repo, token };
 }
+async function loadGitHubConfig() {
+  return resolveGitHubConfig();
+}
 async function main() {
   const args = process.argv.slice(2);
   if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
@@ -83,7 +89,7 @@ async function main() {
     console.log("  feature-id   Feature ID (e.g., FS-062)");
     console.log("");
     console.log("Environment:");
-    console.log("  GITHUB_TOKEN  Required - GitHub personal access token");
+    console.log("  GITHUB_TOKEN  Required - GitHub PAT with repo scope");
     console.log("");
     console.log("Example:");
     console.log("  GITHUB_TOKEN=ghp_xxx node github-feature-sync-cli.js FS-062");
@@ -149,3 +155,6 @@ main().catch((error) => {
   console.error("Fatal error:", error);
   process.exit(1);
 });
+export {
+  resolveGitHubConfig
+};

package/plugins/specweave-github/lib/github-feature-sync-cli.ts

@@ -29,26 +29,46 @@ interface GitHubConfig {
   token: string;
 }
 
-async function loadGitHubConfig(): Promise<GitHubConfig | null> {
-  const projectRoot = process.cwd();
+/**
+ * Resolve GitHub config (owner/repo) with a single canonical precedence order.
+ *
+ * Resolution order (documented for both CLI and hooks):
+ * 1. CLI flags / env vars: GITHUB_OWNER, GITHUB_REPO
+ * 2. .specweave/config.json — sync.github.owner/repo
+ * 3. .specweave/config.json — multiProject.projects[active].externalTools.github
+ * 4. .specweave/config.json — sync.profiles[defaultProfile].config
+ * 5. .specweave/config.json — first GitHub profile (fallback)
+ * 6. Git remote detection (git remote get-url origin)
+ *
+ * This is the SINGLE source of truth for owner/repo config.
+ * Shell hooks should read the same config.json paths in the same order.
+ */
+export async function resolveGitHubConfig(options?: {
+  cliOwner?: string;
+  cliRepo?: string;
+  cliToken?: string;
+  projectRoot?: string;
+}): Promise<{ owner: string; repo: string; token: string } | null> {
+  const projectRoot = options?.projectRoot || process.cwd();
   const configPath = path.join(projectRoot, '.specweave/config.json');
 
-  let owner = process.env.GITHUB_OWNER || '';
-  let repo = process.env.GITHUB_REPO || '';
-  const token = process.env.GITHUB_TOKEN || '';
+  // Step 1: CLI flags / env vars (highest precedence)
+  let owner = options?.cliOwner || process.env.GITHUB_OWNER || '';
+  let repo = options?.cliRepo || process.env.GITHUB_REPO || '';
+  const token = options?.cliToken || process.env.GITHUB_TOKEN || '';
 
-  // Try to load from config.json
-  if (existsSync(configPath)) {
+  // Step 2-5: config.json methods (only if not already resolved)
+  if ((!owner || !repo) && existsSync(configPath)) {
     try {
       const config = JSON.parse(readFileSync(configPath, 'utf-8'));
 
-      // Method 1: sync.github
-      if (config.sync?.github?.owner && config.sync?.github?.repo) {
+      // Method 2: sync.github
+      if (!owner && !repo && config.sync?.github?.owner && config.sync?.github?.repo) {
         owner = config.sync.github.owner;
         repo = config.sync.github.repo;
       }
-      // Method 2: multiProject.projects[activeProject].externalTools.github
-      else if (config.multiProject?.enabled && config.multiProject?.activeProject) {
+      // Method 3: multiProject.projects[activeProject].externalTools.github
+      if (!owner && !repo && config.multiProject?.enabled && config.multiProject?.activeProject) {
         const activeProject = config.multiProject.activeProject;
         const projectConfig = config.multiProject.projects?.[activeProject];
         if (projectConfig?.externalTools?.github?.repository) {
@@ -59,17 +79,16 @@ async function loadGitHubConfig(): Promise<GitHubConfig | null> {
           }
         }
       }
-      // Method 3: sync.profiles[defaultProfile]
-      else if (config.sync?.defaultProfile && config.sync?.profiles) {
+      // Method 4: sync.profiles[defaultProfile]
+      if (!owner && !repo && config.sync?.defaultProfile && config.sync?.profiles) {
         const profile = config.sync.profiles[config.sync.defaultProfile];
         if (profile?.config?.owner && profile?.config?.repo) {
           owner = profile.config.owner;
           repo = profile.config.repo;
         }
       }
-      // Method 4 (v1.0.46): First GitHub profile if no defaultProfile is set
-      // This handles the common case where user has profiles but forgot to set defaultProfile
-      else if (config.sync?.profiles) {
+      // Method 5: First GitHub profile if no defaultProfile is set
+      if (!owner && !repo && config.sync?.profiles) {
         const profileNames = Object.keys(config.sync.profiles);
         for (const name of profileNames) {
           const profile = config.sync.profiles[name];
@@ -86,7 +105,7 @@ async function loadGitHubConfig(): Promise<GitHubConfig | null> {
     }
   }
 
-  // Fallback: detect from git remote
+  // Step 6: Git remote detection (lowest precedence)
   if (!owner || !repo) {
     try {
       const { execSync } = await import('child_process');
@@ -95,14 +114,13 @@ async function loadGitHubConfig(): Promise<GitHubConfig | null> {
         cwd: projectRoot
       }).trim();
 
-      // Parse GitHub URL (HTTPS or SSH)
       const match = remoteUrl.match(/github\.com[:/]([^/]+)\/([^/.]+)/);
       if (match) {
         owner = owner || match[1];
         repo = repo || match[2];
       }
     } catch {
-      // Git detection failed, continue with what we have
+      // Git detection failed
     }
   }
 
@@ -121,6 +139,10 @@ async function loadGitHubConfig(): Promise<GitHubConfig | null> {
   return { owner, repo, token };
 }
 
+async function loadGitHubConfig(): Promise<GitHubConfig | null> {
+  return resolveGitHubConfig();
+}
+
 async function main() {
   const args = process.argv.slice(2);
 
@@ -131,7 +153,7 @@ async function main() {
     console.log('  feature-id   Feature ID (e.g., FS-062)');
     console.log('');
     console.log('Environment:');
-    console.log('  GITHUB_TOKEN  Required - GitHub personal access token');
+    console.log('  GITHUB_TOKEN  Required - GitHub PAT with repo scope');
     console.log('');
     console.log('Example:');
     console.log('  GITHUB_TOKEN=ghp_xxx node github-feature-sync-cli.js FS-062');

package/plugins/specweave-github/lib/github-graphql-client.js

@@ -8,13 +8,13 @@ class GitHubGraphQLClient {
    * Tries user first, falls back to organization.
    */
   async getOwnerNodeId(login) {
-    const userQuery = `query { user(login: "${login}") { id } }`;
-    const userResult = await this.executeGraphQL(userQuery);
+    const userQuery = `query($login: String!) { user(login: $login) { id } }`;
+    const userResult = await this.executeGraphQL(userQuery, { login });
     if (userResult.data?.user && userResult.data.user.id) {
       return userResult.data.user.id;
     }
-    const orgQuery = `query { organization(login: "${login}") { id } }`;
-    const orgResult = await this.executeGraphQL(orgQuery);
+    const orgQuery = `query($login: String!) { organization(login: $login) { id } }`;
+    const orgResult = await this.executeGraphQL(orgQuery, { login });
     if (orgResult.data?.organization && orgResult.data.organization.id) {
       return orgResult.data.organization.id;
     }
@@ -24,12 +24,12 @@ class GitHubGraphQLClient {
    * Create a new GitHub Projects V2 board.
    */
   async createProjectV2(ownerId, title) {
-    const query = `mutation {
-      createProjectV2(input: { ownerId: "${ownerId}", title: "${title}" }) {
+    const query = `mutation($ownerId: ID!, $title: String!) {
+      createProjectV2(input: { ownerId: $ownerId, title: $title }) {
         projectV2 { id number }
       }
     }`;
-    const result = await this.executeGraphQL(query);
+    const result = await this.executeGraphQL(query, { ownerId, title });
     const project = result.data?.createProjectV2?.projectV2;
     return { id: project.id, number: project.number };
   }
@@ -38,12 +38,12 @@ class GitHubGraphQLClient {
    * Returns the project item ID. Idempotent.
    */
   async addProjectV2Item(projectId, contentId) {
-    const query = `mutation {
-      addProjectV2ItemById(input: { projectId: "${projectId}", contentId: "${contentId}" }) {
+    const query = `mutation($projectId: ID!, $contentId: ID!) {
+      addProjectV2ItemById(input: { projectId: $projectId, contentId: $contentId }) {
         item { id }
       }
     }`;
-    const result = await this.executeGraphQL(query);
+    const result = await this.executeGraphQL(query, { projectId, contentId });
     const item = result.data?.addProjectV2ItemById?.item;
     return item.id;
   }
@@ -51,24 +51,29 @@ class GitHubGraphQLClient {
    * Update a field value on a Projects V2 item.
    */
   async updateItemFieldValue(projectId, itemId, fieldId, value) {
-    const query = `mutation {
+    const query = `mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
       updateProjectV2ItemFieldValue(input: {
-        projectId: "${projectId}",
-        itemId: "${itemId}",
-        fieldId: "${fieldId}",
-        value: { singleSelectOptionId: "${value.singleSelectOptionId}" }
+        projectId: $projectId,
+        itemId: $itemId,
+        fieldId: $fieldId,
+        value: { singleSelectOptionId: $optionId }
       }) {
         projectV2Item { id }
       }
     }`;
-    await this.executeGraphQL(query);
+    await this.executeGraphQL(query, {
+      projectId,
+      itemId,
+      fieldId,
+      optionId: value.singleSelectOptionId
+    });
   }
   /**
    * Get field definitions for a Projects V2 board.
    */
   async getProjectFields(projectId) {
-    const query = `query {
-      node(id: "${projectId}") {
+    const query = `query($nodeId: ID!) {
+      node(id: $nodeId) {
         ... on ProjectV2 {
           fields(first: 50) {
             nodes {
@@ -82,7 +87,7 @@ class GitHubGraphQLClient {
         }
       }
     }`;
-    const result = await this.executeGraphQL(query);
+    const result = await this.executeGraphQL(query, { nodeId: projectId });
     const fields = result.data?.node?.fields?.nodes || [];
     return fields.map((f) => {
       const field = { id: f.id, name: f.name };
@@ -94,10 +99,14 @@ class GitHubGraphQLClient {
   }
   /**
    * Execute a GraphQL query via `gh api graphql`.
+   * All variables are passed via `-F` flags to prevent injection.
    */
-  executeGraphQL(query) {
+  executeGraphQL(query, variables = {}) {
     return new Promise((resolve, reject) => {
       const args = ["api", "graphql", "-f", `query=${query}`];
+      for (const [key, value] of Object.entries(variables)) {
+        args.push("-F", `${key}=${value}`);
+      }
       const opts = {};
       if (this.token) {
         opts.env = { ...process.env, GH_TOKEN: this.token };