specweave 1.0.351 → 1.0.352

package/plugins/specweave-github/lib/github-graphql-client.ts

@@ -32,17 +32,17 @@ export class GitHubGraphQLClient {
    * Tries user first, falls back to organization.
    */
   async getOwnerNodeId(login: string): Promise<string> {
-    // Try user query first
-    const userQuery = `query { user(login: "${login}") { id } }`;
-    const userResult = await this.executeGraphQL(userQuery);
+    // Try user query first (parameterized)
+    const userQuery = `query($login: String!) { user(login: $login) { id } }`;
+    const userResult = await this.executeGraphQL(userQuery, { login });
 
     if (userResult.data?.user && (userResult.data.user as { id?: string }).id) {
       return (userResult.data.user as { id: string }).id;
     }
 
-    // Fallback to organization
-    const orgQuery = `query { organization(login: "${login}") { id } }`;
-    const orgResult = await this.executeGraphQL(orgQuery);
+    // Fallback to organization (parameterized)
+    const orgQuery = `query($login: String!) { organization(login: $login) { id } }`;
+    const orgResult = await this.executeGraphQL(orgQuery, { login });
 
     if (orgResult.data?.organization && (orgResult.data.organization as { id?: string }).id) {
       return (orgResult.data.organization as { id: string }).id;
@@ -55,13 +55,13 @@ export class GitHubGraphQLClient {
    * Create a new GitHub Projects V2 board.
    */
   async createProjectV2(ownerId: string, title: string): Promise<{ id: string; number: number }> {
-    const query = `mutation {
-      createProjectV2(input: { ownerId: "${ownerId}", title: "${title}" }) {
+    const query = `mutation($ownerId: ID!, $title: String!) {
+      createProjectV2(input: { ownerId: $ownerId, title: $title }) {
         projectV2 { id number }
       }
     }`;
 
-    const result = await this.executeGraphQL(query);
+    const result = await this.executeGraphQL(query, { ownerId, title });
     const project = (result.data?.createProjectV2 as { projectV2: { id: string; number: number } })?.projectV2;
     return { id: project.id, number: project.number };
   }
@@ -71,13 +71,13 @@ export class GitHubGraphQLClient {
    * Returns the project item ID. Idempotent.
    */
   async addProjectV2Item(projectId: string, contentId: string): Promise<string> {
-    const query = `mutation {
-      addProjectV2ItemById(input: { projectId: "${projectId}", contentId: "${contentId}" }) {
+    const query = `mutation($projectId: ID!, $contentId: ID!) {
+      addProjectV2ItemById(input: { projectId: $projectId, contentId: $contentId }) {
         item { id }
       }
     }`;
 
-    const result = await this.executeGraphQL(query);
+    const result = await this.executeGraphQL(query, { projectId, contentId });
     const item = (result.data?.addProjectV2ItemById as { item: { id: string } })?.item;
     return item.id;
   }
@@ -91,26 +91,31 @@ export class GitHubGraphQLClient {
     fieldId: string,
     value: { singleSelectOptionId: string },
   ): Promise<void> {
-    const query = `mutation {
+    const query = `mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
       updateProjectV2ItemFieldValue(input: {
-        projectId: "${projectId}",
-        itemId: "${itemId}",
-        fieldId: "${fieldId}",
-        value: { singleSelectOptionId: "${value.singleSelectOptionId}" }
+        projectId: $projectId,
+        itemId: $itemId,
+        fieldId: $fieldId,
+        value: { singleSelectOptionId: $optionId }
       }) {
         projectV2Item { id }
       }
     }`;
 
-    await this.executeGraphQL(query);
+    await this.executeGraphQL(query, {
+      projectId,
+      itemId,
+      fieldId,
+      optionId: value.singleSelectOptionId,
+    });
   }
 
   /**
    * Get field definitions for a Projects V2 board.
    */
   async getProjectFields(projectId: string): Promise<ProjectField[]> {
-    const query = `query {
-      node(id: "${projectId}") {
+    const query = `query($nodeId: ID!) {
+      node(id: $nodeId) {
         ... on ProjectV2 {
           fields(first: 50) {
             nodes {
@@ -125,7 +130,7 @@ export class GitHubGraphQLClient {
       }
     }`;
 
-    const result = await this.executeGraphQL(query);
+    const result = await this.executeGraphQL(query, { nodeId: projectId });
     const fields = (result.data?.node as { fields?: { nodes: Array<{
       id: string;
       name: string;
@@ -144,10 +149,17 @@ export class GitHubGraphQLClient {
 
   /**
    * Execute a GraphQL query via `gh api graphql`.
+   * All variables are passed via `-F` flags to prevent injection.
    */
-  private executeGraphQL(query: string): Promise<GraphQLResponse> {
+  private executeGraphQL(query: string, variables: Record<string, string> = {}): Promise<GraphQLResponse> {
     return new Promise((resolve, reject) => {
       const args = ['api', 'graphql', '-f', `query=${query}`];
+
+      // Pass all variables as structured parameters via -F
+      for (const [key, value] of Object.entries(variables)) {
+        args.push('-F', `${key}=${value}`);
+      }
+
       const opts: { env?: NodeJS.ProcessEnv } = {};
 
       if (this.token) {

package/plugins/specweave-github/lib/github-hierarchical-sync.js

@@ -156,8 +156,8 @@ async function executeSearch(query) {
     "1000"
     // Max results
   ], { env: getGhEnv() });
-  if (result.status !== 0) {
-    throw new Error(`Failed to search issues: ${result.stderr || result.stdout}`);
+  if (result.exitCode !== 0) {
+    throw new Error(`Failed to search issues (exit code ${result.exitCode}): ${result.stderr || result.stdout}`);
   }
   if (!result.stdout.trim()) {
     return [];

package/plugins/specweave-github/lib/github-hierarchical-sync.ts

@@ -317,8 +317,8 @@ async function executeSearch(query: string): Promise<GitHubIssue[]> {
     '1000', // Max results
   ], { env: getGhEnv() });
 
-  if (result.status !== 0) {
-    throw new Error(`Failed to search issues: ${result.stderr || result.stdout}`);
+  if (result.exitCode !== 0) {
+    throw new Error(`Failed to search issues (exit code ${result.exitCode}): ${result.stderr || result.stdout}`);
   }
 
   if (!result.stdout.trim()) {

package/plugins/specweave-github/lib/github-multi-project-sync.js

@@ -251,13 +251,29 @@ ${userStory.technicalContext}
 
 \u{1F916} Auto-generated by SpecWeave
 `;
-    const existingIssues = await this.octokit.issues.listForRepo({
-      owner: this.config.owner,
-      repo,
-      labels: "specweave",
-      state: "all"
-    });
-    const existing = existingIssues.data.find((issue) => issue.title === title);
+    let existing;
+    const seenNumbers = /* @__PURE__ */ new Set();
+    let page = 1;
+    while (!existing) {
+      const existingIssues = await this.octokit.issues.listForRepo({
+        owner: this.config.owner,
+        repo,
+        labels: "specweave",
+        state: "all",
+        per_page: 100,
+        page
+      });
+      for (const issue of existingIssues.data) {
+        if (seenNumbers.has(issue.number)) continue;
+        seenNumbers.add(issue.number);
+        if (issue.title === title) {
+          existing = { number: issue.number, title: issue.title };
+          break;
+        }
+      }
+      if (existingIssues.data.length < 100) break;
+      page++;
+    }
     if (existing) {
       const response = await this.octokit.issues.update({
         owner: this.config.owner,

package/plugins/specweave-github/lib/github-multi-project-sync.ts

@@ -356,15 +356,33 @@ ${userStory.technicalContext ? `\n## Technical Context\n\n${userStory.technicalC
 🤖 Auto-generated by SpecWeave
 `;
 
-    // Check if issue already exists (search by title)
-    const existingIssues = await this.octokit.issues.listForRepo({
-      owner: this.config.owner,
-      repo,
-      labels: 'specweave',
-      state: 'all'
-    });
+    // Check if issue already exists (search by title, paginated)
+    let existing: { number: number; title: string } | undefined;
+    const seenNumbers = new Set<number>();
+    let page = 1;
+
+    while (!existing) {
+      const existingIssues = await this.octokit.issues.listForRepo({
+        owner: this.config.owner,
+        repo,
+        labels: 'specweave',
+        state: 'all',
+        per_page: 100,
+        page,
+      });
 
-    const existing = existingIssues.data.find(issue => issue.title === title);
+      for (const issue of existingIssues.data) {
+        if (seenNumbers.has(issue.number)) continue;
+        seenNumbers.add(issue.number);
+        if (issue.title === title) {
+          existing = { number: issue.number, title: issue.title };
+          break;
+        }
+      }
+
+      if (existingIssues.data.length < 100) break;
+      page++;
+    }
 
     if (existing) {
       // Update existing issue

package/plugins/specweave-github/lib/github-spec-frontmatter-updater.js

@@ -60,10 +60,38 @@ function parseYamlSimple(yaml) {
   const stack = [
     { obj: result, indent: -1 }
   ];
-  for (const line of lines) {
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
     if (!line.trim() || line.trim().startsWith("#")) continue;
     const indent = line.search(/\S/);
     const trimmed = line.trim();
+    if (trimmed.startsWith("- ")) {
+      while (stack.length > 1 && stack[stack.length - 1].indent >= indent) {
+        stack.pop();
+      }
+      const parent2 = stack[stack.length - 1];
+      const key2 = parent2.currentKey;
+      if (key2 && parent2.obj[key2] !== void 0) {
+        const arr = parent2.obj[key2];
+        if (Array.isArray(arr)) {
+          const itemText = trimmed.slice(2).trim();
+          const nestedColonIdx = itemText.indexOf(":");
+          if (nestedColonIdx > 0 && !itemText.startsWith('"') && !itemText.startsWith("'")) {
+            const nestedKey = itemText.slice(0, nestedColonIdx).trim();
+            const nestedVal = itemText.slice(nestedColonIdx + 1).trim();
+            if (nestedVal) {
+              const obj = { [nestedKey]: parseYamlValue(nestedVal) };
+              arr.push(obj);
+            } else {
+              arr.push(parseYamlValue(itemText));
+            }
+          } else {
+            arr.push(parseYamlValue(itemText));
+          }
+        }
+      }
+      continue;
+    }
     const colonIdx = trimmed.indexOf(":");
     if (colonIdx === -1) continue;
     const key = trimmed.slice(0, colonIdx).trim();
@@ -73,15 +101,60 @@ function parseYamlSimple(yaml) {
     }
     const parent = stack[stack.length - 1].obj;
     if (rawValue === "" || rawValue === void 0) {
-      const child = {};
-      parent[key] = child;
-      stack.push({ obj: child, indent });
+      const nextIdx = findNextNonEmptyLine(lines, i + 1);
+      if (nextIdx !== -1 && lines[nextIdx].trim().startsWith("- ")) {
+        parent[key] = [];
+        stack.push({ obj: parent, indent, currentKey: key });
+      } else {
+        const child = {};
+        parent[key] = child;
+        stack.push({ obj: child, indent });
+      }
+    } else if (rawValue.startsWith("[") && rawValue.endsWith("]")) {
+      parent[key] = parseFlowArray(rawValue);
     } else {
       parent[key] = parseYamlValue(rawValue);
     }
   }
   return result;
 }
+function findNextNonEmptyLine(lines, start) {
+  for (let i = start; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    if (trimmed && !trimmed.startsWith("#")) return i;
+  }
+  return -1;
+}
+function parseFlowArray(raw) {
+  const inner = raw.slice(1, -1).trim();
+  if (!inner) return [];
+  const items = [];
+  let current = "";
+  let inQuote = false;
+  let quoteChar = "";
+  for (let i = 0; i < inner.length; i++) {
+    const ch = inner[i];
+    if (inQuote) {
+      if (ch === quoteChar) {
+        inQuote = false;
+      }
+      current += ch;
+    } else if (ch === '"' || ch === "'") {
+      inQuote = true;
+      quoteChar = ch;
+      current += ch;
+    } else if (ch === ",") {
+      items.push(parseYamlValue(current.trim()));
+      current = "";
+    } else {
+      current += ch;
+    }
+  }
+  if (current.trim()) {
+    items.push(parseYamlValue(current.trim()));
+  }
+  return items;
+}
 function parseYamlValue(raw) {
   if (raw === "null") return null;
   if (raw === "true") return true;
@@ -99,7 +172,39 @@ function stringifyYaml(obj, indent = 0) {
   for (const [key, value] of Object.entries(obj)) {
     if (value === null || value === void 0) {
       parts.push(`${prefix}${key}: null`);
-    } else if (typeof value === "object" && !Array.isArray(value)) {
+    } else if (Array.isArray(value)) {
+      if (value.length === 0) {
+        parts.push(`${prefix}${key}: []`);
+      } else if (value.every((v) => typeof v !== "object" || v === null)) {
+        parts.push(`${prefix}${key}:`);
+        for (const item of value) {
+          if (typeof item === "string") {
+            parts.push(`${prefix}  - "${item}"`);
+          } else {
+            parts.push(`${prefix}  - ${item}`);
+          }
+        }
+      } else {
+        parts.push(`${prefix}${key}:`);
+        for (const item of value) {
+          if (typeof item === "object" && item !== null) {
+            const entries = Object.entries(item);
+            if (entries.length > 0) {
+              const [firstKey, firstVal] = entries[0];
+              const formattedVal = typeof firstVal === "string" ? `"${firstVal}"` : firstVal;
+              parts.push(`${prefix}  - ${firstKey}: ${formattedVal}`);
+              for (let j = 1; j < entries.length; j++) {
+                const [k, v] = entries[j];
+                const fv = typeof v === "string" ? `"${v}"` : v;
+                parts.push(`${prefix}    ${k}: ${fv}`);
+              }
+            }
+          } else {
+            parts.push(`${prefix}  - ${item}`);
+          }
+        }
+      }
+    } else if (typeof value === "object") {
       parts.push(`${prefix}${key}:`);
       parts.push(stringifyYaml(value, indent + 1));
     } else if (typeof value === "string") {

package/plugins/specweave-github/lib/github-spec-frontmatter-updater.ts

@@ -101,20 +101,55 @@ export async function updateSpecFrontmatter(
 
 /**
  * Simple YAML parser for spec frontmatter.
- * Handles nested objects, strings, numbers, booleans, null.
+ * Handles nested objects, strings, numbers, booleans, null, and arrays.
+ * Supports block arrays (`- item`) and flow arrays (`[a, b, c]`).
  */
 function parseYamlSimple(yaml: string): Record<string, unknown> {
   const result: Record<string, unknown> = {};
   const lines = yaml.split('\n');
-  const stack: Array<{ obj: Record<string, unknown>; indent: number }> = [
+  const stack: Array<{ obj: Record<string, unknown>; indent: number; currentKey?: string }> = [
     { obj: result, indent: -1 },
   ];
 
-  for (const line of lines) {
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
     if (!line.trim() || line.trim().startsWith('#')) continue;
 
     const indent = line.search(/\S/);
     const trimmed = line.trim();
+
+    // Block array item: `- value` or `- key: value` (nested object in array)
+    if (trimmed.startsWith('- ')) {
+      // Find the parent that owns this array
+      while (stack.length > 1 && stack[stack.length - 1].indent >= indent) {
+        stack.pop();
+      }
+      const parent = stack[stack.length - 1];
+      const key = parent.currentKey;
+      if (key && parent.obj[key] !== undefined) {
+        const arr = parent.obj[key];
+        if (Array.isArray(arr)) {
+          const itemText = trimmed.slice(2).trim();
+          // Check if it's a nested object item (- key: value)
+          const nestedColonIdx = itemText.indexOf(':');
+          if (nestedColonIdx > 0 && !itemText.startsWith('"') && !itemText.startsWith("'")) {
+            const nestedKey = itemText.slice(0, nestedColonIdx).trim();
+            const nestedVal = itemText.slice(nestedColonIdx + 1).trim();
+            if (nestedVal) {
+              // Simple key:value object item
+              const obj: Record<string, unknown> = { [nestedKey]: parseYamlValue(nestedVal) };
+              arr.push(obj);
+            } else {
+              arr.push(parseYamlValue(itemText));
+            }
+          } else {
+            arr.push(parseYamlValue(itemText));
+          }
+        }
+      }
+      continue;
+    }
+
     const colonIdx = trimmed.indexOf(':');
     if (colonIdx === -1) continue;
 
@@ -129,10 +164,21 @@ function parseYamlSimple(yaml: string): Record<string, unknown> {
     const parent = stack[stack.length - 1].obj;
 
     if (rawValue === '' || rawValue === undefined) {
-      // Nested object
-      const child: Record<string, unknown> = {};
-      parent[key] = child;
-      stack.push({ obj: child, indent });
+      // Check if next non-empty line is a block array item
+      const nextIdx = findNextNonEmptyLine(lines, i + 1);
+      if (nextIdx !== -1 && lines[nextIdx].trim().startsWith('- ')) {
+        // This key holds an array
+        parent[key] = [] as unknown[];
+        stack.push({ obj: parent, indent, currentKey: key });
+      } else {
+        // Nested object
+        const child: Record<string, unknown> = {};
+        parent[key] = child;
+        stack.push({ obj: child, indent });
+      }
+    } else if (rawValue.startsWith('[') && rawValue.endsWith(']')) {
+      // Flow array: [a, b, c]
+      parent[key] = parseFlowArray(rawValue);
     } else {
       parent[key] = parseYamlValue(rawValue);
     }
@@ -141,6 +187,52 @@ function parseYamlSimple(yaml: string): Record<string, unknown> {
   return result;
 }
 
+/**
+ * Find the next non-empty, non-comment line index.
+ */
+function findNextNonEmptyLine(lines: string[], start: number): number {
+  for (let i = start; i < lines.length; i++) {
+    const trimmed = lines[i].trim();
+    if (trimmed && !trimmed.startsWith('#')) return i;
+  }
+  return -1;
+}
+
+/**
+ * Parse a YAML flow array like [a, b, c] or ["a", "b"]
+ */
+function parseFlowArray(raw: string): unknown[] {
+  const inner = raw.slice(1, -1).trim();
+  if (!inner) return [];
+  // Split on commas, respecting quoted strings
+  const items: unknown[] = [];
+  let current = '';
+  let inQuote = false;
+  let quoteChar = '';
+  for (let i = 0; i < inner.length; i++) {
+    const ch = inner[i];
+    if (inQuote) {
+      if (ch === quoteChar) {
+        inQuote = false;
+      }
+      current += ch;
+    } else if (ch === '"' || ch === "'") {
+      inQuote = true;
+      quoteChar = ch;
+      current += ch;
+    } else if (ch === ',') {
+      items.push(parseYamlValue(current.trim()));
+      current = '';
+    } else {
+      current += ch;
+    }
+  }
+  if (current.trim()) {
+    items.push(parseYamlValue(current.trim()));
+  }
+  return items;
+}
+
 function parseYamlValue(raw: string): unknown {
   if (raw === 'null') return null;
   if (raw === 'true') return true;
@@ -155,7 +247,7 @@ function parseYamlValue(raw: string): unknown {
 }
 
 /**
- * Simple YAML stringifier.
+ * Simple YAML stringifier with array support.
  */
 function stringifyYaml(obj: Record<string, unknown>, indent = 0): string {
   const prefix = '  '.repeat(indent);
@@ -164,7 +256,41 @@ function stringifyYaml(obj: Record<string, unknown>, indent = 0): string {
   for (const [key, value] of Object.entries(obj)) {
     if (value === null || value === undefined) {
       parts.push(`${prefix}${key}: null`);
-    } else if (typeof value === 'object' && !Array.isArray(value)) {
+    } else if (Array.isArray(value)) {
+      if (value.length === 0) {
+        parts.push(`${prefix}${key}: []`);
+      } else if (value.every(v => typeof v !== 'object' || v === null)) {
+        // Simple array — use block style
+        parts.push(`${prefix}${key}:`);
+        for (const item of value) {
+          if (typeof item === 'string') {
+            parts.push(`${prefix}  - "${item}"`);
+          } else {
+            parts.push(`${prefix}  - ${item}`);
+          }
+        }
+      } else {
+        // Array of objects — use block style with nested keys
+        parts.push(`${prefix}${key}:`);
+        for (const item of value) {
+          if (typeof item === 'object' && item !== null) {
+            const entries = Object.entries(item as Record<string, unknown>);
+            if (entries.length > 0) {
+              const [firstKey, firstVal] = entries[0];
+              const formattedVal = typeof firstVal === 'string' ? `"${firstVal}"` : firstVal;
+              parts.push(`${prefix}  - ${firstKey}: ${formattedVal}`);
+              for (let j = 1; j < entries.length; j++) {
+                const [k, v] = entries[j];
+                const fv = typeof v === 'string' ? `"${v}"` : v;
+                parts.push(`${prefix}    ${k}: ${fv}`);
+              }
+            }
+          } else {
+            parts.push(`${prefix}  - ${item}`);
+          }
+        }
+      }
+    } else if (typeof value === 'object') {
       parts.push(`${prefix}${key}:`);
       parts.push(stringifyYaml(value as Record<string, unknown>, indent + 1));
     } else if (typeof value === 'string') {