Release: v7.17.2

.github/dependabot.yml

@@ -1,25 +1,21 @@
 version: 2
 updates:
-  # Enable version updates for npm
-  - package-ecosystem: 'npm'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-      day: 'monday'
-      time: '09:00'
-    open-pull-requests-limit: 5
-    reviewers:
-      - 'dt'
-    commit-message:
-      prefix: 'chore(deps)'
-      include: 'scope'
-    labels:
-      - 'dependencies'
-      - 'automated'
-
   # GitHub Actions updates
+  #
+  # npm version updates were removed here (2026-09-04): package.json has no
+  # runtime `dependencies`, only 3 devDependencies (husky, lint-staged,
+  # prettier) that never reach a user — flow-cli ships as zsh through
+  # Homebrew. Of the last 16 npm dependabot PRs, 9 were closed unmerged and
+  # only 6 merged, each costing a full CI run (ZSH Plugin Tests alone ~7min).
+  # github-actions updates merged 3/3 and cover real security surface (e.g.
+  # #444 bumped actions/create-github-app-token, the action #514 later
+  # hardened) — kept.
   - package-ecosystem: 'github-actions'
     directory: '/'
+    # Open PRs against the integration branch. Without this, dependabot derives
+    # the base from the repo default (main) and RESETS it on every rebase, so a
+    # manual retarget to dev can never stick (observed on #503 and #512).
+    target-branch: 'dev'
     schedule:
       interval: 'weekly'
       day: 'monday'

.github/workflows/homebrew-release.yml

@@ -73,6 +73,12 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: Data-Wise
           repositories: homebrew-tap
+          # Least privilege: without these the minted token inherits EVERY
+          # permission the App installation holds on homebrew-tap, for the whole
+          # job. This step needs exactly two things — commit/push the formula
+          # edit, and open then auto-merge the bump PR.
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Checkout homebrew-tap
         uses: actions/checkout@v7
@@ -120,22 +126,31 @@ jobs:
             echo "No changes to commit (formula already at v${VERSION})"
             exit 0
           fi
+          # Tap main is branch-protected (PR-only + required status checks), so
+          # a direct push is rejected with GH006. Push a bot branch, open a PR,
+          # and enable auto-merge so it lands once the required checks pass.
+          BRANCH="bot/flow-cli-${VERSION}"
+          git checkout -b "$BRANCH"
           git commit -m "flow-cli: update to v${VERSION}"
 
           # Auth via URL-embedded App token; clear GITHUB_TOKEN so the
           # runner credential helper doesn't intercept with the caller's token.
           PUSH_URL="https://x-access-token:${TAP_TOKEN}@github.com/Data-Wise/homebrew-tap.git"
           git remote set-url origin "$PUSH_URL"
           unset GITHUB_TOKEN
+          # Force-push is safe: bot/flow-cli-* is a bot-owned, per-version
+          # branch; overwriting it just makes re-runs idempotent.
+          git push --force -u origin "$BRANCH"
+
+          export GH_TOKEN="$TAP_TOKEN"
+          if ! gh pr view "$BRANCH" --repo Data-Wise/homebrew-tap --json state -q .state 2>/dev/null | grep -q OPEN; then
+            gh pr create --repo Data-Wise/homebrew-tap \
+              --base main --head "$BRANCH" \
+              --title "flow-cli: update to v${VERSION}" \
+              --body "Automated formula bump from flow-cli homebrew-release.yml."
+          fi
 
-          for attempt in 1 2 3; do
-            if git push origin HEAD:main; then
-              echo "Pushed to main (attempt $attempt)"
-              exit 0
-            fi
-            echo "Push failed (attempt $attempt/3), rebasing..."
-            git pull --rebase origin main
-          done
-
-          echo "::error::Failed to push after 3 attempts"
-          exit 1
+          # Auto-merge waits for the tap's required checks; if they already
+          # completed, fall back to an immediate merge.
+          gh pr merge "$BRANCH" --repo Data-Wise/homebrew-tap --squash --auto \
+            || gh pr merge "$BRANCH" --repo Data-Wise/homebrew-tap --squash

CHANGELOG.md

@@ -9,6 +9,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.17.2] — 2026-09-05 — CI hardening + PATH fix
+
+### Fixed
+
+- **`uv` tool shims (radian, arxiv_latex_cleaner) were installed but unreachable.** `~/.local/bin` is
+  where `uv` installs them, but nothing in the zsh config put that directory on `PATH`. Added to
+  `.zshenv` (not `.zshrc`) so non-interactive shells — scripts, Claude Code — resolve them too,
+  guarded against unbounded growth across nested shells. (#513)
+- **The Homebrew tap release workflow's direct push to `main` started failing (GH006)** once
+  `Data-Wise/homebrew-tap` enabled branch protection. The workflow now pushes a
+  `bot/flow-cli-<version>` branch, opens a PR, and enables auto-merge so it lands once the tap's
+  required checks pass. (#499)
+
+### Changed
+
+- **The tap release App token is now scoped to `contents: write` + `pull-requests: write`**
+  instead of inheriting every permission the App's installation holds on `homebrew-tap` — the
+  two permissions the job actually uses (formula push, PR open/auto-merge). (#514)
+- **Dependabot's `github-actions` updates now target `dev` explicitly.** Without a
+  `target-branch`, dependabot re-derives the base from the repo default (`main`) and resets it on
+  every rebase, so a manual PR retarget could never stick. (#515)
+- **Dropped the npm dependabot ecosystem.** `package.json` has no runtime dependencies — only 3
+  devDependencies that never reach a user, since flow-cli ships as zsh through Homebrew. Of the
+  last 16 npm dependabot PRs, 9 were closed unmerged; the 3 github-actions updates in the same
+  window all merged and covered real security surface. (#515)
+- Bumped `prettier` 3.9.4 → 3.9.6 and `lint-staged` 17.0.8 → 17.4.1 (devDependencies only). (#512, #515)
+
 ## [7.17.1] — 2026-08-23 — alias-proof shipped pipelines
 
 ### Fixed

CLAUDE.md

@@ -7,7 +7,7 @@ This file provides guidance to Claude Code when working with code in this reposi
 **flow-cli** - Pure ZSH plugin for ADHD-optimized workflow management. Zero dependencies. Standalone (works without Oh-My-Zsh or any plugin manager).
 
 - **Architecture:** Pure ZSH plugin (no Node.js runtime required)
-- **Current Version:** v7.17.1
+- **Current Version:** v7.17.2
 - **Install:** Homebrew (recommended), or any plugin manager
 - **Source:** `source /opt/homebrew/opt/flow-cli/flow.plugin.zsh` (via Homebrew)
 - **Optional:** Atlas integration for enhanced state management
@@ -217,7 +217,7 @@ export FLOW_FORCE_DISPATCHER_OBS=1           # Force-keep one dispatcher (FLOW_F
 
 ## Current Status
 
-**Version:** v7.17.1 | **Tests:** 12000+ (75/75 suite, 1 skipped — tool absence) | **Docs:** https://Data-Wise.github.io/flow-cli/
+**Version:** v7.17.2 | **Tests:** 12000+ (75/75 suite, 1 skipped — tool absence) | **Docs:** https://Data-Wise.github.io/flow-cli/
 
 ---
 

docs/CHANGELOG.md

@@ -8,6 +8,33 @@ The format follows [Keep a Changelog](https://keepachangelog.com/), and this pro
 
 ## [Unreleased]
 
+## [7.17.2] — 2026-09-05 — CI hardening + PATH fix
+
+### Fixed
+
+- **`uv` tool shims (radian, arxiv_latex_cleaner) were installed but unreachable.** `~/.local/bin` is
+  where `uv` installs them, but nothing in the zsh config put that directory on `PATH`. Added to
+  `.zshenv` (not `.zshrc`) so non-interactive shells — scripts, Claude Code — resolve them too,
+  guarded against unbounded growth across nested shells. (#513)
+- **The Homebrew tap release workflow's direct push to `main` started failing (GH006)** once
+  `Data-Wise/homebrew-tap` enabled branch protection. The workflow now pushes a
+  `bot/flow-cli-<version>` branch, opens a PR, and enables auto-merge so it lands once the tap's
+  required checks pass. (#499)
+
+### Changed
+
+- **The tap release App token is now scoped to `contents: write` + `pull-requests: write`**
+  instead of inheriting every permission the App's installation holds on `homebrew-tap` — the
+  two permissions the job actually uses (formula push, PR open/auto-merge). (#514)
+- **Dependabot's `github-actions` updates now target `dev` explicitly.** Without a
+  `target-branch`, dependabot re-derives the base from the repo default (`main`) and resets it on
+  every rebase, so a manual PR retarget could never stick. (#515)
+- **Dropped the npm dependabot ecosystem.** `package.json` has no runtime dependencies — only 3
+  devDependencies that never reach a user, since flow-cli ships as zsh through Homebrew. Of the
+  last 16 npm dependabot PRs, 9 were closed unmerged; the 3 github-actions updates in the same
+  window all merged and covered real security surface. (#515)
+- Bumped `prettier` 3.9.4 → 3.9.6 and `lint-staged` 17.0.8 → 17.4.1 (devDependencies only). (#512, #515)
+
 ## [7.17.1] — 2026-08-23 — alias-proof shipped pipelines
 
 ### Fixed

docs/index.md

@@ -327,4 +327,4 @@ ref               # Quick-reference card (forgot the syntax? this is faster than
 
 ---
 
-**v7.17.1** · Pure ZSH · Zero Dependencies · MIT License
+**v7.17.2** · Pure ZSH · Zero Dependencies · MIT License

flow.plugin.zsh

@@ -187,7 +187,7 @@ _flow_plugin_init
 
 # Export loaded marker
 export FLOW_PLUGIN_LOADED=1
-export FLOW_VERSION="7.17.1"
+export FLOW_VERSION="7.17.2"
 
 # Register exit hook for plugin cleanup
 add-zsh-hook zshexit _flow_plugin_cleanup

man/man1/agenda.1

@@ -1,6 +1,6 @@
 .\" Man page for the agenda command (forward-looking schedule view)
 .\" Updated: June 2026
-.TH AGENDA 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH AGENDA 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 agenda \- forward-looking schedule across all projects
 .SH SYNOPSIS

man/man1/at.1

@@ -1,6 +1,6 @@
 .\" Man page for at dispatcher (Atlas bridge)
 .\" Generated: June 2026
-.TH AT 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH AT 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 at \- Atlas project intelligence bridge (optional integration)
 .SH SYNOPSIS

man/man1/cc.1

@@ -1,6 +1,6 @@
 .\" Man page for cc dispatcher (Claude Code launcher)
 .\" Generated: June 2026
-.TH CC 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH CC 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 cc \- Claude Code launcher and dispatcher
 .SH SYNOPSIS

man/man1/dash.1

@@ -1,6 +1,6 @@
 .\" Man page for the dash command (project dashboard)
 .\" Updated: June 2026
-.TH DASH 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH DASH 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 dash \- ADHD-friendly project dashboard
 .SH SYNOPSIS

man/man1/dots.1

@@ -1,6 +1,6 @@
 .\" Man page for dots dispatcher (Dotfile Management)
 .\" Generated: June 2026
-.TH DOTS 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH DOTS 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 dots \- Dotfile management dispatcher (chezmoi wrapper)
 .SH SYNOPSIS

man/man1/em.1

@@ -1,6 +1,6 @@
 .\" Man page for em dispatcher (Email / himalaya)
 .\" Generated: June 2026
-.TH EM 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH EM 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 em \- Email dispatcher (himalaya wrapper)
 .SH SYNOPSIS

man/man1/flow-claude.1

@@ -1,4 +1,4 @@
-.TH FLOW-CLAUDE 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH FLOW-CLAUDE 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 flow-claude \- Claude Code environment health checker
 .SH SYNOPSIS

man/man1/flow.1

@@ -1,6 +1,6 @@
 .\" Man page for flow command
 .\" Updated: June 2026
-.TH FLOW 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH FLOW 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 flow \- ADHD-friendly workflow CLI for developers
 .SH SYNOPSIS

man/man1/g.1

@@ -1,6 +1,6 @@
 .\" Man page for g dispatcher (Git workflows)
 .\" Updated: June 2026
-.TH G 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH G 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 g \- Git commands dispatcher
 .SH SYNOPSIS

man/man1/mcp.1

@@ -1,6 +1,6 @@
 .\" Man page for mcp dispatcher (MCP server management)
 .\" Updated: June 2026
-.TH MCP 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH MCP 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 mcp \- MCP server management dispatcher
 .SH SYNOPSIS

man/man1/morning.1

@@ -1,6 +1,6 @@
 .\" Man page for the morning command (daily startup routine)
 .\" Updated: June 2026
-.TH MORNING 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH MORNING 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 morning \- ADHD-friendly daily startup routine
 .SH SYNOPSIS

man/man1/prompt.1

@@ -1,6 +1,6 @@
 .\" Man page for prompt dispatcher (Prompt Engine Switcher)
 .\" Generated: June 2026
-.TH PROMPT 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH PROMPT 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 prompt \- Prompt engine switcher
 .SH SYNOPSIS

man/man1/qu.1

@@ -1,6 +1,6 @@
 .\" Man page for qu dispatcher (Quarto publishing)
 .\" Updated: June 2026
-.TH QU 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH QU 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 qu \- Quarto publishing dispatcher
 .SH SYNOPSIS

man/man1/r.1

@@ -1,6 +1,6 @@
 .\" Man page for r dispatcher (R package development)
 .\" Updated: June 2026
-.TH R 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH R 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 r \- R package development dispatcher
 .SH SYNOPSIS

man/man1/sec.1

@@ -1,6 +1,6 @@
 .\" Man page for sec dispatcher (Secret Management)
 .\" Generated: June 2026
-.TH SEC 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH SEC 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 sec \- Secret management dispatcher (Keychain and Bitwarden)
 .SH SYNOPSIS

man/man1/teach.1

@@ -1,6 +1,6 @@
 .\" Man page for teach dispatcher (Teaching Workflow)
 .\" Generated: June 2026
-.TH TEACH 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH TEACH 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 teach \- Teaching workflow dispatcher (Scholar integration)
 .SH SYNOPSIS

man/man1/tm.1

@@ -1,6 +1,6 @@
 .\" Man page for tm dispatcher (Terminal Manager)
 .\" Generated: June 2026
-.TH TM 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH TM 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 tm \- Terminal manager dispatcher
 .SH SYNOPSIS

man/man1/today.1

@@ -1,6 +1,6 @@
 .\" Man page for the today command (quick daily status)
 .\" Updated: June 2026
-.TH TODAY 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH TODAY 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 today \- quick daily status
 .SH SYNOPSIS

man/man1/tok.1

@@ -1,6 +1,6 @@
 .\" Man page for tok dispatcher (Token Management)
 .\" Generated: June 2026
-.TH TOK 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH TOK 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 tok \- Token lifecycle management dispatcher
 .SH SYNOPSIS

man/man1/v.1

@@ -1,6 +1,6 @@
 .\" Man page for v dispatcher (Vibe / Workflow Automation)
 .\" Generated: June 2026
-.TH V 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH V 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 v \- Workflow automation dispatcher (vibe coding mode)
 .SH SYNOPSIS

man/man1/week.1

@@ -1,6 +1,6 @@
 .\" Man page for the week command (weekly review helper)
 .\" Updated: June 2026
-.TH WEEK 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH WEEK 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 week \- weekly review helper
 .SH SYNOPSIS

man/man1/wt.1

@@ -1,6 +1,6 @@
 .\" Man page for wt dispatcher (Git Worktree Management)
 .\" Generated: June 2026
-.TH WT 1 "June 2026" "flow-cli 7.17.1" "User Commands"
+.TH WT 1 "June 2026" "flow-cli 7.17.2" "User Commands"
 .SH NAME
 wt \- Git worktree management dispatcher
 .SH SYNOPSIS