fix: comprehensive audit — 16 fixes across docs, code, and metadata

Documentation: remove non-existent --text flag, fix default format claims,
fix jq pipe example, correct redirect URI default, add OS requirement note.
Code: section index keyed by id (collision-safe), warn on --by-customer with
json/txns, remove dead branch, remove unused param, add -o to create/update/
delete, extract _read_stdin_json + _txn_to_dict helpers, cached_property on
GLSection, move calendar import to top-level, simplify output_text logic.
Metadata: OS classifier POSIX, CHANGELOG backfilled 0.2-0.6.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: alexph-dev

03_notes/2026-02-17-comprehensive-audit-fixes.md

@@ -0,0 +1,40 @@
+# 2026-02-17 — Comprehensive Non-Security Audit Fixes
+
+## Summary
+
+16 fixes across 4 files covering documentation inaccuracies, code bugs,
+consistency issues, DRY violations, and performance improvements.
+
+## Changes
+
+### Documentation (README.md)
+- Removed non-existent `--text` flag from 2 gl-report examples
+- Fixed "JSON (default)" → "text (default)" in output format section
+- Added `-f json` to jq pipe example (was piping text to jq)
+- Fixed redirect URI default: "—" → `http://localhost:8844/callback`
+- Added macOS/Linux note (fcntl dependency)
+
+### Metadata (pyproject.toml)
+- `Operating System :: OS Independent` → `Operating System :: POSIX`
+
+### CHANGELOG.md
+- Backfilled versions 0.2 through 0.6 from git history
+
+### Code (cli.py)
+- `_build_section_index`: keys by both name AND id (prevents collision)
+- `_find_gl_section`: prefers id-based lookup, 7 callers updated
+- `--by-customer` + json/txns: warns instead of silently ignoring
+- Dead `elif e_clean` branch removed from `_format_date_range`
+- `Config.validate(need_tokens)`: unused param removed, both callers updated
+- `create`/`update`/`delete` parsers: added `-o`/`--output` flag
+- `auth status`: now uses `_resolve_fmt()` like all other commands
+- `_read_stdin_json()`: extracted from duplicate stdin-read pattern
+- `_txn_to_dict()`: extracted from duplicate 8-field dict literal
+- `import calendar` moved to top-level (was deferred in function body)
+- GLSection: `@property` → `@functools.cached_property` (3 properties)
+- `output_text`: simplified confusing double-isinstance check
+
+## Verification
+- `ruff check` ✓
+- `ruff format --check` ✓
+- `py_compile` ✓

CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.6.0 (2026-02-17)
+
+- Security hardening: OAuth `state` parameter validation (CSRF protection)
+- Security: lock file permissions restricted to `0o600`
+- Performance: O(n) account tree and GL section lookups (was O(n^2))
+- Fix: LIKE wildcard `%` stripped in query escaping
+- Fix: version defined in single source (`__init__.py`), no more triplication
+- CI: GitHub Actions pinned to immutable commit SHAs
+- Python 3.9 compatibility restored (`from __future__ import annotations`)
+
+## 0.5.0 (2026-02-16)
+
+- Fix: author metadata updated in package config
+
+## 0.4.0 (2026-02-16)
+
+- Security: SQL injection prevention, directory permission hardening
+- Fix: entity paths auto-lowercase for get/create/update/delete
+- Text output for single entities shows key-value pairs
+
+## 0.3.0 (2026-02-16)
+
+- Text output as default for all commands
+- Per-subcommand `-o` output flag
+- `gl-report --by-customer` / `-g` flag with customer grouping
+- `gl-report` output modes: text, json, txns, expanded
+- `gl-report --no-sub` flag to roll up sub-accounts
+- Customer filter made optional in `gl-report`
+
+## 0.2.0 (2026-02-16)
+
+- `qbo auth setup` interactive config wizard
+- `config.json.example` added
+- `qbo gl-report` subcommand — hierarchical GL reports by account and customer
+- CI/CD: lint workflow + auto-publish to PyPI on release
+
 ## 0.1.0 (2026-02-16)
 
 Initial release.

README.md

@@ -22,7 +22,7 @@ Built for QuickBooks automation — giving AI agents (like [OpenClaw](https://op
 pip install qbo-cli
 ```
 
-Requires Python 3.9+.
+Requires Python 3.9+ on macOS or Linux (uses `fcntl` for file locking).
 
 ## Setup
 
@@ -188,30 +188,33 @@ qbo gl-report --list-accounts
 # Drill into a specific account's sub-accounts
 qbo gl-report -a 125 --list-accounts
 
-# Generate a report (JSON by default)
+# Generate a report (text by default)
 qbo gl-report -c "John Smith" -a 125
 
 # Human-readable text with currency prefix
-qbo gl-report -c "John Smith" -a 125 --text --currency USD
+qbo gl-report -c "John Smith" -a 125 --currency USD
 
 # Custom date range
 qbo gl-report -c "John Smith" -a "Revenue" --start 2025-01-01 --end 2025-12-31
 
 # Dates default to: first transaction → today
-qbo gl-report -c "John Smith" -a 125 --text
+qbo gl-report -c "John Smith" -a 125
 ```
 
 ### Output formats
 
 ```bash
-# JSON (default)
+# Text output (default, human-readable table)
 qbo query "SELECT * FROM Customer"
 
+# JSON
+qbo query "SELECT * FROM Customer" -f json
+
 # TSV (tab-separated, for spreadsheets/awk)
 qbo query "SELECT * FROM Customer" -f tsv
 
 # Pipe to jq
-qbo query "SELECT * FROM Customer" | jq '.[].DisplayName'
+qbo query "SELECT * FROM Customer" -f json | jq '.[].DisplayName'
 ```
 
 ### Sandbox mode
@@ -230,7 +233,7 @@ export QBO_SANDBOX=true
 |---------|-------------|------------|---------|
 | Client ID | `QBO_CLIENT_ID` | `client_id` | — |
 | Client Secret | `QBO_CLIENT_SECRET` | `client_secret` | — |
-| Redirect URI | `QBO_REDIRECT_URI` | `redirect_uri` | — (must match your Intuit app) |
+| Redirect URI | `QBO_REDIRECT_URI` | `redirect_uri` | `http://localhost:8844/callback` |
 | Realm ID | `QBO_REALM_ID` | `realm_id` | From auth flow |
 | Sandbox mode | `QBO_SANDBOX` | `sandbox` | `false` |
 

pyproject.toml

@@ -19,7 +19,7 @@ classifiers = [
     "Intended Audience :: Developers",
     "Intended Audience :: Financial and Insurance Industry",
     "License :: OSI Approved :: MIT License",
-    "Operating System :: OS Independent",
+    "Operating System :: POSIX",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",