@agentforge/cli 0.11.6 → 0.11.8

package/templates/cli/package.json

@@ -20,8 +20,8 @@
     "format": "prettier --write ."
   },
   "dependencies": {
-    "@agentforge/core": "^0.11.6",
-    "@agentforge/patterns": "^0.11.6",
+    "@agentforge/core": "^0.11.8",
+    "@agentforge/patterns": "^0.11.8",
     "@langchain/core": "^1.1.17",
     "@langchain/langgraph": "^1.1.2",
     "@langchain/openai": "^1.2.3",

package/templates/full/package.json

@@ -19,8 +19,8 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@agentforge/core": "^0.11.6",
-    "@agentforge/patterns": "^0.11.6",
+    "@agentforge/core": "^0.11.8",
+    "@agentforge/patterns": "^0.11.8",
     "@langchain/core": "^1.1.17",
     "@langchain/langgraph": "^1.1.2",
     "@langchain/openai": "^1.2.3",

package/templates/minimal/package.json

@@ -16,8 +16,8 @@
     "format": "prettier --write ."
   },
   "dependencies": {
-    "@agentforge/core": "^0.11.6",
-    "@agentforge/patterns": "^0.11.6",
+    "@agentforge/core": "^0.11.8",
+    "@agentforge/patterns": "^0.11.8",
     "@langchain/core": "^1.1.17",
     "@langchain/langgraph": "^1.1.2",
     "@langchain/openai": "^1.2.3",

package/templates/reusable-agent/index.ts

@@ -1,9 +1,10 @@
 import { z } from 'zod';
 import { createReActAgent } from '@agentforge/patterns';
-import { toolBuilder, ToolCategory, ToolRegistry } from '@agentforge/core';
+import { toolBuilder, ToolCategory, ToolRegistry, loadPrompt } from '@agentforge/core';
 import type { BaseLanguageModel } from '@langchain/core/language_models/base';
 import { ChatOpenAI } from '@langchain/openai';
-import { loadPrompt } from './prompt-loader.js';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
 
 /**
  * Configuration schema for {{AGENT_NAME_PASCAL}}Agent
@@ -91,12 +92,25 @@ function buildSystemPrompt(config: {{AGENT_NAME_PASCAL}}Config): string {
     return config.systemPrompt;
   }
 
+  // Resolve prompts directory relative to this module (not cwd)
+  // This ensures prompts are found when the package is published
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = dirname(__filename);
+  const promptsDir = join(__dirname, '../prompts');
+
   // Load prompt from external file with variable substitution
+  // SECURITY: Distinguish between trusted (config) and untrusted (user-supplied) variables
   return loadPrompt('system', {
-    organizationName: config.organizationName || 'your organization',
-    description: config.description || '{{AGENT_DESCRIPTION}}',
-    enableExampleFeature: config.enableExampleFeature,
-  });
+    // Trusted variables: from config/hardcoded values (NOT sanitized)
+    trustedVariables: {
+      enableExampleFeature: config.enableExampleFeature,
+    },
+    // Untrusted variables: potentially user-supplied (WILL be sanitized)
+    untrustedVariables: {
+      organizationName: config.organizationName || 'your organization',
+      description: config.description || '{{AGENT_DESCRIPTION}}',
+    },
+  }, promptsDir);
 }
 
 /**

package/templates/reusable-agent/prompt-loader.ts

@@ -1,43 +0,0 @@
-import { readFileSync } from 'fs';
-import { join, dirname } from 'path';
-import { fileURLToPath } from 'url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-/**
- * Simple template variable substitution
- * Supports: {{variable}} and {{#if variable}}...{{/if}}
- */
-export function renderTemplate(template: string, variables: Record<string, any>): string {
-  let result = template;
-
-  // Replace simple variables: {{variableName}}
-  result = result.replace(/\{\{(\w+)\}\}/g, (match, varName) => {
-    return variables[varName] !== undefined ? String(variables[varName]) : match;
-  });
-
-  // Handle conditional blocks: {{#if variableName}}...{{/if}}
-  result = result.replace(/\{\{#if (\w+)\}\}([\s\S]*?)\{\{\/if\}\}/g, (match, varName, content) => {
-    return variables[varName] ? content : '';
-  });
-
-  return result;
-}
-
-/**
- * Load a prompt template from the prompts directory
- */
-export function loadPromptTemplate(name: string): string {
-  const promptPath = join(__dirname, '..', 'prompts', `${name}.md`);
-  return readFileSync(promptPath, 'utf-8');
-}
-
-/**
- * Load and render a prompt with variables
- */
-export function loadPrompt(name: string, variables: Record<string, any> = {}): string {
-  const template = loadPromptTemplate(name);
-  return renderTemplate(template, variables);
-}
-