@cleocode/cleo 2026.4.109 → 2026.4.111

package/dist/cli/index.js

@@ -698,6 +698,13 @@ var init_validate = __esm({
   }
 });
 
+// packages/contracts/src/operations/variable-substitution.ts
+var init_variable_substitution = __esm({
+  "packages/contracts/src/operations/variable-substitution.ts"() {
+    "use strict";
+  }
+});
+
 // packages/contracts/src/operations/index.ts
 var init_operations = __esm({
   "packages/contracts/src/operations/index.ts"() {
@@ -717,6 +724,7 @@ var init_operations = __esm({
     init_system();
     init_tasks();
     init_validate();
+    init_variable_substitution();
   }
 });
 
@@ -9374,7 +9382,14 @@ async function orchestrateSpawnExecute(taskId, adapterId, protocolType, projectR
         }
       };
     }
-    const rawPrompt = payload.prompt;
+    const templateSubstitution = await applyCantBodySubstitution(payload, cwd, {
+      taskId,
+      sessionId: activeSessionId,
+      protocol: protocolType ?? payload.meta.protocol
+    });
+    const rawPrompt = templateSubstitution.resolvedBody ? `${templateSubstitution.resolvedBody}
+
+${payload.prompt}` : payload.prompt;
     const cleoSpawnContext = {
       taskId: payload.taskId,
       protocol: protocolType || payload.meta.protocol,
@@ -9446,7 +9461,17 @@ async function orchestrateSpawnExecute(taskId, adapterId, protocolType, projectR
         timing: result.timing,
         tier: tier ?? null,
         atomicity: payload.atomicity,
-        meta: payload.meta,
+        meta: {
+          ...payload.meta,
+          // T1238 — variable substitution diagnostics surfaced for audit.
+          templateSubstitution: {
+            applied: templateSubstitution.applied,
+            resolvedCount: templateSubstitution.resolvedCount,
+            missing: templateSubstitution.missing,
+            projectContextLoaded: templateSubstitution.projectContextLoaded,
+            ...templateSubstitution.reason !== void 0 ? { reason: templateSubstitution.reason } : {}
+          }
+        },
         agentId: payload.agentId,
         role: payload.role,
         harnessHint: payload.harnessHint
@@ -9463,6 +9488,58 @@ async function orchestrateSpawnExecute(taskId, adapterId, protocolType, projectR
     };
   }
 }
+async function applyCantBodySubstitution(payload, cwd, ctx) {
+  const empty = {
+    applied: false,
+    resolvedCount: 0,
+    missing: [],
+    projectContextLoaded: false,
+    resolvedBody: null
+  };
+  const cantPath = payload.resolvedAgent?.cantPath;
+  if (!cantPath) {
+    return { ...empty, reason: "resolved agent has no cantPath" };
+  }
+  const [{ existsSync: existsSync12, readFileSync: readFileSync15 }, { substituteCantAgentBody }] = await Promise.all([
+    import("node:fs"),
+    import("@cleocode/core/internal")
+  ]);
+  if (!existsSync12(cantPath)) {
+    return { ...empty, reason: `cant file not found at ${cantPath}` };
+  }
+  let body;
+  try {
+    body = readFileSync15(cantPath, "utf-8");
+  } catch (err) {
+    return {
+      ...empty,
+      reason: `Failed to read cant body: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const sessionContext = {
+    taskId: ctx.taskId,
+    sessionId: ctx.sessionId,
+    protocol: ctx.protocol,
+    agentId: payload.agentId,
+    role: payload.role,
+    tier: payload.tier,
+    harnessHint: payload.harnessHint
+  };
+  if (payload.taskId) sessionContext.spawnTaskId = payload.taskId;
+  const result = substituteCantAgentBody(body, {
+    projectRoot: cwd,
+    sessionContext,
+    env: process.env,
+    options: { strict: false, warnMissing: false }
+  });
+  return {
+    applied: result.resolved.length > 0,
+    resolvedCount: result.resolved.length,
+    missing: result.missing,
+    projectContextLoaded: result.projectContextLoaded,
+    resolvedBody: result.text
+  };
+}
 async function openSignaldockDbForComposer() {
   await ensureGlobalSignaldockDb();
   const dbPath = getGlobalSignaldockDbPath();