@garyr/pt-cli 0.33.0 → 0.38.0

package/README.md

@@ -45,13 +45,15 @@ graph LR
 - Initialize new projects from learned templates
 - Define template variables for dynamic file customization
 - **Automatic Variable Detection:** Scans text files for `{{ var }}` syntax during `learn`/`update`
+- **Nested Variable Expansion (v0.36.0+):** Variables can contain other variable placeholders that are resolved iteratively
+- **Parent Directory `.env` File Scanning:** Automatically scans parent directories for `.env` files and uses their values as defaults
 - Auto-detect and suggest post-config setup tasks
 - Configure global post-config tasks in `~/.pt/config.yaml` (apply to all projects)
 - Baked-in defaults for common project types (javascript, python, godot, etc.)
 - Share templates or use as an API with JSON export/import
 - **Direct JSON scaffolding:** Initialize projects from a JSON file without registering in `config.yaml`
 - **Portable template configs:** `.pt-template.json` files make shared directories fully self-describing
-- Fully supports non-interactive mode (`--yes`, `--vars`) for AI agent automation
+- Fully supports non-interactive mode (`--yes`, `--vars`, `--name`, `--desc`) for AI agent automation
 
 ## Quick Start
 

package/dist/commands/defaultPostConfigCommand.js

@@ -21,6 +21,7 @@ export function defaultPostConfigCommand(options = {}) {
         console.error('You must provide --json <data> to set the default post-config array.');
     }
     else {
-        console.log('Current default post-config tasks:', config.default_post_config || []);
+        const tasks = config.default_post_config || [];
+        console.log(JSON.stringify(tasks, null, 2));
     }
 }

package/dist/commands/initCommand.js

@@ -5,6 +5,61 @@ import { loadConfig, sanitizePath } from '../config.js';
 import chalk from 'chalk';
 import { processCopyFiles } from '../substitute.js';
 import { execSync } from 'child_process';
+/**
+ * Scan parent directories for .env files and parse their variables.
+ * Returns a map of variable names to their values, supporting:
+ * - KEY=VALUE format
+ * - KEY="VALUE with spaces" format
+ * - KEY='VALUE with spaces' format
+ * - Comments (lines starting with #)
+ * - Empty lines
+ */
+function scanEnvForVariables(targetPath) {
+    const envVars = {};
+    let currentDir = path.resolve(targetPath);
+    // Scan up to 5 parent directories for .env files
+    const maxDepth = 5;
+    for (let depth = 0; depth < maxDepth; depth++) {
+        const envPath = path.join(currentDir, '.env');
+        if (fs.existsSync(envPath)) {
+            try {
+                const content = fs.readFileSync(envPath, 'utf-8');
+                const lines = content.split('\n');
+                for (const line of lines) {
+                    const trimmed = line.trim();
+                    // Skip empty lines and comments
+                    if (!trimmed || trimmed.startsWith('#')) {
+                        continue;
+                    }
+                    // Match KEY=VALUE patterns
+                    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+)$/);
+                    if (match) {
+                        const key = match[1];
+                        let value = match[2];
+                        // Remove surrounding quotes if present
+                        if ((value.startsWith('"') && value.endsWith('"')) ||
+                            (value.startsWith("'") && value.endsWith("'"))) {
+                            value = value.slice(1, -1);
+                        }
+                        envVars[key] = value;
+                    }
+                }
+            }
+            catch (err) {
+                // Silently skip unreadable .env files
+                continue;
+            }
+        }
+        // Move to parent directory
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir) {
+            // Reached filesystem root
+            break;
+        }
+        currentDir = parentDir;
+    }
+    return envVars;
+}
 export async function init(targetName, destPath, options = {}) {
     const config = loadConfig();
     let typeName = targetName;
@@ -86,6 +141,16 @@ export async function init(targetName, destPath, options = {}) {
     // Handle Variables
     let variables = {};
     if (template.variables && template.variables.length > 0) {
+        // Scan parent directories for .env files and pre-fill variables
+        const envVars = scanEnvForVariables(resolvedDest);
+        // Merge .env variables into variables (with lower priority than --vars)
+        if (Object.keys(envVars).length > 0) {
+            for (const [key, value] of Object.entries(envVars)) {
+                if (!variables[key]) {
+                    variables[key] = value;
+                }
+            }
+        }
         if (options.vars) {
             // Parse --vars "key=val,key2=val2"
             const pairs = options.vars.split(',').map((p) => p.trim());
@@ -153,25 +218,26 @@ export async function init(targetName, destPath, options = {}) {
             if (fs.existsSync(srcPath)) {
                 if (options.dryRun) {
                     console.log(chalk.gray(`  [DRY RUN] Would copy ${file.src} → ${file.dest || file.src}`));
-                    const ext = path.extname(file.src);
-                    if (['.sh', '.py', '.bash', '.bat'].includes(ext)) {
-                        console.log(chalk.gray(`  [DRY RUN] Would chmod +x ${file.dest || file.src}`));
-                    }
+                    console.log(chalk.gray(`  [DRY RUN] Would chmod +x ${file.dest || file.src}`));
                     continue;
                 }
-                const fileContent = fs.readFileSync(srcPath, 'utf-8');
+                let fileContent = fs.readFileSync(srcPath, 'utf-8');
+                // Substitute variables in post_copy files if template has variables
+                if (template.variables && template.variables.length > 0) {
+                    const { substituteVariables } = await import('../substitute.js');
+                    fileContent = substituteVariables(fileContent, variables);
+                }
                 const destDir = path.dirname(destPath);
                 fs.mkdirSync(destDir, { recursive: true });
                 fs.writeFileSync(destPath, fileContent);
-                // Auto-chmod for executables
-                const ext = path.extname(file.src);
-                if (['.sh', '.py', '.bash', '.bat'].includes(ext)) {
-                    try {
-                        fs.chmodSync(destPath, 0o755);
-                    }
-                    catch (e) {
-                        // chmod not available (Windows)
-                    }
+                // post_copy files are executables by definition — always chmod
+                try {
+                    // Check if source had execute permissions, otherwise default to 0o755
+                    const srcStat = fs.statSync(srcPath);
+                    fs.chmodSync(destPath, srcStat.mode & 0o111 ? srcStat.mode : 0o755);
+                }
+                catch (e) {
+                    // chmod not available (Windows)
                 }
                 console.log(chalk.green("  ✓ " + (file.dest || file.src)));
             }
@@ -190,7 +256,38 @@ export async function init(targetName, destPath, options = {}) {
     }
     // Use template post_config tasks
     const allTasks = template.post_config?.filter(t => !t.type || t.type === typeName) || [];
-    if (allTasks.length > 0) {
+    if (allTasks.length > 0 && !options.skipPostConfig) {
+        // SECURITY CHECK: Validate template safety before running post_config tasks
+        const { validateTemplateSecurity } = await import('../safety.js');
+        const { valid, errors, warnings } = validateTemplateSecurity(template);
+        if (!valid) {
+            console.error(chalk.red("\n❌ SECURITY ERROR: Aborting post_config execution due to blocked commands:"));
+            for (const err of errors) {
+                console.error(chalk.red(`   - ${err}`));
+            }
+            process.exit(1);
+        }
+        if (warnings.length > 0) {
+            console.warn(chalk.yellow("\n⚠️  SECURITY WARNING: Post-config contains dangerous or suspicious commands:"));
+            for (const warn of warnings) {
+                console.warn(chalk.yellow(`   - ${warn}`));
+            }
+            if (!options.yes) {
+                const { proceed } = await inquirer.prompt({
+                    type: 'confirm',
+                    name: 'proceed',
+                    message: chalk.red('Are you sure you want to run these post-config tasks?'),
+                    default: false
+                });
+                if (!proceed) {
+                    console.log(chalk.yellow("Post-config tasks aborted by user."));
+                    return;
+                }
+            }
+            else {
+                console.warn(chalk.yellow("Proceeding anyway (non-interactive mode with auto-confirm enabled)."));
+            }
+        }
         // Determine which tasks to include
         let selectedTaskNames = [];
         if (options.skipPostConfig) {

package/dist/commands/learnCommand.js

@@ -9,7 +9,16 @@ export async function learn(sourcePath, updateTemplate = null, options = {}) {
     // Phase 1: Remote Check
     if (sourcePath.startsWith('http')) {
         console.log(chalk.cyan(`Downloading remote template from: ${sourcePath}...`));
-        resolvedPath = await downloadAndExtract(sourcePath);
+        try {
+            resolvedPath = await downloadAndExtract(sourcePath, options.json || false, options.allowUntrusted || false);
+        }
+        catch (err) {
+            if (err.message === 'Download cancelled by user due to untrusted source') {
+                console.log(chalk.yellow('Download cancelled. Exiting.'));
+                process.exit(0);
+            }
+            throw err;
+        }
     }
     else {
         resolvedPath = path.resolve(sourcePath);
@@ -65,6 +74,8 @@ export async function learn(sourcePath, updateTemplate = null, options = {}) {
         }
     }
     else {
+        // Track whether name came from .info.md or JSON (not user-provided)
+        const nameFromSource = !options.name && (fileTemplateConfig.name || infoName);
         if (options.name) {
             targetName = options.name;
         }
@@ -92,6 +103,34 @@ export async function learn(sourcePath, updateTemplate = null, options = {}) {
                 targetName = newName;
             }
         }
+        // If name came from .info.md or JSON, prompt to confirm/edit
+        // This prevents accidental overwrites when creating new templates based on existing ones
+        if (nameFromSource && !options.json) {
+            if (options.yes) {
+                // In --yes mode, keep the auto-detected name but warn
+                const existingNames = getTemplateNames(config);
+                if (existingNames.includes(targetName)) {
+                    console.warn(chalk.yellow(`⚠ Warning: "${targetName}" already exists. Using this name will overwrite the existing template.`));
+                }
+            }
+            else {
+                const { confirmName } = await inquirer.prompt({
+                    type: 'confirm',
+                    name: 'confirmName',
+                    message: `Use "${targetName}" as the template name?`,
+                    default: true
+                });
+                if (!confirmName) {
+                    const { newName } = await inquirer.prompt({
+                        type: 'input',
+                        name: 'newName',
+                        message: 'Name this template:',
+                        default: targetName
+                    });
+                    targetName = newName;
+                }
+            }
+        }
     }
     let description = '';
     if (options.desc) {
@@ -124,6 +163,8 @@ export async function learn(sourcePath, updateTemplate = null, options = {}) {
         }
     }
     else {
+        // Track whether description came from .info.md or JSON (not user-provided)
+        const descFromSource = !options.desc && (fileTemplateConfig.description || infoDesc);
         if (fileTemplateConfig.description) {
             description = fileTemplateConfig.description;
             if (!options.json)
@@ -146,6 +187,34 @@ export async function learn(sourcePath, updateTemplate = null, options = {}) {
             });
             description = newDesc;
         }
+        // If description came from .info.md or JSON, prompt to confirm/edit
+        // This prevents accidental overwrites when creating new templates based on existing ones
+        if (descFromSource && !options.json) {
+            if (options.yes) {
+                // In --yes mode, keep the auto-detected description but warn
+                const existingNames = getTemplateNames(config);
+                if (existingNames.includes(targetName)) {
+                    console.warn(chalk.yellow(`⚠ Warning: "${targetName}" already exists. Using this name will overwrite the existing template.`));
+                }
+            }
+            else {
+                const { confirmDesc } = await inquirer.prompt({
+                    type: 'confirm',
+                    name: 'confirmDesc',
+                    message: `Use "${description}" as the template description?`,
+                    default: true
+                });
+                if (!confirmDesc) {
+                    const { newDesc } = await inquirer.prompt({
+                        type: 'input',
+                        name: 'newDesc',
+                        message: 'Purpose/Description of this template:',
+                        default: description
+                    });
+                    description = newDesc;
+                }
+            }
+        }
     }
     const cliIgnore = options.ignore ? options.ignore.split(',').map((s) => s.trim()).filter(Boolean) : [];
     const ignorePatterns = [...(config.ignore || []), ...cliIgnore];

package/dist/commands/securityResponseCommand.js

@@ -0,0 +1,12 @@
+// pt-cli/src/commands/securityResponseCommand.ts
+// CLI command to handle security responses from GUI
+import { handleSecurityResponse } from '../safety.js';
+export async function securityResponseCommand(response, options = { response: '' }) {
+    const result = await handleSecurityResponse(response);
+    if (result) {
+        console.log('SECURITY_RESPONSE:ALLOWED');
+    }
+    else {
+        console.log('SECURITY_RESPONSE:DENIED');
+    }
+}

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+import chalk from 'chalk';
 // Command imports
 import { learn } from './commands/learnCommand.js';
 import { init } from './commands/initCommand.js';
@@ -9,6 +10,7 @@ import { variablesCommand } from './commands/variablesCommand.js';
 import { addCommand } from './commands/addCommand.js';
 import { removeCommand } from './commands/removeCommand.js';
 import { defaultPostConfigCommand } from './commands/defaultPostConfigCommand.js';
+import { securityResponseCommand } from './commands/securityResponseCommand.js';
 import pkg from '../package.json' with { type: 'json' };
 const program = new Command();
 program
@@ -23,8 +25,23 @@ program
     .option('--name <name>', 'Template name (skip prompt)')
     .option('--desc <description>', 'Template description (skip prompt)')
     .option('--json', 'Output template structure as JSON for sharing instead of saving')
+    .option('--allow-untrusted', 'Bypass the trusted-source check for remote URLs (set by GUI after user confirmation)')
     .action(async (pathArg, options) => {
-    await learn(pathArg || '.', null, options);
+    try {
+        await learn(pathArg || '.', null, options);
+    }
+    catch (err) {
+        if (options.json) {
+            console.log(JSON.stringify({
+                type: 'error',
+                message: err.message || String(err)
+            }));
+        }
+        else {
+            console.error(chalk.red(`Error: ${err.message || err}`));
+        }
+        process.exit(1);
+    }
 });
 program
     .command('update <templateName> [sourcePath]')
@@ -33,7 +50,13 @@ program
     .option('-y, --yes', 'Automatically confirm prompts')
     .option('--desc <description>', 'Template description (skip prompt)')
     .action(async (templateName, sourcePath, options) => {
-    await learn(sourcePath || '.', templateName, options);
+    try {
+        await learn(sourcePath || '.', templateName, options);
+    }
+    catch (err) {
+        console.error(chalk.red(`Error: ${err.message || err}`));
+        process.exit(1);
+    }
 });
 program
     .command('init [templateName] [destPath]')
@@ -80,4 +103,10 @@ program
     .description('Remove a learned template from the config')
     .option('-y, --yes', 'Automatically confirm removal')
     .action(removeCommand);
+program
+    .command('security-response <response>')
+    .description('Handle security response from GUI')
+    .action(async (response) => {
+    await securityResponseCommand(response);
+});
 program.parse(process.argv);

package/dist/remote.js

@@ -8,26 +8,42 @@ import { extract } from 'tar'; // You'll need: npm install tar
 import chalk from 'chalk';
 import { isTrustedSource, logSecurityEvent } from './safety.js';
 import { loadConfig } from './config.js';
-export async function downloadAndExtract(url) {
+export async function downloadAndExtract(url, isJsonMode = false, allowUntrusted = false) {
     // Load security policy
     const configPath = path.join(process.env.HOME || os.homedir(), '.pt', 'config.yaml');
     const config = loadConfig();
     const securityPolicy = config.security || {
         trustedSources: ['github.com/garyritchie', 'gitea.lyonritchie.com/garyritchie', 'github.com/lyonritchie'],
     };
-    // SECURITY CHECK: Verify source is trusted
-    if (!isTrustedSource(url, securityPolicy.trustedSources)) {
-        console.log(chalk.yellow(`⚠️  Warning: Template from untrusted source: ${url}`));
-        console.log(chalk.yellow('   Only use templates from trusted sources'));
-        const inquirer = (await import('inquirer')).default;
-        const response = await inquirer.prompt({
-            type: 'confirm',
-            name: 'proceed',
-            message: chalk.red('Continue anyway?'),
-            default: false
-        });
-        if (!response.proceed) {
-            throw new Error('Download cancelled by user due to untrusted source');
+    // SECURITY CHECK: Verify source is trusted (skipped when --allow-untrusted is passed)
+    if (!allowUntrusted && !isTrustedSource(url, securityPolicy.trustedSources)) {
+        if (isJsonMode) {
+            // In JSON mode, output warning as JSON for GUI consumption.
+            // The GUI will show a confirmation dialog and, if the user says YES,
+            // re-run `pt learn <url> --json --yes --allow-untrusted`.
+            console.log(JSON.stringify({
+                type: 'security_warning',
+                url: url,
+                message: `Template from untrusted source: ${url}`,
+                warning: 'Only use templates from trusted sources.',
+                prompt: 'Continue anyway?',
+                default: false
+            }));
+            process.exit(1);
+        }
+        else {
+            console.log(chalk.yellow(`⚠️  Warning: Template from untrusted source: ${url}`));
+            console.log(chalk.yellow('   Only use templates from trusted sources'));
+            const inquirer = (await import('inquirer')).default;
+            const response = await inquirer.prompt({
+                type: 'confirm',
+                name: 'proceed',
+                message: chalk.red('Continue anyway?'),
+                default: false
+            });
+            if (!response.proceed) {
+                throw new Error('Download cancelled by user due to untrusted source');
+            }
         }
     }
     const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pt-template-'));

package/dist/safety.js

@@ -12,8 +12,8 @@ const BLOCKED_COMMANDS = [
     'sudo', 'su', 'su -', 'su root',
     // Disk operations that could destroy data
     'dd', 'mkfs', 'fdisk', 'mount', 'umount',
-    // Shell injection patterns
-    ';', '|', '&', '&&', '||',
+    // Shell injection patterns - removed from blocklist to allow command chaining.
+    // These are validated as warnings instead.
     // Dangerous chmod
     'chmod 777', 'chmod -R 777', 'chmod 666',
     // System commands that could kill processes
@@ -26,8 +26,6 @@ const BLOCKED_COMMANDS = [
 // === DANGEROUS PATTERNS ===
 // Commands that should trigger a warning but are NOT blocked
 const DANGEROUS_PATTERNS = [
-    // Destructive file operations
-    'rm -rf', 'rm -r', 'rm --no-preserve-root', 'rm -rf /',
     // Remote downloads + execution
     'curl', 'wget', 'wget -O', 'curl |', 'wget |',
     // Script execution
@@ -69,6 +67,31 @@ export function isBlockedCommand(command) {
  * Check if a command should trigger a warning (but is allowed)
  */
 export function isDangerousCommand(command) {
+    // Check for destructive file operations targeting absolute paths
+    // Regex matches 'rm', 'rmdir', or Windows 'del' followed by optional flags and then an absolute path.
+    // Absolute path matches:
+    // - Unix: starting with '/' (e.g. /tmp, /usr)
+    // - Windows: starting with drive letter (e.g. C:\) or UNC path (\\) or drive-relative '\'
+    const parts = command.split(/\s+/);
+    const rmIndex = parts.findIndex(p => p === 'rm' || p === 'rmdir' || p === 'del');
+    if (rmIndex !== -1) {
+        // Check subsequent arguments
+        for (let i = rmIndex + 1; i < parts.length; i++) {
+            const arg = parts[i];
+            if (!arg)
+                continue;
+            // Skip flags (starting with - or /flag on Windows)
+            if (arg.startsWith('-') || (process.platform === 'win32' && arg.startsWith('/'))) {
+                continue;
+            }
+            // Check absolute path patterns
+            const isAbsolute = arg.startsWith('/') ||
+                (process.platform === 'win32' && (/^[a-zA-Z]:\\/.test(arg) || arg.startsWith('\\\\') || arg.startsWith('\\')));
+            if (isAbsolute) {
+                return true;
+            }
+        }
+    }
     for (const pattern of DANGEROUS_PATTERNS) {
         if (command.includes(pattern)) {
             return true;
@@ -135,31 +158,31 @@ export function isTrustedSource(url, trustedSources = DEFAULT_SECURITY_POLICY.tr
     return trustedSources.some(source => url.includes(source));
 }
 /**
- * Check if a command has been executed too many times (rate limiting)
+ * Rate limiting: track the last execution timestamp per command hash
  */
-const executionCounts = new Map();
+const lastExecutionTimes = new Map();
 const RATE_LIMIT_MS = 1000; // 1 second between identical commands
 export function canExecute(command, maxCommandsPerRun = 50) {
-    // Check total count per run
-    const totalExecuted = Array.from(executionCounts.values()).reduce((sum, count) => sum + count, 0);
+    // Check total commands executed this run
+    const totalExecuted = lastExecutionTimes.size;
     if (totalExecuted >= maxCommandsPerRun) {
         return false;
     }
     // Check rate limit for this specific command
     const hash = crypto.createHash('md5').update(command).digest('hex');
-    const last = executionCounts.get(hash) || 0;
-    if (Date.now() - last < RATE_LIMIT_MS) {
+    const lastTime = lastExecutionTimes.get(hash) || 0;
+    if (Date.now() - lastTime < RATE_LIMIT_MS) {
         return false;
     }
-    // Update count
-    executionCounts.set(hash, Date.now());
+    // Record execution timestamp
+    lastExecutionTimes.set(hash, Date.now());
     return true;
 }
 /**
- * Reset execution counts (for testing or between runs)
+ * Reset execution timestamps (for testing or between runs)
  */
 export function resetExecutionCounts() {
-    executionCounts.clear();
+    lastExecutionTimes.clear();
 }
 /**
  * Validate a template's security before execution
@@ -216,35 +239,42 @@ export function getSecurityPolicy(configPath) {
     return DEFAULT_SECURITY_POLICY;
 }
 /**
- * Show warning about dangerous command and wait for user to cancel
+ * Show warning about dangerous command and wait for user to cancel.
+ * Resolves true after the timeout (continue), or false immediately on CTRL+C (cancel).
  */
 export async function showDangerousCommandWarning(command, timeoutSeconds = 5) {
-    const inquirer = (await import('inquirer')).default;
     const readline = await import('readline');
     console.log(chalk.red('\n⚠️  DANGEROUS COMMAND DETECTED'));
     console.log(chalk.red(`   Command: ${command}`));
     console.log(chalk.red('   This could potentially harm your system.'));
     console.log(chalk.yellow(`   Press CTRL+C to cancel, or wait ${timeoutSeconds}s to continue...`));
-    // Set up timeout
-    const timeout = setTimeout(() => {
-        return true; // Continue after timeout
-    }, timeoutSeconds * 1000);
-    // Set up readline for immediate cancel
     const rl = readline.createInterface({
         input: process.stdin,
         output: process.stdout,
     });
     return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            rl.close();
+            resolve(true);
+        }, timeoutSeconds * 1000);
         rl.on('SIGINT', () => {
-            clearTimeout(timeout);
+            clearTimeout(timer);
             rl.close();
             console.log(chalk.yellow('\n⚠️  Command cancelled by user'));
             resolve(false);
         });
-        // If timeout expires, resolve without waiting for readline
-        setTimeout(() => {
-            rl.close();
-            resolve(true);
-        }, timeoutSeconds * 1000);
     });
 }
+// Security response handling for GUI integration
+export async function handleSecurityResponse(response) {
+    // Normalize response
+    const normalized = response.trim().toLowerCase();
+    // Accept 'y' or 'yes' as positive response
+    if (normalized === 'y' || normalized === 'yes') {
+        console.log('Security response: ALLOWED');
+        return true;
+    }
+    // Reject any other response
+    console.log('Security response: DENIED');
+    return false;
+}

package/dist/substitute.js

@@ -4,11 +4,32 @@ import path from 'path';
 import { sanitizePath } from './config.js';
 /**
  * Replaces all {{var}} patterns in the content with values from the variables object.
+ * Supports nested variable expansion - if a variable's value contains {{other_var}},
+ * it will be expanded iteratively until no more placeholders remain or maxIterations is reached.
  */
-export function substituteVariables(content, variables) {
-    return content.replace(/\{\{\s*(\w+)\s*\}\}/g, (_, varName) => {
-        return variables[varName] ?? `{{${varName}}}`;
-    });
+export function substituteVariables(content, variables, maxIterations = 10) {
+    let result = content;
+    let iteration = 0;
+    // Keep expanding until no more placeholders remain or we hit the limit
+    while (/\{\{[^}]+\}\}/.test(result) && iteration < maxIterations) {
+        // Use a more complex regex that captures the full placeholder including spaces
+        result = result.replace(/(\{\{\s*)(\w+)(\s*\}\})/g, (_, prefix, varName, suffix) => {
+            const val = variables[varName];
+            // If variable not found, leave placeholder as-is with original spacing
+            if (val === undefined) {
+                return `${prefix}${varName}${suffix}`;
+            }
+            // Return the value (which may contain more placeholders to expand)
+            return val;
+        });
+        iteration++;
+        // Prevent infinite loops by checking if we're stuck
+        if (iteration > 1 && result === content) {
+            console.warn(chalk.yellow(`Warning: Potential infinite loop detected in variable expansion, stopping after ${iteration} iterations`));
+            break;
+        }
+    }
+    return result;
 }
 /**
  * Processes copy_files tasks from a template.
@@ -30,7 +51,11 @@ export async function processCopyFiles(templateRoot, resolvedDest, template, var
                 console.log(chalk.gray(`  [DRY RUN] Would recursively copy directory ${copyFile.src} → ${copyFile.dest}`));
             }
             else {
-                copyDirRecursive(srcPath, destPath, variables, copyFile.substitute_variables || false, copyFile.chmod);
+                const dirSubstitute = !!(copyFile.substitute_variables === true || (copyFile.substitute_variables === undefined &&
+                    template.variables &&
+                    template.variables.length > 0 &&
+                    Object.keys(variables).length > 0));
+                copyDirRecursive(srcPath, destPath, variables, dirSubstitute, copyFile.chmod);
             }
             console.log(chalk.green(`  ✓ ${copyFile.dest} (recursive)`));
         }
@@ -38,7 +63,11 @@ export async function processCopyFiles(templateRoot, resolvedDest, template, var
             // Single file copy
             if (dryRun) {
                 console.log(chalk.gray(`  [DRY RUN] Would copy ${copyFile.src} → ${copyFile.dest}`));
-                if (copyFile.substitute_variables) {
+                const drySubstitute = !!(copyFile.substitute_variables === true || (copyFile.substitute_variables === undefined &&
+                    template.variables &&
+                    template.variables.length > 0 &&
+                    Object.keys(variables).length > 0));
+                if (drySubstitute) {
                     console.log(chalk.gray(`  [DRY RUN] Would substitute variables in ${copyFile.dest}`));
                 }
                 if (copyFile.chmod) {
@@ -49,7 +78,13 @@ export async function processCopyFiles(templateRoot, resolvedDest, template, var
             // Ensure destination directory exists
             fs.mkdirSync(path.dirname(destPath), { recursive: true });
             let content = fs.readFileSync(srcPath, 'utf-8');
-            if (copyFile.substitute_variables) {
+            // Default to substituting if substitute_variables is true, OR if it's undefined AND the template defines variables.
+            // If substitute_variables is explicitly false, do not substitute.
+            const shouldSubstitute = !!(copyFile.substitute_variables === true || (copyFile.substitute_variables === undefined &&
+                template.variables &&
+                template.variables.length > 0 &&
+                Object.keys(variables).length > 0));
+            if (shouldSubstitute) {
                 content = substituteVariables(content, variables);
             }
             fs.writeFileSync(destPath, content);