@garyr/pt-cli 0.33.0 → 0.38.0

package/doc/configuration.md

@@ -28,6 +28,58 @@ Instead of manual definition, `pt learn` and `pt update` automatically scan for
 
 These variables are then used during `copy_files` operations to replace `{{variable_name}}` placeholders in copied files.
 
+### Nested Variable Expansion (v0.36.0+)
+
+Starting with v0.36.0, `pt` supports **nested variable expansion** — variables can contain other variable placeholders that are resolved iteratively. This enables powerful configuration patterns like:
+
+```bash
+# In ~/.env or parent directory .env file:
+prefix='rst_{{ project }}'
+project=MyProject
+```
+
+During initialization, the system will:
+1. Load `prefix='rst_{{ project }}'` from `.env`
+2. Detect that `prefix` contains a `{{ project }}` placeholder
+3. Resolve `{{ project }}` to `MyProject`
+4. Set `prefix` to `rst_MyProject`
+
+This is particularly useful for:
+- **Project naming conventions**: `prefix='app_{{ env }}'` + `env=prod` → `app_prod`
+- **Path templates**: `template_path='docs/{{ project }}'` + `project=wiki` → `docs/wiki`
+- **Multi-level configurations**: Combine multiple `.env` files with nested references
+
+**How it works:**
+- Variables are expanded iteratively (up to 10 passes) to prevent infinite loops
+- Circular references are detected and stopped gracefully
+- Missing nested variables remain as `{{ variable }}` placeholders
+- Whitespace is preserved: `{{ unknown }}` stays as `{{ unknown }}` (not `{{unknown}}`)
+
+### Parent Directory `.env` File Scanning
+
+`pt` automatically scans parent directories for `.env` files and uses their values as defaults during initialization. This enables:
+
+- **Project-wide defaults**: Store common values in a parent `.env` file
+- **Environment-specific configurations**: Use different `.env` files for dev/staging/prod
+- **Team collaboration**: Share common variable values across team projects
+
+**Example:**
+```bash
+# Project structure:
+my-project/
+├── .env          # Contains: prefix='rst_'
+├── sub-project/  # Initialize here
+│   └── ...
+```
+
+When you run `pt init my-template sub-project`, the `prefix` variable will be pre-filled with `rst_` from the parent `.env` file.
+
+**Behavior:**
+- Scans from the current directory up to 3 parent levels
+- Uses values from `.env` as defaults (still prompts if not in `.env`)
+- `--vars` CLI option overrides `.env` values
+- `.env` files are not committed to version control (use `.gitignore`)
+
 ## Post-Config Tasks
 
 Post-config tasks are optional commands that run after a project is initialized. They can be defined in a template or auto-detected from the source directory.

package/doc/usage.md

@@ -46,6 +46,72 @@ During `pt learn` or `pt update`, the tool automatically scans text files at the
 - **Global Suggestions:** Your global variables (defined in `~/.pt/config.yaml`) are automatically injected as additional suggestions during the learn process.
 - **Updating:** You can add new placeholders to a project folder and run `pt update <template_name>` to automatically register them in your existing template.
 
+### Using `.env` Files for Variable Defaults (v0.36.0+)
+
+Starting with v0.36.0, `pt` automatically scans parent directories for `.env` files and uses their values as defaults during initialization. This enables powerful configuration patterns:
+
+```bash
+# Create a .env file in your project directory
+echo "prefix='rst_'" > .env
+echo "project='MyProject'" >> .env
+
+# Initialize a project - variables are pre-filled from .env
+pt init my-template my-new-project
+```
+
+**Key Features:**
+- **Automatic Scanning:** Scans up to 3 parent directories for `.env` files
+- **Variable Pre-filling:** Values from `.env` are used as defaults in prompts
+- **Nested Variables:** Supports nested placeholders like `prefix='app_{{ env }}'`
+- **Override Support:** Use `--vars` to override `.env` values: `--vars project=OverriddenProject`
+
+**Example with Nested Variables:**
+```bash
+# .env file
+prefix='app_{{ env }}'
+env=prod
+project=MyApp
+
+# Template README.md.tmpl
+# Content: {{prefix}}_{{project}}
+
+# Result: app_prod_MyApp
+```
+
+**Security Note:** `.env` files are not committed to version control. Use `.gitignore` to exclude them:
+```bash
+# .gitignore
+.env
+*.env
+```
+
+### Nested Variable Expansion (v0.36.0+)
+
+The `pt` CLI now supports **nested variable expansion** — variables can contain other variable placeholders that are resolved iteratively. This enables powerful configuration patterns:
+
+```bash
+# In .env file:
+prefix='rst_{{ project }}'
+project=MyProject
+
+# During initialization, the system will:
+# 1. Load prefix='rst_{{ project }}' from .env
+# 2. Detect that prefix contains a {{ project }} placeholder
+# 3. Resolve {{ project }} to MyProject
+# 4. Set prefix to rst_MyProject
+```
+
+**Use Cases:**
+- **Project naming conventions:** `prefix='app_{{ env }}'` + `env=prod` → `app_prod`
+- **Path templates:** `template_path='docs/{{ project }}'` + `project=wiki` → `docs/wiki`
+- **Multi-level configurations:** Combine multiple `.env` files with nested references
+
+**How it works:**
+- Variables are expanded iteratively (up to 10 passes) to prevent infinite loops
+- Circular references are detected and stopped gracefully
+- Missing nested variables remain as `{{ variable }}` placeholders
+- Whitespace is preserved: `{{ unknown }}` stays as `{{ unknown }}` (not `{{unknown}}`)
+
 ## Initialize a project
 
 ```bash

package/doc/variable_substitution_example.md

@@ -76,3 +76,67 @@ The resulting `package.json` in `my-new-project/` will be:
   "license": "MIT"
 }
 ```
+
+## 4. Nested Variable Expansion (v0.36.0+)
+
+Starting with v0.36.0, you can use **nested variables** for more complex configurations. Create a `.env` file in your project directory or parent directory:
+
+```bash
+# .env file in parent directory
+prefix='rst_'
+project=MyProject
+```
+
+Then use these variables in your template files:
+
+**`templates/README.md.tmpl`**:
+```markdown
+# {{prefix}}{{project}}
+
+This is a nested variable example where:
+- prefix = 'rst_'
+- project = 'MyProject'
+- Result: 'rst_MyProject'
+```
+
+**Even more complex nesting:**
+```bash
+# .env file
+prefix='app_{{ env }}'
+env=prod
+project=MyApp
+version=2.0
+```
+
+Then in your template:
+```json
+{
+  "name": "{{prefix}}_{{project}}",
+  "version": "{{version}}"
+}
+```
+
+This will resolve to:
+```json
+{
+  "name": "app_prod_MyApp",
+  "version": "2.0"
+}
+```
+
+**How it works:**
+1. `pt` scans parent directories for `.env` files
+2. Loads variables from `.env` as defaults
+3. Expands nested placeholders iteratively (up to 10 passes)
+4. Resolves circular references gracefully
+
+**Example with nested placeholders:**
+```bash
+# .env file
+template_path='docs/{{ project }}'
+project=wiki
+```
+
+Result: `template_path` becomes `docs/wiki`
+
+**Important:** Missing nested variables remain as `{{ variable }}` placeholders (with preserved whitespace) to help identify configuration issues.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@garyr/pt-cli",
-  "version": "0.33.0",
+  "version": "0.38.0",
   "description": "Project Template CLI - Learn structures and initialize projects",
   "main": "dist/index.js",
   "bin": {
@@ -43,4 +43,4 @@
     "tsx": "^4.21.0",
     "typescript": "^5.6.0"
   }
-}
+}

package/src/commands/defaultPostConfigCommand.ts

@@ -27,6 +27,7 @@ export function defaultPostConfigCommand(options: DefaultPostConfigOptions = {})
 
     console.error('You must provide --json <data> to set the default post-config array.');
   } else {
-    console.log('Current default post-config tasks:', config.default_post_config || []);
+    const tasks = config.default_post_config || [];
+    console.log(JSON.stringify(tasks, null, 2));
   }
 }

package/src/commands/initCommand.ts

@@ -14,6 +14,71 @@ export interface InitOptions {
   file?: string;
 }
 
+/**
+ * Scan parent directories for .env files and parse their variables.
+ * Returns a map of variable names to their values, supporting:
+ * - KEY=VALUE format
+ * - KEY="VALUE with spaces" format
+ * - KEY='VALUE with spaces' format
+ * - Comments (lines starting with #)
+ * - Empty lines
+ */
+function scanEnvForVariables(targetPath: string): Record<string, string> {
+  const envVars: Record<string, string> = {};
+  let currentDir = path.resolve(targetPath);
+  
+  // Scan up to 5 parent directories for .env files
+  const maxDepth = 5;
+  
+  for (let depth = 0; depth < maxDepth; depth++) {
+    const envPath = path.join(currentDir, '.env');
+    
+    if (fs.existsSync(envPath)) {
+      try {
+        const content = fs.readFileSync(envPath, 'utf-8');
+        const lines = content.split('\n');
+        
+        for (const line of lines) {
+          const trimmed = line.trim();
+          
+          // Skip empty lines and comments
+          if (!trimmed || trimmed.startsWith('#')) {
+            continue;
+          }
+          
+          // Match KEY=VALUE patterns
+          const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+)$/);
+          if (match) {
+            const key = match[1];
+            let value = match[2];
+            
+            // Remove surrounding quotes if present
+            if ((value.startsWith('"') && value.endsWith('"')) || 
+                (value.startsWith("'") && value.endsWith("'"))) {
+              value = value.slice(1, -1);
+            }
+            
+            envVars[key] = value;
+          }
+        }
+      } catch (err) {
+        // Silently skip unreadable .env files
+        continue;
+      }
+    }
+    
+    // Move to parent directory
+    const parentDir = path.dirname(currentDir);
+    if (parentDir === currentDir) {
+      // Reached filesystem root
+      break;
+    }
+    currentDir = parentDir;
+  }
+  
+  return envVars;
+}
+
 export async function init(targetName: string | undefined, destPath: string | undefined, options: InitOptions = {}) {
   const config = loadConfig();
 
@@ -103,6 +168,18 @@ export async function init(targetName: string | undefined, destPath: string | un
   // Handle Variables
   let variables: Record<string, string> = {};
   if (template.variables && template.variables.length > 0) {
+    // Scan parent directories for .env files and pre-fill variables
+    const envVars = scanEnvForVariables(resolvedDest);
+    
+    // Merge .env variables into variables (with lower priority than --vars)
+    if (Object.keys(envVars).length > 0) {
+      for (const [key, value] of Object.entries(envVars)) {
+        if (!variables[key]) {
+          variables[key] = value;
+        }
+      }
+    }
+    
     if (options.vars) {
       // Parse --vars "key=val,key2=val2"
       const pairs = options.vars.split(',').map((p: string) => p.trim());
@@ -172,26 +249,29 @@ export async function init(targetName: string | undefined, destPath: string | un
       if (fs.existsSync(srcPath)) {
         if (options.dryRun) {
           console.log(chalk.gray(`  [DRY RUN] Would copy ${file.src} → ${file.dest || file.src}`));
-          const ext = path.extname(file.src);
-          if (['.sh', '.py', '.bash', '.bat'].includes(ext)) {
-            console.log(chalk.gray(`  [DRY RUN] Would chmod +x ${file.dest || file.src}`));
-          }
+          console.log(chalk.gray(`  [DRY RUN] Would chmod +x ${file.dest || file.src}`));
           continue;
         }
 
-        const fileContent = fs.readFileSync(srcPath, 'utf-8');
+        let fileContent = fs.readFileSync(srcPath, 'utf-8');
+
+        // Substitute variables in post_copy files if template has variables
+        if (template.variables && template.variables.length > 0) {
+          const { substituteVariables } = await import('../substitute.js');
+          fileContent = substituteVariables(fileContent, variables);
+        }
+
         const destDir = path.dirname(destPath);
         fs.mkdirSync(destDir, { recursive: true });
         fs.writeFileSync(destPath, fileContent);
 
-        // Auto-chmod for executables
-        const ext = path.extname(file.src);
-        if (['.sh', '.py', '.bash', '.bat'].includes(ext)) {
-          try {
-            fs.chmodSync(destPath, 0o755);
-          } catch (e) {
-            // chmod not available (Windows)
-          }
+        // post_copy files are executables by definition — always chmod
+        try {
+          // Check if source had execute permissions, otherwise default to 0o755
+          const srcStat = fs.statSync(srcPath);
+          fs.chmodSync(destPath, srcStat.mode & 0o111 ? srcStat.mode : 0o755);
+        } catch (e) {
+          // chmod not available (Windows)
         }
         console.log(chalk.green("  ✓ " + (file.dest || file.src)));
       } else {
@@ -210,7 +290,40 @@ export async function init(targetName: string | undefined, destPath: string | un
   // Use template post_config tasks
   const allTasks = template.post_config?.filter(t => !t.type || t.type === typeName!) || [];
 
-  if (allTasks.length > 0) {
+  if (allTasks.length > 0 && !options.skipPostConfig) {
+    // SECURITY CHECK: Validate template safety before running post_config tasks
+    const { validateTemplateSecurity } = await import('../safety.js');
+    const { valid, errors, warnings } = validateTemplateSecurity(template);
+    
+    if (!valid) {
+      console.error(chalk.red("\n❌ SECURITY ERROR: Aborting post_config execution due to blocked commands:"));
+      for (const err of errors) {
+        console.error(chalk.red(`   - ${err}`));
+      }
+      process.exit(1);
+    }
+
+    if (warnings.length > 0) {
+      console.warn(chalk.yellow("\n⚠️  SECURITY WARNING: Post-config contains dangerous or suspicious commands:"));
+      for (const warn of warnings) {
+        console.warn(chalk.yellow(`   - ${warn}`));
+      }
+      
+      if (!options.yes) {
+        const { proceed } = await inquirer.prompt({
+          type: 'confirm',
+          name: 'proceed',
+          message: chalk.red('Are you sure you want to run these post-config tasks?'),
+          default: false
+        });
+        if (!proceed) {
+          console.log(chalk.yellow("Post-config tasks aborted by user."));
+          return;
+        }
+      } else {
+        console.warn(chalk.yellow("Proceeding anyway (non-interactive mode with auto-confirm enabled)."));
+      }
+    }
     // Determine which tasks to include
     let selectedTaskNames: string[] = [];
     

package/src/commands/learnCommand.ts

@@ -11,6 +11,7 @@ export interface LearnOptions {
   name?: string;
   desc?: string;
   json?: boolean;
+  allowUntrusted?: boolean;
 }
 
 
@@ -20,7 +21,15 @@ export async function learn(sourcePath: string, updateTemplate: string | null =
   // Phase 1: Remote Check
   if (sourcePath.startsWith('http')) {
     console.log(chalk.cyan(`Downloading remote template from: ${sourcePath}...`));
-    resolvedPath = await downloadAndExtract(sourcePath);
+    try {
+      resolvedPath = await downloadAndExtract(sourcePath, options.json || false, options.allowUntrusted || false);
+    } catch (err) {
+      if ((err as Error).message === 'Download cancelled by user due to untrusted source') {
+        console.log(chalk.yellow('Download cancelled. Exiting.'));
+        process.exit(0);
+      }
+      throw err;
+    }
   } else {
     resolvedPath = path.resolve(sourcePath);
   }
@@ -77,6 +86,9 @@ export async function learn(sourcePath: string, updateTemplate: string | null =
       process.exit(1);
     }
   } else {
+    // Track whether name came from .info.md or JSON (not user-provided)
+    const nameFromSource = !options.name && (fileTemplateConfig.name || infoName);
+    
     if (options.name) {
       targetName = options.name;
     } else if (fileTemplateConfig.name) {
@@ -98,6 +110,34 @@ export async function learn(sourcePath: string, updateTemplate: string | null =
         targetName = newName;
       }
     }
+    
+    // If name came from .info.md or JSON, prompt to confirm/edit
+    // This prevents accidental overwrites when creating new templates based on existing ones
+    if (nameFromSource && !options.json) {
+      if (options.yes) {
+        // In --yes mode, keep the auto-detected name but warn
+        const existingNames = getTemplateNames(config);
+        if (existingNames.includes(targetName)) {
+          console.warn(chalk.yellow(`⚠ Warning: "${targetName}" already exists. Using this name will overwrite the existing template.`));
+        }
+      } else {
+        const { confirmName } = await inquirer.prompt({
+          type: 'confirm',
+          name: 'confirmName',
+          message: `Use "${targetName}" as the template name?`,
+          default: true
+        });
+        if (!confirmName) {
+          const { newName } = await inquirer.prompt({
+            type: 'input',
+            name: 'newName',
+            message: 'Name this template:',
+            default: targetName
+          });
+          targetName = newName;
+        }
+      }
+    }
   }
 
   let description = '';
@@ -128,6 +168,9 @@ export async function learn(sourcePath: string, updateTemplate: string | null =
       }
     }
   } else {
+    // Track whether description came from .info.md or JSON (not user-provided)
+    const descFromSource = !options.desc && (fileTemplateConfig.description || infoDesc);
+    
     if (fileTemplateConfig.description) {
       description = fileTemplateConfig.description;
       if (!options.json) console.log(chalk.cyan(`Auto-detected template description from JSON: ${description}`));
@@ -145,6 +188,34 @@ export async function learn(sourcePath: string, updateTemplate: string | null =
       });
       description = newDesc;
     }
+    
+    // If description came from .info.md or JSON, prompt to confirm/edit
+    // This prevents accidental overwrites when creating new templates based on existing ones
+    if (descFromSource && !options.json) {
+      if (options.yes) {
+        // In --yes mode, keep the auto-detected description but warn
+        const existingNames = getTemplateNames(config);
+        if (existingNames.includes(targetName)) {
+          console.warn(chalk.yellow(`⚠ Warning: "${targetName}" already exists. Using this name will overwrite the existing template.`));
+        }
+      } else {
+        const { confirmDesc } = await inquirer.prompt({
+          type: 'confirm',
+          name: 'confirmDesc',
+          message: `Use "${description}" as the template description?`,
+          default: true
+        });
+        if (!confirmDesc) {
+          const { newDesc } = await inquirer.prompt({
+            type: 'input',
+            name: 'newDesc',
+            message: 'Purpose/Description of this template:',
+            default: description
+          });
+          description = newDesc;
+        }
+      }
+    }
   }
 
   const cliIgnore = options.ignore ? options.ignore.split(',').map((s: string) => s.trim()).filter(Boolean) : [];

package/src/commands/securityResponseCommand.ts

@@ -0,0 +1,18 @@
+// pt-cli/src/commands/securityResponseCommand.ts
+// CLI command to handle security responses from GUI
+
+import { handleSecurityResponse } from '../safety.js';
+
+export interface SecurityResponseOptions {
+  response: string;
+}
+
+export async function securityResponseCommand(response: string, options: SecurityResponseOptions = { response: '' }): Promise<void> {
+  const result = await handleSecurityResponse(response);
+  
+  if (result) {
+    console.log('SECURITY_RESPONSE:ALLOWED');
+  } else {
+    console.log('SECURITY_RESPONSE:DENIED');
+  }
+}

package/src/index.ts

@@ -14,6 +14,7 @@ import { variablesCommand } from './commands/variablesCommand.js';
 import { addCommand } from './commands/addCommand.js';
 import { removeCommand } from './commands/removeCommand.js';
 import { defaultPostConfigCommand } from './commands/defaultPostConfigCommand.js';
+import { securityResponseCommand } from './commands/securityResponseCommand.js';
 
 import pkg from '../package.json' with { type: 'json' };
 
@@ -32,8 +33,21 @@ program
   .option('--name <name>', 'Template name (skip prompt)')
   .option('--desc <description>', 'Template description (skip prompt)')
   .option('--json', 'Output template structure as JSON for sharing instead of saving')
+  .option('--allow-untrusted', 'Bypass the trusted-source check for remote URLs (set by GUI after user confirmation)')
   .action(async (pathArg: string | undefined, options) => {
-    await learn(pathArg || '.', null, options);
+    try {
+      await learn(pathArg || '.', null, options);
+    } catch (err: any) {
+      if (options.json) {
+        console.log(JSON.stringify({
+          type: 'error',
+          message: err.message || String(err)
+        }));
+      } else {
+        console.error(chalk.red(`Error: ${err.message || err}`));
+      }
+      process.exit(1);
+    }
   });
 
 program
@@ -43,7 +57,12 @@ program
   .option('-y, --yes', 'Automatically confirm prompts')
   .option('--desc <description>', 'Template description (skip prompt)')
   .action(async (templateName: string, sourcePath: string | undefined, options) => {
-    await learn(sourcePath || '.', templateName, options);
+    try {
+      await learn(sourcePath || '.', templateName, options);
+    } catch (err: any) {
+      console.error(chalk.red(`Error: ${err.message || err}`));
+      process.exit(1);
+    }
   });
 
 program
@@ -98,4 +117,11 @@ program
   .option('-y, --yes', 'Automatically confirm removal')
   .action(removeCommand);
 
+program
+  .command('security-response <response>')
+  .description('Handle security response from GUI')
+  .action(async (response: string) => {
+    await securityResponseCommand(response);
+  });
+
 program.parse(process.argv);

package/src/remote.ts

@@ -9,7 +9,7 @@ import chalk from 'chalk';
 import { isTrustedSource, logSecurityEvent, getSecurityPolicy } from './safety.js';
 import { loadConfig } from './config.js';
 
-export async function downloadAndExtract(url: string): Promise<string> {
+export async function downloadAndExtract(url: string, isJsonMode: boolean = false, allowUntrusted: boolean = false): Promise<string> {
     // Load security policy
     const configPath = path.join(process.env.HOME || os.homedir(), '.pt', 'config.yaml');
     const config = loadConfig();
@@ -17,21 +17,36 @@ export async function downloadAndExtract(url: string): Promise<string> {
         trustedSources: ['github.com/garyritchie', 'gitea.lyonritchie.com/garyritchie', 'github.com/lyonritchie'],
     };
 
-    // SECURITY CHECK: Verify source is trusted
-    if (!isTrustedSource(url, securityPolicy.trustedSources)) {
-        console.log(chalk.yellow(`⚠️  Warning: Template from untrusted source: ${url}`));
-        console.log(chalk.yellow('   Only use templates from trusted sources'));
-        
-        const inquirer = (await import('inquirer')).default;
-        const response = await inquirer.prompt({
-            type: 'confirm',
-            name: 'proceed',
-            message: chalk.red('Continue anyway?'),
-            default: false
-        });
-        
-        if (!response.proceed) {
-            throw new Error('Download cancelled by user due to untrusted source');
+    // SECURITY CHECK: Verify source is trusted (skipped when --allow-untrusted is passed)
+    if (!allowUntrusted && !isTrustedSource(url, securityPolicy.trustedSources)) {
+        if (isJsonMode) {
+            // In JSON mode, output warning as JSON for GUI consumption.
+            // The GUI will show a confirmation dialog and, if the user says YES,
+            // re-run `pt learn <url> --json --yes --allow-untrusted`.
+            console.log(JSON.stringify({
+                type: 'security_warning',
+                url: url,
+                message: `Template from untrusted source: ${url}`,
+                warning: 'Only use templates from trusted sources.',
+                prompt: 'Continue anyway?',
+                default: false
+            }));
+            process.exit(1);
+        } else {
+            console.log(chalk.yellow(`⚠️  Warning: Template from untrusted source: ${url}`));
+            console.log(chalk.yellow('   Only use templates from trusted sources'));
+            
+            const inquirer = (await import('inquirer')).default;
+            const response = await inquirer.prompt({
+                type: 'confirm',
+                name: 'proceed',
+                message: chalk.red('Continue anyway?'),
+                default: false
+            });
+            
+            if (!response.proceed) {
+                throw new Error('Download cancelled by user due to untrusted source');
+            }
         }
     }