@garyr/pt-cli 0.33.0 → 0.38.0

package/src/safety.ts

@@ -13,8 +13,8 @@ const BLOCKED_COMMANDS = [
   'sudo', 'su', 'su -', 'su root',
   // Disk operations that could destroy data
   'dd', 'mkfs', 'fdisk', 'mount', 'umount',
-  // Shell injection patterns
-  ';', '|', '&', '&&', '||',
+  // Shell injection patterns - removed from blocklist to allow command chaining.
+  // These are validated as warnings instead.
   // Dangerous chmod
   'chmod 777', 'chmod -R 777', 'chmod 666',
   // System commands that could kill processes
@@ -28,8 +28,6 @@ const BLOCKED_COMMANDS = [
 // === DANGEROUS PATTERNS ===
 // Commands that should trigger a warning but are NOT blocked
 const DANGEROUS_PATTERNS = [
-  // Destructive file operations
-  'rm -rf', 'rm -r', 'rm --no-preserve-root', 'rm -rf /',
   // Remote downloads + execution
   'curl', 'wget', 'wget -O', 'curl |', 'wget |',
   // Script execution
@@ -83,6 +81,31 @@ export function isBlockedCommand(command: string): boolean {
  * Check if a command should trigger a warning (but is allowed)
  */
 export function isDangerousCommand(command: string): boolean {
+  // Check for destructive file operations targeting absolute paths
+  // Regex matches 'rm', 'rmdir', or Windows 'del' followed by optional flags and then an absolute path.
+  // Absolute path matches:
+  // - Unix: starting with '/' (e.g. /tmp, /usr)
+  // - Windows: starting with drive letter (e.g. C:\) or UNC path (\\) or drive-relative '\'
+  const parts = command.split(/\s+/);
+  const rmIndex = parts.findIndex(p => p === 'rm' || p === 'rmdir' || p === 'del');
+  if (rmIndex !== -1) {
+    // Check subsequent arguments
+    for (let i = rmIndex + 1; i < parts.length; i++) {
+      const arg = parts[i];
+      if (!arg) continue;
+      // Skip flags (starting with - or /flag on Windows)
+      if (arg.startsWith('-') || (process.platform === 'win32' && arg.startsWith('/'))) {
+        continue;
+      }
+      // Check absolute path patterns
+      const isAbsolute = arg.startsWith('/') || 
+                         (process.platform === 'win32' && (/^[a-zA-Z]:\\/.test(arg) || arg.startsWith('\\\\') || arg.startsWith('\\')));
+      if (isAbsolute) {
+        return true;
+      }
+    }
+  }
+
   for (const pattern of DANGEROUS_PATTERNS) {
     if (command.includes(pattern)) {
       return true;
@@ -164,35 +187,35 @@ export function isTrustedSource(url: string, trustedSources: string[] = DEFAULT_
 }
 
 /**
- * Check if a command has been executed too many times (rate limiting)
+ * Rate limiting: track the last execution timestamp per command hash
  */
-const executionCounts = new Map<string, number>();
+const lastExecutionTimes = new Map<string, number>();
 const RATE_LIMIT_MS = 1000; // 1 second between identical commands
 
 export function canExecute(command: string, maxCommandsPerRun: number = 50): boolean {
-  // Check total count per run
-  const totalExecuted = Array.from(executionCounts.values()).reduce((sum, count) => sum + count, 0);
+  // Check total commands executed this run
+  const totalExecuted = lastExecutionTimes.size;
   if (totalExecuted >= maxCommandsPerRun) {
     return false;
   }
 
   // Check rate limit for this specific command
   const hash = crypto.createHash('md5').update(command).digest('hex');
-  const last = executionCounts.get(hash) || 0;
-  if (Date.now() - last < RATE_LIMIT_MS) {
+  const lastTime = lastExecutionTimes.get(hash) || 0;
+  if (Date.now() - lastTime < RATE_LIMIT_MS) {
     return false;
   }
 
-  // Update count
-  executionCounts.set(hash, Date.now());
+  // Record execution timestamp
+  lastExecutionTimes.set(hash, Date.now());
   return true;
 }
 
 /**
- * Reset execution counts (for testing or between runs)
+ * Reset execution timestamps (for testing or between runs)
  */
 export function resetExecutionCounts(): void {
-  executionCounts.clear();
+  lastExecutionTimes.clear();
 }
 
 /**
@@ -260,10 +283,10 @@ export function getSecurityPolicy(configPath?: string): SecurityPolicy {
 }
 
 /**
- * Show warning about dangerous command and wait for user to cancel
+ * Show warning about dangerous command and wait for user to cancel.
+ * Resolves true after the timeout (continue), or false immediately on CTRL+C (cancel).
  */
 export async function showDangerousCommandWarning(command: string, timeoutSeconds: number = 5): Promise<boolean> {
-  const inquirer = (await import('inquirer')).default;
   const readline = await import('readline');
 
   console.log(chalk.red('\n⚠️  DANGEROUS COMMAND DETECTED'));
@@ -271,29 +294,38 @@ export async function showDangerousCommandWarning(command: string, timeoutSecond
   console.log(chalk.red('   This could potentially harm your system.'));
   console.log(chalk.yellow(`   Press CTRL+C to cancel, or wait ${timeoutSeconds}s to continue...`));
 
-  // Set up timeout
-  const timeout = setTimeout(() => {
-    return true; // Continue after timeout
-  }, timeoutSeconds * 1000);
-
-  // Set up readline for immediate cancel
   const rl = readline.createInterface({
     input: process.stdin,
     output: process.stdout,
   });
 
   return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      rl.close();
+      resolve(true);
+    }, timeoutSeconds * 1000);
+
     rl.on('SIGINT', () => {
-      clearTimeout(timeout);
+      clearTimeout(timer);
       rl.close();
       console.log(chalk.yellow('\n⚠️  Command cancelled by user'));
       resolve(false);
     });
-
-    // If timeout expires, resolve without waiting for readline
-    setTimeout(() => {
-      rl.close();
-      resolve(true);
-    }, timeoutSeconds * 1000);
   });
 }
+
+// Security response handling for GUI integration
+export async function handleSecurityResponse(response: string): Promise<boolean> {
+  // Normalize response
+  const normalized = response.trim().toLowerCase();
+  
+  // Accept 'y' or 'yes' as positive response
+  if (normalized === 'y' || normalized === 'yes') {
+    console.log('Security response: ALLOWED');
+    return true;
+  }
+  
+  // Reject any other response
+  console.log('Security response: DENIED');
+  return false;
+}

package/src/substitute.ts

@@ -7,14 +7,39 @@ import { sanitizePath } from './config.js';
 
 /**
  * Replaces all {{var}} patterns in the content with values from the variables object.
+ * Supports nested variable expansion - if a variable's value contains {{other_var}},
+ * it will be expanded iteratively until no more placeholders remain or maxIterations is reached.
  */
 export function substituteVariables(
   content: string,
-  variables: Record<string, string>
+  variables: Record<string, string>,
+  maxIterations: number = 10
 ): string {
-  return content.replace(/\{\{\s*(\w+)\s*\}\}/g, (_, varName) => {
-    return variables[varName] ?? `{{${varName}}}`;
-  });
+  let result = content;
+  let iteration = 0;
+  
+  // Keep expanding until no more placeholders remain or we hit the limit
+  while (/\{\{[^}]+\}\}/.test(result) && iteration < maxIterations) {
+    // Use a more complex regex that captures the full placeholder including spaces
+    result = result.replace(/(\{\{\s*)(\w+)(\s*\}\})/g, (_, prefix, varName, suffix) => {
+      const val = variables[varName];
+      // If variable not found, leave placeholder as-is with original spacing
+      if (val === undefined) {
+        return `${prefix}${varName}${suffix}`;
+      }
+      // Return the value (which may contain more placeholders to expand)
+      return val;
+    });
+    iteration++;
+    
+    // Prevent infinite loops by checking if we're stuck
+    if (iteration > 1 && result === content) {
+      console.warn(chalk.yellow(`Warning: Potential infinite loop detected in variable expansion, stopping after ${iteration} iterations`));
+      break;
+    }
+  }
+  
+  return result;
 }
 
 /**
@@ -44,14 +69,26 @@ export async function processCopyFiles(
       if (dryRun) {
         console.log(chalk.gray(`  [DRY RUN] Would recursively copy directory ${copyFile.src} → ${copyFile.dest}`));
       } else {
-        copyDirRecursive(srcPath, destPath, variables, copyFile.substitute_variables || false, copyFile.chmod);
+        const dirSubstitute = !!(copyFile.substitute_variables === true || (
+          copyFile.substitute_variables === undefined &&
+          template.variables &&
+          template.variables.length > 0 &&
+          Object.keys(variables).length > 0
+        ));
+        copyDirRecursive(srcPath, destPath, variables, dirSubstitute, copyFile.chmod);
       }
       console.log(chalk.green(`  ✓ ${copyFile.dest} (recursive)`));
     } else {
       // Single file copy
       if (dryRun) {
         console.log(chalk.gray(`  [DRY RUN] Would copy ${copyFile.src} → ${copyFile.dest}`));
-        if (copyFile.substitute_variables) {
+        const drySubstitute = !!(copyFile.substitute_variables === true || (
+          copyFile.substitute_variables === undefined &&
+          template.variables &&
+          template.variables.length > 0 &&
+          Object.keys(variables).length > 0
+        ));
+        if (drySubstitute) {
           console.log(chalk.gray(`  [DRY RUN] Would substitute variables in ${copyFile.dest}`));
         }
         if (copyFile.chmod) {
@@ -64,7 +101,15 @@ export async function processCopyFiles(
       fs.mkdirSync(path.dirname(destPath), { recursive: true });
 
       let content = fs.readFileSync(srcPath, 'utf-8');
-      if (copyFile.substitute_variables) {
+      // Default to substituting if substitute_variables is true, OR if it's undefined AND the template defines variables.
+      // If substitute_variables is explicitly false, do not substitute.
+      const shouldSubstitute = !!(copyFile.substitute_variables === true || (
+        copyFile.substitute_variables === undefined &&
+        template.variables &&
+        template.variables.length > 0 &&
+        Object.keys(variables).length > 0
+      ));
+      if (shouldSubstitute) {
         content = substituteVariables(content, variables);
       }
 

package/tests/env-scanning.test.ts

@@ -0,0 +1,330 @@
+import { test } from 'node:test';
+import assert from 'node:assert';
+import fs from 'fs';
+import path from 'path';
+
+// Force a temporary home directory for testing before importing anything from the CLI
+const testHome = path.join(process.cwd(), '.test-home-env');
+process.env.HOME = testHome;
+
+// Import the init command to test the env scanning functionality
+import { init } from '../src/commands/initCommand.js';
+import { loadConfig, saveConfig, PtConfig, getConfigPath } from '../src/config.js';
+
+// Helper to clean up test directories
+function cleanup(...paths: string[]) {
+  for (const p of paths) {
+    if (fs.existsSync(p)) {
+      fs.rmSync(p, { recursive: true, force: true });
+    }
+  }
+}
+
+// Helper to set up a config with a template for testing
+function setupTestConfig(templateName: string, template: any): PtConfig {
+  const config: PtConfig = {
+    version: '3.0',
+    templates: {
+      [templateName]: template
+    }
+  };
+  saveConfig(config);
+  return config;
+}
+
+test('init scans parent directories for .env files and pre-fills variables', async () => {
+  const parentEnvDir = path.join(process.cwd(), 'test-parent-env');
+  const projectDest = path.join(parentEnvDir, 'test-env-project');
+  const templateRoot = path.join(process.cwd(), 'test-env-tpl-root');
+  cleanup(projectDest, templateRoot, testHome);
+
+  // Create template root with a file containing variables
+  fs.mkdirSync(templateRoot, { recursive: true });
+  fs.writeFileSync(
+    path.join(templateRoot, 'README.md'),
+    '# {{ project_name }}\n\nBy {{ author }}\n'
+  );
+
+  // Set up config with template that has variables and copy_files
+  setupTestConfig('env-tpl', {
+    description: 'Template with variables',
+    templateRoot: templateRoot,
+    folders: [],
+    variables: [
+      { name: 'project_name', prompt: 'Project name:', required: true },
+      { name: 'author', prompt: 'Author:', default: 'Unknown' }
+    ],
+    copy_files: [
+      { src: 'README.md', dest: 'README.md', substitute_variables: true }
+    ]
+  });
+
+  // Create parent directory with .env file containing matching variables
+  fs.mkdirSync(parentEnvDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(parentEnvDir, '.env'),
+    `project_name=EnvProject\nauthor=EnvAuthor\n`
+  );
+
+  // Run init from within the parent directory
+  await init('env-tpl', projectDest, {
+    yes: true,
+    skipPostConfig: true
+  });
+
+  // Verify .env variables were used
+  const readme = fs.readFileSync(path.join(projectDest, 'README.md'), 'utf-8');
+  assert.ok(readme.includes('EnvProject'), 'README should contain project_name from .env');
+  assert.ok(readme.includes('EnvAuthor'), 'README should contain author from .env');
+  assert.ok(!readme.includes('{{ project_name }}'), 'README should NOT contain variable placeholder');
+
+  cleanup(projectDest, templateRoot, parentEnvDir, testHome);
+});
+
+test('init --vars overrides .env variables', async () => {
+  const parentEnvDir = path.join(process.cwd(), 'test-parent-override');
+  const projectDest = path.join(parentEnvDir, 'test-override-project');
+  const templateRoot = path.join(process.cwd(), 'test-override-tpl-root');
+  cleanup(projectDest, templateRoot, testHome);
+
+  // Create template root with a file containing variables
+  fs.mkdirSync(templateRoot, { recursive: true });
+  fs.writeFileSync(
+    path.join(templateRoot, 'config.txt'),
+    'name={{ project_name }}\n'
+  );
+
+  // Set up config with template that has variables and copy_files
+  setupTestConfig('override-tpl', {
+    description: 'Template with variables',
+    templateRoot: templateRoot,
+    folders: [],
+    variables: [
+      { name: 'project_name', prompt: 'Project name:', required: true }
+    ],
+    copy_files: [
+      { src: 'config.txt', dest: 'config.txt', substitute_variables: true }
+    ]
+  });
+
+  // Create parent directory with .env file
+  fs.mkdirSync(parentEnvDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(parentEnvDir, '.env'),
+    `project_name=EnvProject\n`
+  );
+
+  // Run init with --vars to override .env value
+  await init('override-tpl', projectDest, {
+    yes: true,
+    skipPostConfig: true,
+    vars: 'project_name=CLIProject'
+  });
+
+  // Verify --vars value was used instead of .env value
+  const configContent = fs.readFileSync(path.join(projectDest, 'config.txt'), 'utf-8');
+  assert.ok(configContent.includes('CLIProject'), 'config.txt should contain --vars value');
+  assert.ok(!configContent.includes('EnvProject'), 'config.txt should NOT contain .env value');
+
+  cleanup(projectDest, templateRoot, parentEnvDir, testHome);
+});
+
+test('init uses .env from immediate parent directory', async () => {
+  const parentEnvDir = path.join(process.cwd(), 'test-immediate-parent');
+  const projectDest = path.join(parentEnvDir, 'test-immediate-parent-project');
+  const templateRoot = path.join(process.cwd(), 'test-immediate-parent-tpl-root');
+  cleanup(projectDest, templateRoot, testHome);
+
+  // Create template root with a file containing variables
+  fs.mkdirSync(templateRoot, { recursive: true });
+  fs.writeFileSync(
+    path.join(templateRoot, 'README.md'),
+    '# {{ project_name }}\n'
+  );
+
+  // Set up config with template that has variables and copy_files
+  setupTestConfig('immediate-parent-tpl', {
+    description: 'Template with variables',
+    templateRoot: templateRoot,
+    folders: [],
+    variables: [
+      { name: 'project_name', prompt: 'Project name:', required: true }
+    ],
+    copy_files: [
+      { src: 'README.md', dest: 'README.md', substitute_variables: true }
+    ]
+  });
+
+  // Create immediate parent directory with .env file
+  fs.mkdirSync(parentEnvDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(parentEnvDir, '.env'),
+    `project_name=ImmediateParent\n`
+  );
+
+  // Run init from within the parent directory
+  await init('immediate-parent-tpl', projectDest, {
+    yes: true,
+    skipPostConfig: true
+  });
+
+  // Verify .env variable was used
+  const readme = fs.readFileSync(path.join(projectDest, 'README.md'), 'utf-8');
+  assert.ok(readme.includes('ImmediateParent'), 'README should contain project_name from immediate parent .env');
+
+  cleanup(projectDest, templateRoot, parentEnvDir, testHome);
+});
+
+test('init scans multiple parent directories for .env files', async () => {
+  const topEnvDir = path.join(process.cwd(), 'test-multi-parent');
+  const midEnvDir = path.join(topEnvDir, 'test-mid-env');
+  const projectDest = path.join(midEnvDir, 'test-multi-parent-project');
+  const templateRoot = path.join(process.cwd(), 'test-multi-parent-tpl-root');
+  cleanup(projectDest, templateRoot, testHome);
+
+  // Create template root with a file containing variables
+  fs.mkdirSync(templateRoot, { recursive: true });
+  fs.writeFileSync(
+    path.join(templateRoot, 'README.md'),
+    '# {{ project_name }}\n\nBy {{ author }}\n'
+  );
+
+  // Set up config with template that has variables and copy_files
+  setupTestConfig('multi-parent-tpl', {
+    description: 'Template with variables',
+    templateRoot: templateRoot,
+    folders: [],
+    variables: [
+      { name: 'project_name', prompt: 'Project name:', required: true },
+      { name: 'author', prompt: 'Author:', default: 'Unknown' }
+    ],
+    copy_files: [
+      { src: 'README.md', dest: 'README.md', substitute_variables: true }
+    ]
+  });
+
+  // Create nested directory structure with .env files at different levels
+  fs.mkdirSync(topEnvDir, { recursive: true });
+  fs.mkdirSync(midEnvDir, { recursive: true });
+  
+  // .env file at the top level with project_name
+  fs.writeFileSync(
+    path.join(topEnvDir, '.env'),
+    `project_name=TopLevel\n`
+  );
+  
+  // .env file at the middle level with author
+  fs.writeFileSync(
+    path.join(midEnvDir, '.env'),
+    `author=MidLevelAuthor\n`
+  );
+
+  // Run init from the deepest directory
+  await init('multi-parent-tpl', projectDest, {
+    yes: true,
+    skipPostConfig: true
+  });
+
+  // Verify .env variables from different levels were used
+  const readme = fs.readFileSync(path.join(projectDest, 'README.md'), 'utf-8');
+  assert.ok(readme.includes('TopLevel'), 'README should contain project_name from top level .env');
+  assert.ok(readme.includes('MidLevelAuthor'), 'README should contain author from middle level .env');
+
+  cleanup(projectDest, templateRoot, topEnvDir, midEnvDir, testHome);
+});
+
+test('init uses .env values with quoted strings', async () => {
+  const parentEnvDir = path.join(process.cwd(), 'test-quoted-parent');
+  const projectDest = path.join(parentEnvDir, 'test-quoted-strings-project');
+  const templateRoot = path.join(process.cwd(), 'test-quoted-strings-tpl-root');
+  cleanup(projectDest, templateRoot, testHome);
+
+  // Create template root with a file containing variables
+  fs.mkdirSync(templateRoot, { recursive: true });
+  fs.writeFileSync(
+    path.join(templateRoot, 'README.md'),
+    '# {{ project_name }}\n\nBy {{ author }}\n'
+  );
+
+  // Set up config with template that has variables and copy_files
+  setupTestConfig('quoted-strings-tpl', {
+    description: 'Template with variables',
+    templateRoot: templateRoot,
+    folders: [],
+    variables: [
+      { name: 'project_name', prompt: 'Project name:', required: true },
+      { name: 'author', prompt: 'Author:', default: 'Unknown' }
+    ],
+    copy_files: [
+      { src: 'README.md', dest: 'README.md', substitute_variables: true }
+    ]
+  });
+
+  // Create parent directory with .env file containing quoted strings
+  fs.mkdirSync(parentEnvDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(parentEnvDir, '.env'),
+    `project_name="My Quoted Project"\nauthor='Quoted Author'\n`
+  );
+
+  // Run init from within the parent directory
+  await init('quoted-strings-tpl', projectDest, {
+    yes: true,
+    skipPostConfig: true
+  });
+
+  // Verify quoted strings were parsed correctly
+  const readme = fs.readFileSync(path.join(projectDest, 'README.md'), 'utf-8');
+  assert.ok(readme.includes('My Quoted Project'), 'README should contain project_name without quotes');
+  assert.ok(readme.includes('Quoted Author'), 'README should contain author without quotes');
+  assert.ok(!readme.includes('"My Quoted Project"'), 'README should NOT contain quotes around project_name');
+  assert.ok(!readme.includes("'Quoted Author'"), 'README should NOT contain quotes around author');
+
+  cleanup(projectDest, templateRoot, parentEnvDir, testHome);
+});
+
+test('init uses .env values with comments and empty lines', async () => {
+  const parentEnvDir = path.join(process.cwd(), 'test-comments-parent');
+  const projectDest = path.join(parentEnvDir, 'test-comments-project');
+  const templateRoot = path.join(process.cwd(), 'test-comments-tpl-root');
+  cleanup(projectDest, templateRoot, testHome);
+
+  // Create template root with a file containing variables
+  fs.mkdirSync(templateRoot, { recursive: true });
+  fs.writeFileSync(
+    path.join(templateRoot, 'README.md'),
+    '# {{ project_name }}\n'
+  );
+
+  // Set up config with template that has variables and copy_files
+  setupTestConfig('comments-tpl', {
+    description: 'Template with variables',
+    templateRoot: templateRoot,
+    folders: [],
+    variables: [
+      { name: 'project_name', prompt: 'Project name:', required: true }
+    ],
+    copy_files: [
+      { src: 'README.md', dest: 'README.md', substitute_variables: true }
+    ]
+  });
+
+  // Create parent directory with .env file containing comments and empty lines
+  fs.mkdirSync(parentEnvDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(parentEnvDir, '.env'),
+    `# This is a comment\n\nproject_name=CommentProject\n\n# Another comment\n`
+  );
+
+  // Run init from within the parent directory
+  await init('comments-tpl', projectDest, {
+    yes: true,
+    skipPostConfig: true
+  });
+
+  // Verify .env variable was used (comments and empty lines should be ignored)
+  const readme = fs.readFileSync(path.join(projectDest, 'README.md'), 'utf-8');
+  assert.ok(readme.includes('CommentProject'), 'README should contain project_name from .env');
+
+  cleanup(projectDest, templateRoot, parentEnvDir, testHome);
+});