@garyr/pt-cli 0.41.0 → 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,247 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [1.0.0] - 2026-07-31
+
+### 🎉 First Stable Release
+
+This release locks the public API for the 1.x series. See [README](README.md#10-release--api-stability) for stability guarantees.
+
+### Changed
+
+- **Version bump**: 0.42.0 → 1.0.0
+- **Documentation overhaul**: Added API stability promise, versioning policy, migration guide, and locked CLI/config/JSON schemas to README
+- **Config schema v3.0 locked**: No breaking changes to `~/.pt/config.yaml` or `.pt-template.json` in 1.x
+
+### Fixed
+
+- All documentation files updated to reflect current implementation (exclusions, testing, variable substitution)
+
+---
+
+## [0.42.0] - 2026-07-25
+
+### Added
+
+- Security enhancements and audit logging improvements
+- Additional security test coverage
+
+### Fixed
+
+- Consistent key ordering in config.yaml output (name → prompt → default → required)
+
+---
+
+## [0.41.0] - 2026-07-20
+
+### Added
+
+- Shared utility modules for template parsing
+- Comprehensive test suites for config-utils, learn, and substitute commands
+- Testing guide documentation
+
+### Fixed
+
+- Learn and update checkbox interaction bugs
+- Config test isolation by making HOME_DIR dynamic
+- Critical issue where config was being wiped during test execution
+
+---
+
+## [0.40.0] - 2026-07-15
+
+### Added
+
+- **Remote template learning**: `pt learn https://github.com/user/repo` downloads and learns from Git repositories and tarball URLs
+- Trusted source verification with `--allow-untrusted` override
+- Automatic URL translation for GitHub/Gitea to tarball endpoints
+
+### Changed
+
+- Improved template sharing and portability workflow
+- Strip trailing `.git` from repository URLs
+
+---
+
+## [0.39.0] - 2026-07-10
+
+### Added
+
+- JSON template config files (`.pt-template.json`, `template.json`) take precedence over `.info.md` and shell scripts
+- Full template metadata auto-detection from JSON config files
+- JSON export/import for template sharing
+
+### Fixed
+
+- JSON variables take precedence during update
+- Update docs for remote learn
+
+---
+
+## [0.38.0] - 2026-07-05
+
+### Added
+
+- **Additive diff mode for `pt update`** (default): Shows only new folders/files/variables for de-selection
+- `--no-diff` flag to restore full/original update mode
+- Preserves existing `substitute_variables` and `post_copy` settings during updates
+
+### Changed
+
+- Default post-config tasks renamed from `global_post_config` → `default_post_config`
+- Default tasks now baked into template at learn time (not auto-applied at init)
+
+---
+
+## [0.37.0] - 2026-06-28
+
+### Added
+
+- Security model: command validation, blocklists, dangerous command warnings with 5-second countdown
+- Rate limiting (50 commands per init session)
+- Execution timeout (30 seconds per command)
+- Audit logging to `~/.pt/security-audit.log`
+- Trusted sources for remote template downloads
+- `pt security-response` command for GUI integration
+
+### Fixed
+
+- Security warning loop issues
+- Variables not replaced during init; missing chmod for scripts
+- Selecting "N" during learn with untrusted URL now exits cleanly
+
+---
+
+## [0.36.0] - 2026-06-20
+
+### Added
+
+- **Nested variable expansion**: Variables can contain other `{{ variable }}` placeholders resolved iteratively (up to 10 passes)
+- **Parent directory `.env` file scanning**: Automatic defaults from `.env` files up to 3 levels up
+- Circular reference detection and graceful handling
+- Whitespace preservation for unresolved placeholders
+
+---
+
+## [0.35.0] - 2026-06-15
+
+### Added
+
+- Default post-config tasks (`default_post_config`) with `checked`, `type` filter fields
+- `pt default-post-config` command for managing default tasks via JSON
+- Template-specific post-config with `always_prompt`, `script`, `cross_platform` fields
+- Auto-detection of post-config from `post_config.sh`/`post_config.bat`
+
+---
+
+## [0.34.0] - 2026-06-10
+
+### Added
+
+- Global variables in config.yaml with `name`, `prompt`, `default`, `required` fields
+- `pt variables` command for managing global variables (`--set`, `--delete`, `--json`)
+- Variable suggestions during `pt learn`/`pt update`
+
+---
+
+## [0.33.0] - 2026-06-05
+
+### Added
+
+- `pt add` command for importing templates from JSON string/file
+- `pt config --json` for full config export
+- `pt config <template> --json` for single template export
+- Direct JSON scaffolding: `pt init --file template.json`
+
+---
+
+## [0.32.0] - 2026-05-28
+
+### Added
+
+- Comprehensive test suite (114+ tests passing)
+- Test isolation with dynamic HOME directory
+- Sequential test run option (`npm run test:sequential`)
+
+---
+
+## [0.31.0] - 2026-05-20
+
+### Added
+
+- Config version 3.0 migration (auto-migrates from v2.0)
+- Renames `name` → `description`, removes `type` field
+- Migrates `global_post_config` → `default_post_config`
+- Normalizes variables from Record → TemplateVariable[]
+
+---
+
+## [0.30.0] - 2026-05-10
+
+### Added
+
+- Automatic variable detection from `{{ var }}` placeholders during `pt learn`/`pt update`
+- Auto-detection of executable scripts for `post_copy`
+- Folder ignore patterns with glob support (`DAILIES/*`, `**/FOLDER/`, etc.)
+
+---
+
+## [0.20.0 - 0.29.0] - 2026-04 to 2026-05
+
+### Added (Incremental)
+
+- Core `pt learn`, `pt init`, `pt update`, `pt config`, `pt remove` commands
+- Template structure learning with folder hierarchy
+- Variable substitution in `copy_files` with `substitute_variables`
+- Post-copy executable handling
+- Remote template infrastructure
+- Cross-platform binary builds (Linux, macOS, Windows via Bun)
+
+---
+
+## [0.10.0] - 2026-03-15
+
+### Added
+
+- Initial project structure
+- TypeScript + Commander.js CLI framework
+- Basic template learning and initialization
+- YAML config storage at `~/.pt/config.yaml`
+
+---
+
+## Migration Guides
+
+### 0.x → 1.0.0
+
+**No manual action required.** Run any `pt` command and your config auto-migrates from v2.0 → v3.0 with a `.bak` backup created.
+
+Key 0.x breaking changes already applied in earlier versions:
+
+- Config v3.0 (0.31+): `name`→`description`, `global_post_config`→`default_post_config`
+- Additive update mode (0.38+): `pt update` shows diffs by default
+- Nested variables (0.36+): `.env` scanning and iterative expansion
+- Security model (0.37+): Command validation, audit logging
+
+### 0.30 → 0.31 (Config v3.0)
+
+Auto-migration handles:
+
+- `template.name` → `template.description`
+- `template.type` removed
+- `global_post_config` → `default_post_config`
+- `variables` Record → `TemplateVariable[]`
+
+---
+
+## Links
+
+- [GitHub Releases](https://github.com/garyritchie/pt-cli/releases)
+- [npm Package](https://www.npmjs.com/package/@garyr/pt-cli)
+- [Documentation](doc/)

package/README.md

@@ -67,7 +67,9 @@ Standardization is key to lowering the friction of starting new work. By ensurin
 
 ### 📦 Sharing is Caring
 
-Templates can be exported as plain-text JSON files (`.pt-template.json`). This makes them completely self-describing, easy to share with your team, version control, or pull directly from remote repositories without vendor lock-in.
+Templates can be exported as JSON configuration files via `pt config <name> --json > .pt-template.json`. This exports the template's structure (folders, files to copy), variables, and post-config tasks — but *not* the actual file contents.
+
+For fully self-contained distribution, commit the template's source directory alongside its JSON config.
 
 ### 🤖 Agentic and API Friendly
 
@@ -156,3 +158,100 @@ Because `pt-cli` is built around flexibility, the app purposefully avoids imposi
 
 * **[Example Templates](https://github.com/search?q=topic%3Atemplate-project+org%3Agaryritchie&type=Repositories):** We have provided a few templates based on our own workflows to get you started. These include helpful Python scripts for streamlining common tasks, such as downloading the latest version of Blender or pruning unused folders from a project.
 * **[Share Your Own](https://github.com/garyritchie/pt-cli/discussions):** Have you built a project structure that works perfectly for your niche? Join us in GitHub Discussions to share your templates and see how others are organizing their work.
+
+## 1.0 Release & API Stability
+
+**pt-cli v1.0.0** marks the first stable release with a locked public API. This means:
+
+### 🔒 Stability Guarantee (1.x series)
+
+- **No breaking changes** to CLI command signatures, flags, or config schema (`~/.pt/config.yaml`) within the 1.x series
+- **No breaking changes** to the JSON template format (`.pt-template.json` / `template.json`)
+- **No breaking changes** to the Node.js programmatic API (if used as a library)
+
+### 📦 Versioning Policy
+
+| Version | Meaning |
+|---------|---------|
+| **MAJOR** (1.0 → 2.0) | Breaking changes to CLI, config schema, or JSON template format |
+| **MINOR** (1.0 → 1.1) | New features, commands, or config options (backward compatible) |
+| **PATCH** (1.0 → 1.0.1) | Bug fixes, security patches, documentation updates |
+
+### 📋 What's Locked in 1.0
+
+**CLI Commands & Flags:**
+```bash
+pt learn [path] [--ignore] [--name] [--desc] [--yes] [--json] [--allow-untrusted] [--no-diff]
+pt init [template] [dest] [--file] [--skip-post-config] [--dry-run] [--yes] [--vars]
+pt update <template> [path] [--ignore] [--desc] [--yes] [--no-diff]
+pt config [template] [--json]
+pt add <name> [--file] [json]
+pt remove <template> [--yes]        # alias: pt rm
+pt variables [--set] [--delete] [--json]
+pt default-post-config [--set --json]
+pt ignore [patterns] [--set]
+pt security-response <response>
+```
+
+**Config Schema (`~/.pt/config.yaml` v3.0):**
+```yaml
+version: "3.0"
+templates: { <name>: TemplateConfig }
+default_post_config: PostConfigTask[]
+ignore: string[]
+variables: TemplateVariable[]
+security: SecurityPolicy  # optional
+```
+
+**TemplateConfig (per-template):**
+```yaml
+description: string
+templateRoot?: string
+variables?: TemplateVariable[]
+folders: FolderNode[]
+exclude?: string[]
+copy_files?: CopyFileEntry[]
+post_copy?: PostCopyFile[]
+post_config?: PostConfigTask[]
+```
+
+**JSON Template Format (`.pt-template.json`):**
+```json
+{
+  "name": "template-name",
+  "description": "Template description",
+  "variables": [{ "name": "", "prompt": "", "default": "", "required": false }],
+  "folders": [{ "name": "", "info": "", "children": [] }],
+  "copy_files": [{ "src": "", "dest": "", "substitute_variables": false, "chmod": "" }],
+  "post_config": [{ "command": "", "description": "", "type": "", "always_prompt": false, "script": "", "cross_platform": false, "checked": true }],
+  "post_copy": [{ "src": "", "dest": "" }]
+}
+```
+
+### 📖 Migration from 0.x to 1.0
+
+If you're upgrading from a 0.x version:
+
+1. **Config auto-migrates** — `pt` automatically upgrades your `~/.pt/config.yaml` from v2.0 → v3.0 on first run (renames `name` → `description`, removes `type`, migrates `global_post_config` → `default_post_config`, normalizes variables)
+2. **No action needed** — Just run any `pt` command; migration happens silently with a backup (`.bak`) created
+3. **CLI flags unchanged** — All 0.x flags work identically in 1.0
+
+**Breaking changes from 0.x already landed in 0.30+:**
+- Config version 3.0 (v0.30+)
+- `default_post_config` replaces `global_post_config` (v0.30+)
+- Additive diff mode for `pt update` (v0.38+)
+- Nested variable expansion (v0.36+)
+- `.env` file scanning for defaults (v0.36+)
+
+If you skipped intermediate 0.x versions, the auto-migration handles everything.
+
+---
+
+## Documentation
+
+* **[Detailed Usage](doc/usage.md)** - Learn, Initialize, Update, and Remove commands.
+* **[Configuration Guide](doc/configuration.md)** - Template variables, post-config tasks, file copying, and more.
+* **[Security Guide](doc/security.md)** - Command validation, trusted sources, audit logging.
+* **[Testing Guide](doc/testing.md)** - Test suite structure and running tests.
+* **[Exclusions Reference](doc/exclusions.md)** - Default ignored files and custom patterns.
+* **[Variable Substitution Example](doc/variable_substitution_example.md)** - Practical examples.

package/dist/config.js

@@ -109,6 +109,20 @@ export function normalizeVariable(v) {
         result.required = v.required;
     return result;
 }
+export function normalizeFolders(folders) {
+    return folders.map(folder => {
+        const normalized = { name: folder.name, info: folder.info || '' };
+        if (folder.children !== undefined && folder.children.length > 0) {
+            normalized.children = normalizeFolders(folder.children);
+        }
+        else if (folder.children !== undefined) {
+            normalized.children = [];
+        }
+        if (folder.is_file !== undefined)
+            normalized.is_file = folder.is_file;
+        return normalized;
+    });
+}
 export function saveConfig(config) {
     ensureConfigDir();
     // Normalize variable key ordering (forces 'name' to be first in serialized YAML)
@@ -121,6 +135,28 @@ export function saveConfig(config) {
             if (template.variables && Array.isArray(template.variables)) {
                 template.variables = template.variables.map(normalizeVariable);
             }
+            if (template.folders && Array.isArray(template.folders)) {
+                template.folders = normalizeFolders(template.folders);
+            }
+            // Create a new object with keys in the desired order for consistent YAML output
+            const orderedTemplate = {};
+            if (template.description !== undefined)
+                orderedTemplate.description = template.description;
+            if (template.templateRoot !== undefined)
+                orderedTemplate.templateRoot = template.templateRoot;
+            if (template.variables !== undefined)
+                orderedTemplate.variables = template.variables;
+            if (template.folders !== undefined)
+                orderedTemplate.folders = template.folders;
+            if (template.exclude !== undefined)
+                orderedTemplate.exclude = template.exclude;
+            if (template.copy_files !== undefined)
+                orderedTemplate.copy_files = template.copy_files;
+            if (template.post_copy !== undefined)
+                orderedTemplate.post_copy = template.post_copy;
+            if (template.post_config !== undefined)
+                orderedTemplate.post_config = template.post_config;
+            config.templates[key] = orderedTemplate;
         }
     }
     const content = YAML.stringify(config);
@@ -183,17 +219,12 @@ export function getSecurityPolicy(config) {
 // Default exclusions for template scanning
 export const DEFAULT_EXCLUDES = [
     '.git',
-    '.gitea',
-    '.vscode',
     'node_modules',
     'dist',
     'build',
     'bin',
     '.DS_Store',
     'Thumbs.db',
-    '.stignore',
-    '.stfolder',
-    '.stversions',
 ];
 // Check if a path should be excluded
 export function shouldExclude(dirPath, fullPath, excludes) {
@@ -291,22 +322,10 @@ export function shouldExcludeFile(fileName) {
         '*.swo',
         '*~',
         '.bak',
-        '*.md',
-        '*.txt',
-        '*.json',
-        '*.yaml',
-        '*.yml',
-        '*.ini',
-        '*.conf',
-        '*.config',
-        '.gitconfig',
-        '.makerc',
         'Gemfile.lock',
-        'package.json',
         'package-lock.json',
         'yarn.lock',
         'pnpm-lock.yaml',
-        'composer.json',
         'composer.lock',
     ];
     for (const pattern of excludePatterns) {

package/doc/exclusions.md

@@ -1,13 +1,18 @@
 # Exclusions
 
-The following are excluded by default when learning templates:
+The following are excluded by default when learning templates (from `src/config.ts`):
 
-- `.git`, `node_modules`, `dist`, `build`
-- `.DS_Store`, `.pytest_cache`, `__pycache__`
-- `.vscode`, `.idea`
-- Various editor/IDE files (`.bak`, `.swp`, etc.)
-- Compiled files (`.pyc`, `.so`, `.dll`, etc.)
-- `.gitkeep.md`, `.info.md`, `.vale.ini`, `.gitattributes`
+- `.git`
+- `node_modules`, `dist`, `build`, `bin`
+- `.DS_Store`, `Thumbs.db`
+
+Additionally, these **file patterns** are excluded from `copy_files`/`post_copy` scanning:
+
+- Compiled/binary: `*.pyc`, `*.pyo`, `*.pyd`, `.Python`, `*.egg-info`, `*.egg`, `*.whl`, `*.so`, `*.dll`, `*.dylib`, `*.exe`, `*.o`, `*.a`, `*.lib`, `*.class`, `*.jar`, `*.war`, `*.ear`
+- Logs/temp: `*.log`, `*.tmp`, `*.swp`, `*.swo`, `*~`, `.bak`
+- Lockfiles: `Gemfile.lock`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `composer.lock`
+
+> **Note:** Configuration files (`*.json`, `*.yaml`, `*.yml`, `*.ini`, `*.conf`, `*.config`, `.gitconfig`, `.makerc`, `package.json`, `composer.json`), documentation (`*.md`, `*.txt`), and editor folders (`.vscode`, `.gitea`, `.stignore`, etc.) are **NOT** excluded by default. Use the `ignore` config or `--ignore` flag to exclude them if needed.
 
 ## Ignore Patterns
 
@@ -26,10 +31,11 @@ Patterns use wildcards for clarity:
 | ------------ | ---------------------------------------------------------------------------- |
 | `DAILIES/*`  | Ignore all contents of DAILIES (DAILIES itself is kept as a template folder) |
 | `DAILIES/**` | Same as `DAILIES/*` (deep match)                                             |
-| `NODE`       | Ignore this specific folder only (no wildcard = exact match)                 |
+| `**/FOLDER/` | Ignore any folder named FOLDER at any depth                                  |
+| `FOLDER`     | Ignore this specific folder (at root or by name)                             |
 
 The CLI flag `--ignore=DAILIES/*,PARKING_LOT/*` merges with the config patterns (one-shot, not persistent).
 
 ## Custom exclusions
 
-Additional patterns can be added to `DEFAULT_EXCLUDES` in `src/config.ts`.
+Additional patterns can be added to `DEFAULT_EXCLUDES` in `src/config.ts` or via the `--ignore` flag / config `ignore` array.

package/doc/testing.md

@@ -6,24 +6,28 @@ This guide explains how to run, write, and manage the test suite for `pt-cli`.
 
 The test suite uses Node.js's native test runner (`node:test`) and assertion library (`node:assert`). It is configured to run files ending with `.test.ts` in the `tests/` directory.
 
-## Running Tests
-
-### 0. Security Testing
-
-Security features can be tested by:
-
-1. **Testing command blocks**: Try running templates with dangerous commands like `sudo rm -rf` or `dd`
-2. **Testing remote downloads**: Use untrusted URLs to verify source verification
-3. **Testing rate limiting**: Execute more than 50 commands in a single init session
-4. **Testing timeouts**: Run commands that hang to verify timeout behavior
-5. **Reviewing audit logs**: Check `~/.pt/security-audit.log` for security events
+## Test Suite Summary (as of v1.0.0)
+
+| Test File | Focus | Test Count |
+|-----------|-------|------------|
+| `config.test.ts` | Config loading, saving, migration, atomic writes | ~30 |
+| `init.test.ts` | Project initialization, variables, dry-run, copy_files, post_copy | ~20 |
+| `learn.test.ts` | Template learning, updates, variable detection, JSON output | ~25 |
+| `update.test.ts` | Additive diff mode, full mode, post-config, JSON config | ~15 |
+| `substitute.test.ts` | Variable substitution, nested expansion, edge cases | ~15 |
+| `safety.test.ts` | Security validation, command blocking, audit logging | ~15 |
+| `remote.test.ts` | Remote template download, trusted sources | ~10 |
+| `config-utils.test.ts` | Ignore patterns, path sanitization, exclusions | ~10 |
+| `nested-variable-expansion.test.ts` | Nested variable resolution, circular refs | ~5 |
+| `env-scanning.test.ts` | Parent directory `.env` file scanning | ~5 |
+| `final-rst-verification.test.ts` | End-to-end integration | ~5 |
+
+**Total: ~146 tests, all passing**
 
-For more details, see the [Security Guide](security.md).
+## Running Tests
 
 ### 1. Run the Entire Test Suite
 
-To execute all tests:
-
 ```bash
 npm test
 ```
@@ -40,6 +44,7 @@ To run a specific test suite, use `tsx`:
 
 ```bash
 npx tsx --test tests/config.test.ts
+npx tsx --test tests/init.test.ts
 npx tsx --test tests/learn.test.ts
 npx tsx --test tests/substitute.test.ts
 ```
@@ -52,6 +57,28 @@ To generate a test coverage report directly in the terminal:
 node --experimental-test-coverage --import tsx --test tests/**/*.test.ts
 ```
 
+### 4. Sequential Test Run (for debugging)
+
+Some tests modify shared state (HOME directory). To run sequentially:
+
+```bash
+npm run test:sequential
+```
+
+---
+
+## Security Testing
+
+Security features can be tested by:
+
+1. **Testing command blocks**: Try running templates with dangerous commands like `sudo rm -rf` or `dd`
+2. **Testing remote downloads**: Use untrusted URLs to verify source verification
+3. **Testing rate limiting**: Execute more than 50 commands in a single init session
+4. **Testing timeouts**: Run commands that hang to verify timeout behavior
+5. **Reviewing audit logs**: Check `~/.pt/security-audit.log` for security events
+
+For more details, see the [Security Guide](security.md).
+
 ---
 
 ## Writing Tests

package/doc/variable_substitution_example.md

@@ -27,7 +27,7 @@ templates:
 ```
 
 > [!TIP]
-> **New in v0.16.0:** You no longer need to manually define the `variables` section. During `pt learn` or `pt update`, the tool will automatically detect `{{ variable_name }}` placeholders in your files and add them to the configuration for you.
+> **Automatic detection (v0.16+):** You no longer need to manually define the `variables` section. During `pt learn` or `pt update`, the tool will automatically detect `{{ variable_name }}` placeholders in your files and add them to the configuration for you.
 
 ## 2. Create Template Files
 
@@ -140,3 +140,13 @@ project=wiki
 Result: `template_path` becomes `docs/wiki`
 
 **Important:** Missing nested variables remain as `{{ variable }}` placeholders (with preserved whitespace) to help identify configuration issues.
+
+## 5. CLI Variable Overrides
+
+Pass variables non-interactively with `--vars`:
+
+```bash
+pt init node_web_app my-project --yes --vars project_name=my-service,author_name="Jane Doe"
+```
+
+Or use a `.env` file in the destination directory for persistent defaults.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@garyr/pt-cli",
-  "version": "0.41.0",
+  "version": "1.0.0",
   "description": "Project Template CLI - Learn structures and initialize projects",
   "main": "dist/index.js",
   "bin": {

package/src/config.ts

@@ -174,6 +174,19 @@ export function normalizeVariable(v: TemplateVariable): TemplateVariable {
   return result;
 }
 
+export function normalizeFolders(folders: FolderNode[]): FolderNode[] {
+  return folders.map(folder => {
+    const normalized: FolderNode = { name: folder.name, info: folder.info || '' };
+    if (folder.children !== undefined && folder.children.length > 0) {
+      normalized.children = normalizeFolders(folder.children);
+    } else if (folder.children !== undefined) {
+      normalized.children = [];
+    }
+    if (folder.is_file !== undefined) normalized.is_file = folder.is_file;
+    return normalized;
+  });
+}
+
 export function saveConfig(config: PtConfig) {
   ensureConfigDir();
 
@@ -187,6 +200,20 @@ export function saveConfig(config: PtConfig) {
       if (template.variables && Array.isArray(template.variables)) {
         template.variables = template.variables.map(normalizeVariable);
       }
+      if (template.folders && Array.isArray(template.folders)) {
+        template.folders = normalizeFolders(template.folders);
+      }
+      // Create a new object with keys in the desired order for consistent YAML output
+      const orderedTemplate: Partial<TemplateConfig> = {};
+      if (template.description !== undefined) orderedTemplate.description = template.description;
+      if (template.templateRoot !== undefined) orderedTemplate.templateRoot = template.templateRoot;
+      if (template.variables !== undefined) orderedTemplate.variables = template.variables;
+      if (template.folders !== undefined) orderedTemplate.folders = template.folders;
+      if (template.exclude !== undefined) orderedTemplate.exclude = template.exclude;
+      if (template.copy_files !== undefined) orderedTemplate.copy_files = template.copy_files;
+      if (template.post_copy !== undefined) orderedTemplate.post_copy = template.post_copy;
+      if (template.post_config !== undefined) orderedTemplate.post_config = template.post_config;
+      config.templates[key] = orderedTemplate as TemplateConfig;
     }
   }
 
@@ -254,17 +281,12 @@ export function getSecurityPolicy(config: PtConfig): SecurityPolicy {
 // Default exclusions for template scanning
 export const DEFAULT_EXCLUDES = [
   '.git',
-  '.gitea',
-  '.vscode',
   'node_modules',
   'dist',
   'build',
   'bin',
   '.DS_Store',
   'Thumbs.db',
-  '.stignore',
-  '.stfolder',
-  '.stversions',
 ];
 
 // Check if a path should be excluded
@@ -370,22 +392,10 @@ export function shouldExcludeFile(fileName: string): boolean {
     '*.swo',
     '*~',
     '.bak',
-    '*.md',
-    '*.txt',
-    '*.json',
-    '*.yaml',
-    '*.yml',
-    '*.ini',
-    '*.conf',
-    '*.config',
-    '.gitconfig',
-    '.makerc',
     'Gemfile.lock',
-    'package.json',
     'package-lock.json',
     'yarn.lock',
     'pnpm-lock.yaml',
-    'composer.json',
     'composer.lock',
   ];
 

package/tests/config-utils.test.ts

@@ -148,8 +148,10 @@ test('DEFAULT_EXCLUDES contains expected patterns', () => {
   assert.ok(DEFAULT_EXCLUDES.includes('dist'), 'Should include dist');
   assert.ok(DEFAULT_EXCLUDES.includes('build'), 'Should include build');
   assert.ok(DEFAULT_EXCLUDES.includes('.DS_Store'), 'Should include .DS_Store');
-  assert.ok(DEFAULT_EXCLUDES.includes('.vscode'), 'Should include .vscode');
   assert.ok(DEFAULT_EXCLUDES.includes('Thumbs.db'), 'Should include Thumbs.db');
+  assert.ok(!DEFAULT_EXCLUDES.includes('.vscode'), 'Should NOT include .vscode');
+  assert.ok(!DEFAULT_EXCLUDES.includes('.gitea'), 'Should NOT include .gitea');
+  assert.ok(!DEFAULT_EXCLUDES.includes('.stignore'), 'Should NOT include .stignore');
 });
 
 // ─── shouldExclude ───────────────────────────────────────────────────────────
@@ -357,14 +359,6 @@ test('shouldExcludeFile excludes wildcard extension patterns', () => {
     'file.swp',
     'file.swo',
     'backup~',
-    'readme.md',
-    'notes.txt',
-    'data.json',
-    'config.yaml',
-    'settings.yml',
-    'setup.ini',
-    'app.conf',
-    'lint.config',
   ];
 
   for (const file of wildcardExcludes) {
@@ -379,14 +373,10 @@ test('shouldExcludeFile excludes exact match files', () => {
   const exactExcludes = [
     '.Python',
     '.bak',
-    '.gitconfig',
-    '.makerc',
     'Gemfile.lock',
-    'package.json',
     'package-lock.json',
     'yarn.lock',
     'pnpm-lock.yaml',
-    'composer.json',
     'composer.lock',
   ];
 
@@ -415,6 +405,18 @@ test('shouldExcludeFile does NOT exclude normal source files', () => {
     'Component.jsx',
     'handler.py',
     'server.rb',
+    'readme.md',
+    'notes.txt',
+    'data.json',
+    'config.yaml',
+    'settings.yml',
+    'setup.ini',
+    'app.conf',
+    'lint.config',
+    '.gitconfig',
+    '.makerc',
+    'package.json',
+    'composer.json',
   ];
 
   for (const file of normalFiles) {