@litmers/cursorflow-orchestrator 0.1.15 → 0.1.20

package/src/utils/enhanced-logger.ts

@@ -13,8 +13,9 @@
 
 import * as fs from 'fs';
 import * as path from 'path';
-import { PassThrough, Transform, TransformCallback } from 'stream';
+import { Transform, TransformCallback } from 'stream';
 import { EnhancedLogConfig } from './types';
+import { safeJoin } from './path';
 
 // Re-export for backwards compatibility
 export { EnhancedLogConfig } from './types';
@@ -163,6 +164,23 @@ export class StreamingMessageParser {
           },
         });
         break;
+        
+      case 'thinking':
+        // Thinking message (Claude 3.7+ etc.)
+        if (json.subtype === 'delta' && json.text) {
+          // Check if this is a new message or continuation
+          if (this.currentRole !== 'thinking') {
+            // Flush previous message if any
+            this.flush();
+            this.currentRole = 'thinking';
+            this.messageStartTime = json.timestamp_ms || Date.now();
+          }
+          this.currentMessage += json.text;
+        } else if (json.subtype === 'completed') {
+          // Thinking completed - flush immediately
+          this.flush();
+        }
+        break;
     }
   }
   
@@ -191,7 +209,7 @@ export class StreamingMessageParser {
 }
 
 export interface ParsedMessage {
-  type: 'system' | 'user' | 'assistant' | 'tool' | 'tool_result' | 'result';
+  type: 'system' | 'user' | 'assistant' | 'tool' | 'tool_result' | 'result' | 'thinking';
   role: string;
   content: string;
   timestamp: number;
@@ -396,10 +414,10 @@ export class EnhancedLogManager {
     fs.mkdirSync(logDir, { recursive: true });
     
     // Set up log file paths
-    this.cleanLogPath = path.join(logDir, 'terminal.log');
-    this.rawLogPath = path.join(logDir, 'terminal-raw.log');
-    this.jsonLogPath = path.join(logDir, 'terminal.jsonl');
-    this.readableLogPath = path.join(logDir, 'terminal-readable.log');
+    this.cleanLogPath = safeJoin(logDir, 'terminal.log');
+    this.rawLogPath = safeJoin(logDir, 'terminal-raw.log');
+    this.jsonLogPath = safeJoin(logDir, 'terminal.jsonl');
+    this.readableLogPath = safeJoin(logDir, 'terminal-readable.log');
     
     // Initialize log files
     this.initLogFiles();
@@ -505,6 +523,21 @@ export class EnhancedLogManager {
         formatted = `[${ts}] 📄 RESL: ${msg.metadata?.toolName || 'Tool'}${toolResultLines}\n`;
         break;
         
+      case 'thinking':
+        // Format thinking block
+        const thinkLabel = `[ 🤔 THINKING ] `;
+        const thinkWidth = 80;
+        const thinkTop = `┌─${thinkLabel}${'─'.repeat(Math.max(0, thinkWidth - thinkLabel.length - 2))}`;
+        const thinkBottom = `└─${'─'.repeat(thinkWidth - 2)}`;
+
+        const thinkLines = msg.content.trim().split('\n');
+        formatted = `[${ts}] ${thinkTop}\n`;
+        for (const line of thinkLines) {
+          formatted += `[${ts}] │ ${line}\n`;
+        }
+        formatted += `[${ts}] ${thinkBottom}\n`;
+        break;
+        
       default:
         formatted = `[${ts}] ${msg.content}\n`;
     }
@@ -588,8 +621,8 @@ export class EnhancedLogManager {
     
     // Shift existing rotated files
     for (let i = this.config.maxFiles - 1; i >= 1; i--) {
-      const oldPath = path.join(dir, `${base}.${i}${ext}`);
-      const newPath = path.join(dir, `${base}.${i + 1}${ext}`);
+      const oldPath = safeJoin(dir, `${base}.${i}${ext}`);
+      const newPath = safeJoin(dir, `${base}.${i + 1}${ext}`);
       
       if (fs.existsSync(oldPath)) {
         if (i === this.config.maxFiles - 1) {
@@ -601,7 +634,7 @@ export class EnhancedLogManager {
     }
     
     // Rotate current to .1
-    const rotatedPath = path.join(dir, `${base}.1${ext}`);
+    const rotatedPath = safeJoin(dir, `${base}.1${ext}`);
     fs.renameSync(logPath, rotatedPath);
   }
 
@@ -669,20 +702,73 @@ export class EnhancedLogManager {
       this.cleanTransform.write(data);
     }
     
-    // Parse streaming JSON for readable log (handles boxes, messages, tool calls)
-    this.parseStreamingData(text);
+    // Process lines for readable log and JSON entries
+    this.lineBuffer += text;
+    const lines = this.lineBuffer.split('\n');
+    this.lineBuffer = lines.pop() || '';
     
-    // Also include significant info/status lines in readable log (compact)
-    if (this.readableLogFd !== null) {
-      const lines = text.split('\n');
-      for (const line of lines) {
-        const cleanLine = stripAnsi(line).trim();
+    for (const line of lines) {
+      const cleanLine = stripAnsi(line).trim();
+      if (!cleanLine) continue;
+
+      // Handle streaming JSON messages (for boxes, etc. in readable log)
+      if (cleanLine.startsWith('{')) {
+        if (this.streamingParser) {
+          this.streamingParser.parseLine(cleanLine);
+        }
+
+        // Special handling for terminal.jsonl entries for AI messages
+        if (this.config.writeJsonLog) {
+          try {
+            const json = JSON.parse(cleanLine);
+            let displayMsg = cleanLine;
+            let metadata = { ...json };
+
+            // Extract cleaner text for significant AI message types
+            if ((json.type === 'thinking' || json.type === 'thought') && (json.text || json.thought)) {
+              displayMsg = json.text || json.thought;
+              // Clean up any double newlines at the end of deltas
+              displayMsg = displayMsg.replace(/\n+$/, '\n');
+            } else if (json.type === 'assistant' && json.message?.content) {
+              displayMsg = json.message.content
+                .filter((c: any) => c.type === 'text')
+                .map((c: any) => c.text)
+                .join('');
+            } else if (json.type === 'user' && json.message?.content) {
+              displayMsg = json.message.content
+                .filter((c: any) => c.type === 'text')
+                .map((c: any) => c.text)
+                .join('');
+            } else if (json.type === 'tool_call' && json.subtype === 'started') {
+              const toolName = Object.keys(json.tool_call)[0] || 'unknown';
+              const args = json.tool_call[toolName]?.args || {};
+              displayMsg = `🔧 CALL: ${toolName}(${JSON.stringify(args)})`;
+            } else if (json.type === 'tool_call' && json.subtype === 'completed') {
+              const toolName = Object.keys(json.tool_call)[0] || 'unknown';
+              displayMsg = `📄 RESL: ${toolName}`;
+            } else if (json.type === 'result') {
+              displayMsg = json.result || 'Task completed';
+            }
+
+            this.writeJsonEntry({
+              timestamp: new Date().toISOString(),
+              level: 'stdout',
+              lane: this.session.laneName,
+              task: this.session.taskName,
+              message: displayMsg.substring(0, 2000), // Larger limit for AI text
+              metadata,
+            });
+            continue; // Already logged this JSON line
+          } catch {
+            // Not valid JSON or error, fall through to regular logging
+          }
+        }
+      }
+
+      // Also include significant info/status lines in readable log (compact)
+      if (this.readableLogFd !== null) {
         // Look for log lines: [ISO_DATE] [LEVEL] ...
-        if (cleanLine && 
-            !cleanLine.startsWith('{') && 
-            !this.isNoiseLog(cleanLine) && 
-            /\[\d{4}-\d{2}-\d{2}T/.test(cleanLine)) {
-          
+        if (!this.isNoiseLog(cleanLine) && /\[\d{4}-\d{2}-\d{2}T/.test(cleanLine)) {
           try {
             // Check if it has a level marker
             if (/\[(INFO|WARN|ERROR|SUCCESS|DEBUG)\]/.test(cleanLine)) {
@@ -698,44 +784,26 @@ export class EnhancedLogManager {
           } catch {}
         }
       }
-    }
-    
-    // Write JSON entry (for significant lines only)
-    if (this.config.writeJsonLog) {
-      const cleanText = stripAnsi(text).trim();
-      if (cleanText && !this.isNoiseLog(cleanText)) {
+      
+      // Write regular non-JSON lines to terminal.jsonl
+      if (this.config.writeJsonLog && !this.isNoiseLog(cleanLine)) {
         this.writeJsonEntry({
           timestamp: new Date().toISOString(),
           level: 'stdout',
           lane: this.session.laneName,
           task: this.session.taskName,
-          message: cleanText.substring(0, 1000), // Truncate very long lines
-          raw: this.config.keepRawLogs ? undefined : text.substring(0, 1000),
+          message: cleanLine.substring(0, 1000),
+          raw: this.config.keepRawLogs ? undefined : line.substring(0, 1000),
         });
       }
     }
   }
   
   /**
-   * Parse streaming JSON data for readable log
+   * Parse streaming JSON data for readable log - legacy, integrated into writeStdout
    */
   private parseStreamingData(text: string): void {
-    if (!this.streamingParser) return;
-    
-    // Buffer incomplete lines
-    this.lineBuffer += text;
-    const lines = this.lineBuffer.split('\n');
-    
-    // Keep the last incomplete line in buffer
-    this.lineBuffer = lines.pop() || '';
-    
-    // Parse complete lines
-    for (const line of lines) {
-      const trimmed = line.trim();
-      if (trimmed.startsWith('{')) {
-        this.streamingParser.parseLine(trimmed);
-      }
-    }
+    // Legacy method, no longer used but kept for internal references if any
   }
 
   /**
@@ -873,7 +941,7 @@ export class EnhancedLogManager {
     
     // Skip common progress/spinner patterns
     const noisePatterns = [
-      /^[\s│├└─┌┐┘┴┬┤├]+$/, // Box drawing only
+      /^[\s│├└─┌┐┘┴┬┤]+$/, // Box drawing only (removed duplicate ├)
       /^[.\s]+$/, // Dots only
       /^[=>\s-]+$/, // Progress bar characters
       /^\d+%$/, // Percentage only
@@ -1036,8 +1104,8 @@ export function exportLogs(
   format: 'text' | 'json' | 'markdown' | 'html',
   outputPath?: string
 ): string {
-  const cleanLogPath = path.join(laneRunDir, 'terminal.log');
-  const jsonLogPath = path.join(laneRunDir, 'terminal.jsonl');
+  const cleanLogPath = safeJoin(laneRunDir, 'terminal.log');
+  const jsonLogPath = safeJoin(laneRunDir, 'terminal.jsonl');
   
   let output = '';
   

package/src/utils/git.ts

@@ -3,6 +3,77 @@
  */
 
 import { execSync, spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { safeJoin } from './path';
+
+/**
+ * Acquire a file-based lock for Git operations
+ */
+function acquireLock(lockName: string, cwd?: string): string | null {
+  const repoRoot = cwd || getRepoRoot();
+  const lockDir = safeJoin(repoRoot, '_cursorflow', 'locks');
+  if (!fs.existsSync(lockDir)) {
+    fs.mkdirSync(lockDir, { recursive: true });
+  }
+  
+  const lockFile = safeJoin(lockDir, `${lockName}.lock`);
+  
+  try {
+    // wx flag ensures atomic creation
+    fs.writeFileSync(lockFile, String(process.pid), { flag: 'wx' });
+    return lockFile;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Release a file-based lock
+ */
+function releaseLock(lockFile: string | null): void {
+  if (lockFile && fs.existsSync(lockFile)) {
+    try {
+      fs.unlinkSync(lockFile);
+    } catch {
+      // Ignore
+    }
+  }
+}
+
+/**
+ * Run Git command with locking
+ */
+async function runGitWithLock<T>(
+  lockName: string,
+  fn: () => T,
+  options: { cwd?: string; maxRetries?: number; retryDelay?: number } = {}
+): Promise<T> {
+  const maxRetries = options.maxRetries ?? 10;
+  const retryDelay = options.retryDelay ?? 500;
+  
+  let retries = 0;
+  let lockFile = null;
+  
+  while (retries < maxRetries) {
+    lockFile = acquireLock(lockName, options.cwd);
+    if (lockFile) break;
+    
+    retries++;
+    const delay = Math.floor(Math.random() * retryDelay) + retryDelay / 2;
+    await new Promise(resolve => setTimeout(resolve, delay));
+  }
+  
+  if (!lockFile) {
+    throw new Error(`Failed to acquire lock: ${lockName}`);
+  }
+  
+  try {
+    return fn();
+  } finally {
+    releaseLock(lockFile);
+  }
+}
 
 export interface GitRunOptions {
   cwd?: string;
@@ -36,6 +107,25 @@ export interface CommitInfo {
   subject: string;
 }
 
+/**
+ * Filter out noisy git stderr messages
+ */
+function filterGitStderr(stderr: string): string {
+  if (!stderr) return '';
+  
+  const lines = stderr.split('\n');
+  const filtered = lines.filter(line => {
+    // GitHub noise
+    if (line.includes('remote: Create a pull request')) return false;
+    if (line.trim().startsWith('remote:') && line.includes('pull/new')) return false;
+    if (line.trim() === 'remote:') return false; // Empty remote lines
+    
+    return true;
+  });
+  
+  return filtered.join('\n');
+}
+
 /**
  * Run git command and return output
  */
@@ -43,12 +133,21 @@ export function runGit(args: string[], options: GitRunOptions = {}): string {
   const { cwd, silent = false } = options;
   
   try {
+    const stdioMode = silent ? 'pipe' : ['inherit', 'inherit', 'pipe'];
+
     const result = spawnSync('git', args, {
       cwd: cwd || process.cwd(),
       encoding: 'utf8',
-      stdio: silent ? 'pipe' : 'inherit',
+      stdio: stdioMode as any,
     });
     
+    if (!silent && result.stderr) {
+      const filteredStderr = filterGitStderr(result.stderr);
+      if (filteredStderr) {
+        process.stderr.write(filteredStderr);
+      }
+    }
+    
     if (result.status !== 0 && !silent) {
       throw new Error(`Git command failed: git ${args.join(' ')}\n${result.stderr || ''}`);
     }
@@ -120,18 +219,53 @@ export function worktreeExists(worktreePath: string, cwd?: string): boolean {
 export function createWorktree(worktreePath: string, branchName: string, options: { cwd?: string; baseBranch?: string } = {}): string {
   const { cwd, baseBranch = 'main' } = options;
   
-  // Check if branch already exists
-  const branchExists = runGitResult(['rev-parse', '--verify', branchName], { cwd }).success;
+  // Use a file-based lock to prevent race conditions during worktree creation
+  const lockDir = safeJoin(cwd || getRepoRoot(), '_cursorflow', 'locks');
+  if (!fs.existsSync(lockDir)) {
+    fs.mkdirSync(lockDir, { recursive: true });
+  }
+  const lockFile = safeJoin(lockDir, 'worktree.lock');
+  
+  let retries = 20;
+  let acquired = false;
+  
+  while (retries > 0 && !acquired) {
+    try {
+      fs.writeFileSync(lockFile, String(process.pid), { flag: 'wx' });
+      acquired = true;
+    } catch {
+      retries--;
+      const delay = Math.floor(Math.random() * 500) + 200;
+      // Use synchronous sleep to keep the function signature synchronous
+      const end = Date.now() + delay;
+      while (Date.now() < end) { /* wait */ }
+    }
+  }
   
-  if (branchExists) {
-    // Branch exists, checkout to worktree
-    runGit(['worktree', 'add', worktreePath, branchName], { cwd });
-  } else {
-    // Create new branch from base
-    runGit(['worktree', 'add', '-b', branchName, worktreePath, baseBranch], { cwd });
+  if (!acquired) {
+    throw new Error('Failed to acquire worktree lock after multiple retries');
   }
   
-  return worktreePath;
+  try {
+    // Check if branch already exists
+    const branchExists = runGitResult(['rev-parse', '--verify', branchName], { cwd }).success;
+    
+    if (branchExists) {
+      // Branch exists, checkout to worktree
+      runGit(['worktree', 'add', worktreePath, branchName], { cwd });
+    } else {
+      // Create new branch from base
+      runGit(['worktree', 'add', '-b', branchName, worktreePath, baseBranch], { cwd });
+    }
+    
+    return worktreePath;
+  } finally {
+    try {
+      fs.unlinkSync(lockFile);
+    } catch {
+      // Ignore
+    }
+  }
 }
 
 /**
@@ -362,4 +496,4 @@ export function getLastOperationStats(cwd?: string): string {
   } catch (e) {
     return '';
   }
-}
+}

package/src/utils/log-formatter.ts

@@ -0,0 +1,162 @@
+/**
+ * Utility for formatting log messages for console display
+ */
+
+import * as logger from './logger';
+import { ParsedMessage, stripAnsi } from './enhanced-logger';
+
+/**
+ * Format a single parsed message into a human-readable string (compact or multi-line)
+ */
+export function formatMessageForConsole(
+  msg: ParsedMessage, 
+  options: { 
+    includeTimestamp?: boolean; 
+    laneLabel?: string;
+    compact?: boolean;
+  } = {}
+): string {
+  const { includeTimestamp = true, laneLabel = '', compact = false } = options;
+  const ts = includeTimestamp ? new Date(msg.timestamp).toLocaleTimeString('en-US', { hour12: false }) : '';
+  const tsPrefix = ts ? `${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ` : '';
+  const labelPrefix = laneLabel ? `${logger.COLORS.magenta}${laneLabel.padEnd(12)}${logger.COLORS.reset} ` : '';
+  
+  let typePrefix = '';
+  let content = msg.content;
+  
+  switch (msg.type) {
+    case 'user':
+      typePrefix = `${logger.COLORS.cyan}🧑 USER${logger.COLORS.reset}`;
+      if (compact) content = content.replace(/\n/g, ' ').substring(0, 100) + (content.length > 100 ? '...' : '');
+      break;
+    case 'assistant':
+      typePrefix = `${logger.COLORS.green}🤖 ASST${logger.COLORS.reset}`;
+      if (compact) content = content.replace(/\n/g, ' ').substring(0, 100) + (content.length > 100 ? '...' : '');
+      break;
+    case 'tool':
+      typePrefix = `${logger.COLORS.yellow}🔧 TOOL${logger.COLORS.reset}`;
+      const toolMatch = content.match(/\[Tool: ([^\]]+)\] (.*)/);
+      if (toolMatch) {
+        const [, name, args] = toolMatch;
+        try {
+          const parsedArgs = JSON.parse(args!);
+          let argStr = '';
+          if (name === 'read_file' && parsedArgs.target_file) {
+            argStr = parsedArgs.target_file;
+          } else if (name === 'run_terminal_cmd' && parsedArgs.command) {
+            argStr = parsedArgs.command;
+          } else if (name === 'write' && parsedArgs.file_path) {
+            argStr = parsedArgs.file_path;
+          } else if (name === 'search_replace' && parsedArgs.file_path) {
+            argStr = parsedArgs.file_path;
+          } else {
+            const keys = Object.keys(parsedArgs);
+            if (keys.length > 0) {
+              argStr = String(parsedArgs[keys[0]]).substring(0, 50);
+            }
+          }
+          content = `${logger.COLORS.bold}${name}${logger.COLORS.reset}(${argStr})`;
+        } catch {
+          content = `${logger.COLORS.bold}${name}${logger.COLORS.reset}: ${args}`;
+        }
+      }
+      break;
+    case 'tool_result':
+      typePrefix = `${logger.COLORS.gray}📄 RESL${logger.COLORS.reset}`;
+      const resMatch = content.match(/\[Tool Result: ([^\]]+)\]/);
+      content = resMatch ? `${resMatch[1]} OK` : 'result';
+      break;
+    case 'result':
+      typePrefix = `${logger.COLORS.green}✅ DONE${logger.COLORS.reset}`;
+      break;
+    case 'system':
+      typePrefix = `${logger.COLORS.gray}⚙️  SYS${logger.COLORS.reset}`;
+      break;
+    case 'thinking':
+      typePrefix = `${logger.COLORS.gray}🤔 THNK${logger.COLORS.reset}`;
+      if (compact) content = content.replace(/\n/g, ' ').substring(0, 100) + (content.length > 100 ? '...' : '');
+      break;
+  }
+  
+  if (!typePrefix) return `${tsPrefix}${labelPrefix}${content}`;
+
+  if (compact) {
+    return `${tsPrefix}${labelPrefix}${typePrefix} ${content}`;
+  }
+
+  // Multi-line box format (as seen in orchestrator)
+  const lines = content.split('\n');
+  const fullPrefix = `${tsPrefix}${labelPrefix}`;
+  const header = `${typePrefix} ┌${'─'.repeat(60)}`;
+  let result = `${fullPrefix}${header}\n`;
+  
+  const indent = ' '.repeat(stripAnsi(typePrefix).length);
+  for (const line of lines) {
+    result += `${fullPrefix}${indent} │ ${line}\n`;
+  }
+  result += `${fullPrefix}${indent} └${'─'.repeat(60)}`;
+  
+  return result;
+}
+
+/**
+ * Detect and format a message that might be a raw JSON string from cursor-agent
+ */
+export function formatPotentialJsonMessage(message: string): string {
+  const trimmed = message.trim();
+  if (!trimmed.startsWith('{') || !trimmed.endsWith('}')) {
+    return message;
+  }
+  
+  try {
+    const json = JSON.parse(trimmed);
+    if (!json.type) return message;
+    
+    // Convert JSON to a ParsedMessage-like structure for formatting
+    let content = trimmed;
+    let type = 'system';
+    
+    if (json.type === 'thinking' && json.text) {
+      content = json.text;
+      type = 'thinking';
+    } else if (json.type === 'assistant' && json.message?.content) {
+      content = json.message.content
+        .filter((c: any) => c.type === 'text')
+        .map((c: any) => c.text)
+        .join('');
+      type = 'assistant';
+    } else if (json.type === 'user' && json.message?.content) {
+      content = json.message.content
+        .filter((c: any) => c.type === 'text')
+        .map((c: any) => c.text)
+        .join('');
+      type = 'user';
+    } else if (json.type === 'tool_call' && json.subtype === 'started') {
+      const toolName = Object.keys(json.tool_call)[0] || 'unknown';
+      const args = json.tool_call[toolName]?.args || {};
+      content = `[Tool: ${toolName}] ${JSON.stringify(args)}`;
+      type = 'tool';
+    } else if (json.type === 'tool_call' && json.subtype === 'completed') {
+      const toolName = Object.keys(json.tool_call)[0] || 'unknown';
+      content = `[Tool Result: ${toolName}]`;
+      type = 'tool_result';
+    } else if (json.type === 'result') {
+      content = json.result || 'Task completed';
+      type = 'result';
+    } else {
+      // Unknown type, return as is
+      return message;
+    }
+    
+    return formatMessageForConsole({
+      type: type as any,
+      role: type,
+      content,
+      timestamp: json.timestamp_ms || Date.now()
+    }, { includeTimestamp: false, compact: true });
+    
+  } catch {
+    return message;
+  }
+}
+

package/src/utils/path.ts

@@ -0,0 +1,45 @@
+import * as path from 'path';
+
+/**
+ * Ensures that a path is safe and stays within a base directory.
+ * Prevents path traversal attacks.
+ */
+export function isSafePath(baseDir: string, ...parts: string[]): boolean {
+  const joined = path.join(baseDir, ...parts); // nosemgrep
+  const resolvedBase = path.resolve(baseDir); // nosemgrep
+  const resolvedJoined = path.resolve(joined); // nosemgrep
+  
+  return resolvedJoined.startsWith(resolvedBase);
+}
+
+/**
+ * Safely joins path parts and ensures the result is within the base directory.
+ * Throws an error if path traversal is detected.
+ * 
+ * @param baseDir The base directory that the resulting path must be within
+ * @param parts Path parts to join
+ * @returns The joined path
+ * @throws Error if the resulting path is outside the base directory
+ */
+export function safeJoin(baseDir: string, ...parts: string[]): string {
+  const joined = path.join(baseDir, ...parts); // nosemgrep
+  const resolvedBase = path.resolve(baseDir); // nosemgrep
+  const resolvedJoined = path.resolve(joined); // nosemgrep
+  
+  if (!resolvedJoined.startsWith(resolvedBase)) {
+    throw new Error(`Potential path traversal detected: ${joined} is outside of ${baseDir}`);
+  }
+  
+  return joined;
+}
+
+/**
+ * Normalizes a path and checks if it's absolute or relative to project root.
+ */
+export function normalizePath(p: string, projectRoot: string): string {
+  if (path.isAbsolute(p)) {
+    return path.normalize(p);
+  }
+  return path.join(projectRoot, p); // nosemgrep
+}
+