@litmers/cursorflow-orchestrator 0.1.18 → 0.1.20

package/src/utils/enhanced-logger.ts

@@ -15,6 +15,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { Transform, TransformCallback } from 'stream';
 import { EnhancedLogConfig } from './types';
+import { safeJoin } from './path';
 
 // Re-export for backwards compatibility
 export { EnhancedLogConfig } from './types';
@@ -413,10 +414,10 @@ export class EnhancedLogManager {
     fs.mkdirSync(logDir, { recursive: true });
     
     // Set up log file paths
-    this.cleanLogPath = path.join(logDir, 'terminal.log');
-    this.rawLogPath = path.join(logDir, 'terminal-raw.log');
-    this.jsonLogPath = path.join(logDir, 'terminal.jsonl');
-    this.readableLogPath = path.join(logDir, 'terminal-readable.log');
+    this.cleanLogPath = safeJoin(logDir, 'terminal.log');
+    this.rawLogPath = safeJoin(logDir, 'terminal-raw.log');
+    this.jsonLogPath = safeJoin(logDir, 'terminal.jsonl');
+    this.readableLogPath = safeJoin(logDir, 'terminal-readable.log');
     
     // Initialize log files
     this.initLogFiles();
@@ -620,8 +621,8 @@ export class EnhancedLogManager {
     
     // Shift existing rotated files
     for (let i = this.config.maxFiles - 1; i >= 1; i--) {
-      const oldPath = path.join(dir, `${base}.${i}${ext}`);
-      const newPath = path.join(dir, `${base}.${i + 1}${ext}`);
+      const oldPath = safeJoin(dir, `${base}.${i}${ext}`);
+      const newPath = safeJoin(dir, `${base}.${i + 1}${ext}`);
       
       if (fs.existsSync(oldPath)) {
         if (i === this.config.maxFiles - 1) {
@@ -633,7 +634,7 @@ export class EnhancedLogManager {
     }
     
     // Rotate current to .1
-    const rotatedPath = path.join(dir, `${base}.1${ext}`);
+    const rotatedPath = safeJoin(dir, `${base}.1${ext}`);
     fs.renameSync(logPath, rotatedPath);
   }
 
@@ -724,8 +725,10 @@ export class EnhancedLogManager {
             let metadata = { ...json };
 
             // Extract cleaner text for significant AI message types
-            if (json.type === 'thinking' && json.text) {
-              displayMsg = json.text;
+            if ((json.type === 'thinking' || json.type === 'thought') && (json.text || json.thought)) {
+              displayMsg = json.text || json.thought;
+              // Clean up any double newlines at the end of deltas
+              displayMsg = displayMsg.replace(/\n+$/, '\n');
             } else if (json.type === 'assistant' && json.message?.content) {
               displayMsg = json.message.content
                 .filter((c: any) => c.type === 'text')
@@ -1101,8 +1104,8 @@ export function exportLogs(
   format: 'text' | 'json' | 'markdown' | 'html',
   outputPath?: string
 ): string {
-  const cleanLogPath = path.join(laneRunDir, 'terminal.log');
-  const jsonLogPath = path.join(laneRunDir, 'terminal.jsonl');
+  const cleanLogPath = safeJoin(laneRunDir, 'terminal.log');
+  const jsonLogPath = safeJoin(laneRunDir, 'terminal.jsonl');
   
   let output = '';
   

package/src/utils/git.ts

@@ -3,6 +3,77 @@
  */
 
 import { execSync, spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as path from 'path';
+import { safeJoin } from './path';
+
+/**
+ * Acquire a file-based lock for Git operations
+ */
+function acquireLock(lockName: string, cwd?: string): string | null {
+  const repoRoot = cwd || getRepoRoot();
+  const lockDir = safeJoin(repoRoot, '_cursorflow', 'locks');
+  if (!fs.existsSync(lockDir)) {
+    fs.mkdirSync(lockDir, { recursive: true });
+  }
+  
+  const lockFile = safeJoin(lockDir, `${lockName}.lock`);
+  
+  try {
+    // wx flag ensures atomic creation
+    fs.writeFileSync(lockFile, String(process.pid), { flag: 'wx' });
+    return lockFile;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Release a file-based lock
+ */
+function releaseLock(lockFile: string | null): void {
+  if (lockFile && fs.existsSync(lockFile)) {
+    try {
+      fs.unlinkSync(lockFile);
+    } catch {
+      // Ignore
+    }
+  }
+}
+
+/**
+ * Run Git command with locking
+ */
+async function runGitWithLock<T>(
+  lockName: string,
+  fn: () => T,
+  options: { cwd?: string; maxRetries?: number; retryDelay?: number } = {}
+): Promise<T> {
+  const maxRetries = options.maxRetries ?? 10;
+  const retryDelay = options.retryDelay ?? 500;
+  
+  let retries = 0;
+  let lockFile = null;
+  
+  while (retries < maxRetries) {
+    lockFile = acquireLock(lockName, options.cwd);
+    if (lockFile) break;
+    
+    retries++;
+    const delay = Math.floor(Math.random() * retryDelay) + retryDelay / 2;
+    await new Promise(resolve => setTimeout(resolve, delay));
+  }
+  
+  if (!lockFile) {
+    throw new Error(`Failed to acquire lock: ${lockName}`);
+  }
+  
+  try {
+    return fn();
+  } finally {
+    releaseLock(lockFile);
+  }
+}
 
 export interface GitRunOptions {
   cwd?: string;
@@ -36,6 +107,25 @@ export interface CommitInfo {
   subject: string;
 }
 
+/**
+ * Filter out noisy git stderr messages
+ */
+function filterGitStderr(stderr: string): string {
+  if (!stderr) return '';
+  
+  const lines = stderr.split('\n');
+  const filtered = lines.filter(line => {
+    // GitHub noise
+    if (line.includes('remote: Create a pull request')) return false;
+    if (line.trim().startsWith('remote:') && line.includes('pull/new')) return false;
+    if (line.trim() === 'remote:') return false; // Empty remote lines
+    
+    return true;
+  });
+  
+  return filtered.join('\n');
+}
+
 /**
  * Run git command and return output
  */
@@ -43,12 +133,21 @@ export function runGit(args: string[], options: GitRunOptions = {}): string {
   const { cwd, silent = false } = options;
   
   try {
+    const stdioMode = silent ? 'pipe' : ['inherit', 'inherit', 'pipe'];
+
     const result = spawnSync('git', args, {
       cwd: cwd || process.cwd(),
       encoding: 'utf8',
-      stdio: silent ? 'pipe' : 'inherit',
+      stdio: stdioMode as any,
     });
     
+    if (!silent && result.stderr) {
+      const filteredStderr = filterGitStderr(result.stderr);
+      if (filteredStderr) {
+        process.stderr.write(filteredStderr);
+      }
+    }
+    
     if (result.status !== 0 && !silent) {
       throw new Error(`Git command failed: git ${args.join(' ')}\n${result.stderr || ''}`);
     }
@@ -120,18 +219,53 @@ export function worktreeExists(worktreePath: string, cwd?: string): boolean {
 export function createWorktree(worktreePath: string, branchName: string, options: { cwd?: string; baseBranch?: string } = {}): string {
   const { cwd, baseBranch = 'main' } = options;
   
-  // Check if branch already exists
-  const branchExists = runGitResult(['rev-parse', '--verify', branchName], { cwd }).success;
+  // Use a file-based lock to prevent race conditions during worktree creation
+  const lockDir = safeJoin(cwd || getRepoRoot(), '_cursorflow', 'locks');
+  if (!fs.existsSync(lockDir)) {
+    fs.mkdirSync(lockDir, { recursive: true });
+  }
+  const lockFile = safeJoin(lockDir, 'worktree.lock');
+  
+  let retries = 20;
+  let acquired = false;
+  
+  while (retries > 0 && !acquired) {
+    try {
+      fs.writeFileSync(lockFile, String(process.pid), { flag: 'wx' });
+      acquired = true;
+    } catch {
+      retries--;
+      const delay = Math.floor(Math.random() * 500) + 200;
+      // Use synchronous sleep to keep the function signature synchronous
+      const end = Date.now() + delay;
+      while (Date.now() < end) { /* wait */ }
+    }
+  }
   
-  if (branchExists) {
-    // Branch exists, checkout to worktree
-    runGit(['worktree', 'add', worktreePath, branchName], { cwd });
-  } else {
-    // Create new branch from base
-    runGit(['worktree', 'add', '-b', branchName, worktreePath, baseBranch], { cwd });
+  if (!acquired) {
+    throw new Error('Failed to acquire worktree lock after multiple retries');
   }
   
-  return worktreePath;
+  try {
+    // Check if branch already exists
+    const branchExists = runGitResult(['rev-parse', '--verify', branchName], { cwd }).success;
+    
+    if (branchExists) {
+      // Branch exists, checkout to worktree
+      runGit(['worktree', 'add', worktreePath, branchName], { cwd });
+    } else {
+      // Create new branch from base
+      runGit(['worktree', 'add', '-b', branchName, worktreePath, baseBranch], { cwd });
+    }
+    
+    return worktreePath;
+  } finally {
+    try {
+      fs.unlinkSync(lockFile);
+    } catch {
+      // Ignore
+    }
+  }
 }
 
 /**
@@ -362,4 +496,4 @@ export function getLastOperationStats(cwd?: string): string {
   } catch (e) {
     return '';
   }
-}
+}

package/src/utils/log-formatter.ts

@@ -0,0 +1,162 @@
+/**
+ * Utility for formatting log messages for console display
+ */
+
+import * as logger from './logger';
+import { ParsedMessage, stripAnsi } from './enhanced-logger';
+
+/**
+ * Format a single parsed message into a human-readable string (compact or multi-line)
+ */
+export function formatMessageForConsole(
+  msg: ParsedMessage, 
+  options: { 
+    includeTimestamp?: boolean; 
+    laneLabel?: string;
+    compact?: boolean;
+  } = {}
+): string {
+  const { includeTimestamp = true, laneLabel = '', compact = false } = options;
+  const ts = includeTimestamp ? new Date(msg.timestamp).toLocaleTimeString('en-US', { hour12: false }) : '';
+  const tsPrefix = ts ? `${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ` : '';
+  const labelPrefix = laneLabel ? `${logger.COLORS.magenta}${laneLabel.padEnd(12)}${logger.COLORS.reset} ` : '';
+  
+  let typePrefix = '';
+  let content = msg.content;
+  
+  switch (msg.type) {
+    case 'user':
+      typePrefix = `${logger.COLORS.cyan}🧑 USER${logger.COLORS.reset}`;
+      if (compact) content = content.replace(/\n/g, ' ').substring(0, 100) + (content.length > 100 ? '...' : '');
+      break;
+    case 'assistant':
+      typePrefix = `${logger.COLORS.green}🤖 ASST${logger.COLORS.reset}`;
+      if (compact) content = content.replace(/\n/g, ' ').substring(0, 100) + (content.length > 100 ? '...' : '');
+      break;
+    case 'tool':
+      typePrefix = `${logger.COLORS.yellow}🔧 TOOL${logger.COLORS.reset}`;
+      const toolMatch = content.match(/\[Tool: ([^\]]+)\] (.*)/);
+      if (toolMatch) {
+        const [, name, args] = toolMatch;
+        try {
+          const parsedArgs = JSON.parse(args!);
+          let argStr = '';
+          if (name === 'read_file' && parsedArgs.target_file) {
+            argStr = parsedArgs.target_file;
+          } else if (name === 'run_terminal_cmd' && parsedArgs.command) {
+            argStr = parsedArgs.command;
+          } else if (name === 'write' && parsedArgs.file_path) {
+            argStr = parsedArgs.file_path;
+          } else if (name === 'search_replace' && parsedArgs.file_path) {
+            argStr = parsedArgs.file_path;
+          } else {
+            const keys = Object.keys(parsedArgs);
+            if (keys.length > 0) {
+              argStr = String(parsedArgs[keys[0]]).substring(0, 50);
+            }
+          }
+          content = `${logger.COLORS.bold}${name}${logger.COLORS.reset}(${argStr})`;
+        } catch {
+          content = `${logger.COLORS.bold}${name}${logger.COLORS.reset}: ${args}`;
+        }
+      }
+      break;
+    case 'tool_result':
+      typePrefix = `${logger.COLORS.gray}📄 RESL${logger.COLORS.reset}`;
+      const resMatch = content.match(/\[Tool Result: ([^\]]+)\]/);
+      content = resMatch ? `${resMatch[1]} OK` : 'result';
+      break;
+    case 'result':
+      typePrefix = `${logger.COLORS.green}✅ DONE${logger.COLORS.reset}`;
+      break;
+    case 'system':
+      typePrefix = `${logger.COLORS.gray}⚙️  SYS${logger.COLORS.reset}`;
+      break;
+    case 'thinking':
+      typePrefix = `${logger.COLORS.gray}🤔 THNK${logger.COLORS.reset}`;
+      if (compact) content = content.replace(/\n/g, ' ').substring(0, 100) + (content.length > 100 ? '...' : '');
+      break;
+  }
+  
+  if (!typePrefix) return `${tsPrefix}${labelPrefix}${content}`;
+
+  if (compact) {
+    return `${tsPrefix}${labelPrefix}${typePrefix} ${content}`;
+  }
+
+  // Multi-line box format (as seen in orchestrator)
+  const lines = content.split('\n');
+  const fullPrefix = `${tsPrefix}${labelPrefix}`;
+  const header = `${typePrefix} ┌${'─'.repeat(60)}`;
+  let result = `${fullPrefix}${header}\n`;
+  
+  const indent = ' '.repeat(stripAnsi(typePrefix).length);
+  for (const line of lines) {
+    result += `${fullPrefix}${indent} │ ${line}\n`;
+  }
+  result += `${fullPrefix}${indent} └${'─'.repeat(60)}`;
+  
+  return result;
+}
+
+/**
+ * Detect and format a message that might be a raw JSON string from cursor-agent
+ */
+export function formatPotentialJsonMessage(message: string): string {
+  const trimmed = message.trim();
+  if (!trimmed.startsWith('{') || !trimmed.endsWith('}')) {
+    return message;
+  }
+  
+  try {
+    const json = JSON.parse(trimmed);
+    if (!json.type) return message;
+    
+    // Convert JSON to a ParsedMessage-like structure for formatting
+    let content = trimmed;
+    let type = 'system';
+    
+    if (json.type === 'thinking' && json.text) {
+      content = json.text;
+      type = 'thinking';
+    } else if (json.type === 'assistant' && json.message?.content) {
+      content = json.message.content
+        .filter((c: any) => c.type === 'text')
+        .map((c: any) => c.text)
+        .join('');
+      type = 'assistant';
+    } else if (json.type === 'user' && json.message?.content) {
+      content = json.message.content
+        .filter((c: any) => c.type === 'text')
+        .map((c: any) => c.text)
+        .join('');
+      type = 'user';
+    } else if (json.type === 'tool_call' && json.subtype === 'started') {
+      const toolName = Object.keys(json.tool_call)[0] || 'unknown';
+      const args = json.tool_call[toolName]?.args || {};
+      content = `[Tool: ${toolName}] ${JSON.stringify(args)}`;
+      type = 'tool';
+    } else if (json.type === 'tool_call' && json.subtype === 'completed') {
+      const toolName = Object.keys(json.tool_call)[0] || 'unknown';
+      content = `[Tool Result: ${toolName}]`;
+      type = 'tool_result';
+    } else if (json.type === 'result') {
+      content = json.result || 'Task completed';
+      type = 'result';
+    } else {
+      // Unknown type, return as is
+      return message;
+    }
+    
+    return formatMessageForConsole({
+      type: type as any,
+      role: type,
+      content,
+      timestamp: json.timestamp_ms || Date.now()
+    }, { includeTimestamp: false, compact: true });
+    
+  } catch {
+    return message;
+  }
+}
+

package/src/utils/path.ts

@@ -0,0 +1,45 @@
+import * as path from 'path';
+
+/**
+ * Ensures that a path is safe and stays within a base directory.
+ * Prevents path traversal attacks.
+ */
+export function isSafePath(baseDir: string, ...parts: string[]): boolean {
+  const joined = path.join(baseDir, ...parts); // nosemgrep
+  const resolvedBase = path.resolve(baseDir); // nosemgrep
+  const resolvedJoined = path.resolve(joined); // nosemgrep
+  
+  return resolvedJoined.startsWith(resolvedBase);
+}
+
+/**
+ * Safely joins path parts and ensures the result is within the base directory.
+ * Throws an error if path traversal is detected.
+ * 
+ * @param baseDir The base directory that the resulting path must be within
+ * @param parts Path parts to join
+ * @returns The joined path
+ * @throws Error if the resulting path is outside the base directory
+ */
+export function safeJoin(baseDir: string, ...parts: string[]): string {
+  const joined = path.join(baseDir, ...parts); // nosemgrep
+  const resolvedBase = path.resolve(baseDir); // nosemgrep
+  const resolvedJoined = path.resolve(joined); // nosemgrep
+  
+  if (!resolvedJoined.startsWith(resolvedBase)) {
+    throw new Error(`Potential path traversal detected: ${joined} is outside of ${baseDir}`);
+  }
+  
+  return joined;
+}
+
+/**
+ * Normalizes a path and checks if it's absolute or relative to project root.
+ */
+export function normalizePath(p: string, projectRoot: string): string {
+  if (path.isAbsolute(p)) {
+    return path.normalize(p);
+  }
+  return path.join(projectRoot, p); // nosemgrep
+}
+

package/src/utils/state.ts

@@ -4,6 +4,7 @@
 
 import * as fs from 'fs';
 import * as path from 'path';
+import { safeJoin } from './path';
 import { 
   LaneState, 
   ConversationEntry, 
@@ -80,18 +81,25 @@ export function readLog<T = any>(logPath: string): T[] {
 /**
  * Create initial lane state
  */
-export function createLaneState(laneName: string, config: RunnerConfig): LaneState {
+export function createLaneState(
+  laneName: string, 
+  config: RunnerConfig, 
+  tasksFile?: string,
+  options: { pipelineBranch?: string; worktreeDir?: string } = {}
+): LaneState {
   return {
     label: laneName,
     status: 'pending',
     currentTaskIndex: 0,
     totalTasks: config.tasks ? config.tasks.length : 0,
-    worktreeDir: null,
-    pipelineBranch: null,
+    worktreeDir: options.worktreeDir || null,
+    pipelineBranch: options.pipelineBranch || null,
     startTime: Date.now(),
     endTime: null,
     error: null,
     dependencyRequest: null,
+    tasksFile,
+    dependsOn: config.dependsOn || [],
   };
 }
 
@@ -151,7 +159,7 @@ export function getLatestRunDir(logsDir: string): string | null {
   }
   
   const runs = fs.readdirSync(logsDir)
-    .filter(f => fs.statSync(path.join(logsDir, f)).isDirectory())
+    .filter(f => fs.statSync(safeJoin(logsDir, f)).isDirectory())
     .sort()
     .reverse();
   
@@ -159,7 +167,7 @@ export function getLatestRunDir(logsDir: string): string | null {
     return null;
   }
   
-  return path.join(logsDir, runs[0]!);
+  return safeJoin(logsDir, runs[0]!);
 }
 
 /**
@@ -171,11 +179,11 @@ export function listLanesInRun(runDir: string): { name: string; dir: string; sta
   }
   
   return fs.readdirSync(runDir)
-    .filter(f => fs.statSync(path.join(runDir, f)).isDirectory())
+    .filter(f => fs.statSync(safeJoin(runDir, f)).isDirectory())
     .map(laneName => ({
       name: laneName,
-      dir: path.join(runDir, laneName),
-      statePath: path.join(runDir, laneName, 'state.json'),
+      dir: safeJoin(runDir, laneName),
+      statePath: safeJoin(runDir, laneName, 'state.json'),
     }));
 }
 

package/src/utils/template.ts

@@ -0,0 +1,92 @@
+/**
+ * Template loading utilities for CursorFlow
+ */
+
+import * as fs from 'fs';
+import * as path from 'path';
+import * as https from 'https';
+import * as http from 'http';
+import * as logger from './logger';
+import { safeJoin } from './path';
+import { findProjectRoot } from './config';
+
+/**
+ * Fetch remote template from URL
+ */
+export async function fetchRemoteTemplate(url: string): Promise<any> {
+  return new Promise((resolve, reject) => {
+    const protocol = url.startsWith('https') ? https : http;
+    
+    protocol.get(url, (res) => {
+      if (res.statusCode !== 200) {
+        reject(new Error(`Failed to fetch template from ${url}: Status ${res.statusCode}`));
+        return;
+      }
+
+      let data = '';
+      res.on('data', (chunk) => {
+        data += chunk;
+      });
+
+      res.on('end', () => {
+        try {
+          resolve(JSON.parse(data));
+        } catch (e) {
+          reject(new Error(`Failed to parse template JSON from ${url}: ${e}`));
+        }
+      });
+    }).on('error', (err) => {
+      reject(new Error(`Network error while fetching template from ${url}: ${err.message}`));
+    });
+  });
+}
+
+/**
+ * Resolve template from various sources:
+ * 1. URL (starts with http:// or https://)
+ * 2. Built-in template (name without .json)
+ * 3. Local file path
+ */
+export async function resolveTemplate(templatePath: string): Promise<any> {
+  // 1. Remote URL
+  if (templatePath.startsWith('http://') || templatePath.startsWith('https://')) {
+    logger.info(`Fetching remote template: ${templatePath}`);
+    return fetchRemoteTemplate(templatePath);
+  }
+
+  // 2. Built-in template
+  // Search in templates/ directory of the project root
+  try {
+    const projectRoot = findProjectRoot();
+    const builtInPath = safeJoin(projectRoot, 'templates', templatePath.endsWith('.json') ? templatePath : `${templatePath}.json`);
+    if (fs.existsSync(builtInPath)) {
+      logger.info(`Using built-in template: ${templatePath}`);
+      return JSON.parse(fs.readFileSync(builtInPath, 'utf8'));
+    }
+  } catch (e) {
+    // Ignore error if project root not found, try other methods
+  }
+
+  // Fallback for built-in templates relative to the module (for installed package)
+  const templatesDir = path.resolve(__dirname, '../../templates');
+  const templateFileName = templatePath.endsWith('.json') ? templatePath : `${templatePath}.json`;
+  const modulePath = safeJoin(templatesDir, templateFileName);
+  if (fs.existsSync(modulePath)) {
+    logger.info(`Using module template: ${templatePath}`);
+    return JSON.parse(fs.readFileSync(modulePath, 'utf8'));
+  }
+
+  // 3. Local file path
+  const localPath = safeJoin(process.cwd(), templatePath);
+  if (fs.existsSync(localPath)) {
+    logger.info(`Using local template: ${templatePath}`);
+    try {
+      return JSON.parse(fs.readFileSync(localPath, 'utf8'));
+    } catch (e) {
+      throw new Error(`Failed to parse local template ${templatePath}: ${e}`);
+    }
+  }
+
+  throw new Error(`Template not found: ${templatePath}. It must be a URL, a built-in template name, or a local file path.`);
+}
+

package/src/utils/types.ts

@@ -200,6 +200,7 @@ export interface RunnerConfig {
   tasks: Task[];
   dependsOn?: string[];
   pipelineBranch?: string;
+  worktreeDir?: string;
   branchPrefix?: string;
   worktreeRoot?: string;
   baseBranch?: string;

package/templates/basic.json

@@ -0,0 +1,21 @@
+{
+  "name": "basic-template",
+  "tasks": [
+    {
+      "name": "plan",
+      "model": "sonnet-4.5-thinking",
+      "prompt": "Analyze requirements for {{featureName}} and create a plan.",
+      "acceptanceCriteria": ["Plan documented"]
+    },
+    {
+      "name": "implement",
+      "model": "sonnet-4.5",
+      "prompt": "Implement {{featureName}} based on the plan.",
+      "acceptanceCriteria": ["Implementation complete"]
+    }
+  ],
+  "dependencyPolicy": {
+    "allowDependencyChange": false,
+    "lockfileReadOnly": true
+  }
+}