@litmers/cursorflow-orchestrator 0.1.18 → 0.1.20

package/dist/utils/path.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Ensures that a path is safe and stays within a base directory.
+ * Prevents path traversal attacks.
+ */
+export declare function isSafePath(baseDir: string, ...parts: string[]): boolean;
+/**
+ * Safely joins path parts and ensures the result is within the base directory.
+ * Throws an error if path traversal is detected.
+ *
+ * @param baseDir The base directory that the resulting path must be within
+ * @param parts Path parts to join
+ * @returns The joined path
+ * @throws Error if the resulting path is outside the base directory
+ */
+export declare function safeJoin(baseDir: string, ...parts: string[]): string;
+/**
+ * Normalizes a path and checks if it's absolute or relative to project root.
+ */
+export declare function normalizePath(p: string, projectRoot: string): string;

package/dist/utils/path.js

@@ -0,0 +1,77 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafePath = isSafePath;
+exports.safeJoin = safeJoin;
+exports.normalizePath = normalizePath;
+const path = __importStar(require("path"));
+/**
+ * Ensures that a path is safe and stays within a base directory.
+ * Prevents path traversal attacks.
+ */
+function isSafePath(baseDir, ...parts) {
+    const joined = path.join(baseDir, ...parts); // nosemgrep
+    const resolvedBase = path.resolve(baseDir); // nosemgrep
+    const resolvedJoined = path.resolve(joined); // nosemgrep
+    return resolvedJoined.startsWith(resolvedBase);
+}
+/**
+ * Safely joins path parts and ensures the result is within the base directory.
+ * Throws an error if path traversal is detected.
+ *
+ * @param baseDir The base directory that the resulting path must be within
+ * @param parts Path parts to join
+ * @returns The joined path
+ * @throws Error if the resulting path is outside the base directory
+ */
+function safeJoin(baseDir, ...parts) {
+    const joined = path.join(baseDir, ...parts); // nosemgrep
+    const resolvedBase = path.resolve(baseDir); // nosemgrep
+    const resolvedJoined = path.resolve(joined); // nosemgrep
+    if (!resolvedJoined.startsWith(resolvedBase)) {
+        throw new Error(`Potential path traversal detected: ${joined} is outside of ${baseDir}`);
+    }
+    return joined;
+}
+/**
+ * Normalizes a path and checks if it's absolute or relative to project root.
+ */
+function normalizePath(p, projectRoot) {
+    if (path.isAbsolute(p)) {
+        return path.normalize(p);
+    }
+    return path.join(projectRoot, p); // nosemgrep
+}
+//# sourceMappingURL=path.js.map

package/dist/utils/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../src/utils/path.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA,gCAMC;AAWD,4BAUC;AAKD,sCAKC;AA3CD,2CAA6B;AAE7B;;;GAGG;AACH,SAAgB,UAAU,CAAC,OAAe,EAAE,GAAG,KAAe;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;IAEzD,OAAO,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,QAAQ,CAAC,OAAe,EAAE,GAAG,KAAe;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;IACxD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY;IAEzD,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,kBAAkB,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,CAAS,EAAE,WAAmB;IAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;AAChD,CAAC"}

package/dist/utils/state.d.ts

@@ -22,7 +22,10 @@ export declare function readLog<T = any>(logPath: string): T[];
 /**
  * Create initial lane state
  */
-export declare function createLaneState(laneName: string, config: RunnerConfig): LaneState;
+export declare function createLaneState(laneName: string, config: RunnerConfig, tasksFile?: string, options?: {
+    pipelineBranch?: string;
+    worktreeDir?: string;
+}): LaneState;
 /**
  * Update lane state
  */

package/dist/utils/state.js

@@ -50,6 +50,7 @@ exports.listLanesInRun = listLanesInRun;
 exports.getLaneStateSummary = getLaneStateSummary;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const path_1 = require("./path");
 /**
  * Save state to JSON file
  */
@@ -109,18 +110,20 @@ function readLog(logPath) {
 /**
  * Create initial lane state
  */
-function createLaneState(laneName, config) {
+function createLaneState(laneName, config, tasksFile, options = {}) {
     return {
         label: laneName,
         status: 'pending',
         currentTaskIndex: 0,
         totalTasks: config.tasks ? config.tasks.length : 0,
-        worktreeDir: null,
-        pipelineBranch: null,
+        worktreeDir: options.worktreeDir || null,
+        pipelineBranch: options.pipelineBranch || null,
         startTime: Date.now(),
         endTime: null,
         error: null,
         dependencyRequest: null,
+        tasksFile,
+        dependsOn: config.dependsOn || [],
     };
 }
 /**
@@ -174,13 +177,13 @@ function getLatestRunDir(logsDir) {
         return null;
     }
     const runs = fs.readdirSync(logsDir)
-        .filter(f => fs.statSync(path.join(logsDir, f)).isDirectory())
+        .filter(f => fs.statSync((0, path_1.safeJoin)(logsDir, f)).isDirectory())
         .sort()
         .reverse();
     if (runs.length === 0) {
         return null;
     }
-    return path.join(logsDir, runs[0]);
+    return (0, path_1.safeJoin)(logsDir, runs[0]);
 }
 /**
  * List all lanes in a run directory
@@ -190,11 +193,11 @@ function listLanesInRun(runDir) {
         return [];
     }
     return fs.readdirSync(runDir)
-        .filter(f => fs.statSync(path.join(runDir, f)).isDirectory())
+        .filter(f => fs.statSync((0, path_1.safeJoin)(runDir, f)).isDirectory())
         .map(laneName => ({
         name: laneName,
-        dir: path.join(runDir, laneName),
-        statePath: path.join(runDir, laneName, 'state.json'),
+        dir: (0, path_1.safeJoin)(runDir, laneName),
+        statePath: (0, path_1.safeJoin)(runDir, laneName, 'state.json'),
     }));
 }
 /**

package/dist/utils/state.js.map

@@ -1 +1 @@
-{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/utils/state.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBH,8BAQC;AAKD,8BAYC;AAKD,8BASC;AAKD,0BAeC;AAKD,0CAaC;AAKD,0CAMC;AAKD,0DASC;AAKD,8CAMC;AAKD,4CAMC;AAKD,0CAeC;AAKD,wCAYC;AAKD,kDAcC;AAlMD,uCAAyB;AACzB,2CAA6B;AAU7B;;GAEG;AACH,SAAgB,SAAS,CAAC,SAAiB,EAAE,KAAU;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAU,SAAiB;IAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;IAClC,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,uCAAuC,SAAS,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,OAAe,EAAE,KAAU;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC1C,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAgB,OAAO,CAAU,OAAe;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,OAAO;aACX,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,qCAAqC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,QAAgB,EAAE,MAAoB;IACpE,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,gBAAgB,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,IAAI;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAgB,EAAE,OAA2B;IAC3E,OAAO;QACL,GAAG,KAAK;QACR,GAAG,OAAO;QACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,IAA+B,EAAE,IAAY,EAAE,UAA6C,EAAE;IACpI,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;QAC1B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,SAAiB,EAAE,UAAe,EAAE;IACpE,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAa,EAAE,OAAY,EAAE;IAC5D,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;QACL,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC7D,IAAI,EAAE;SACN,OAAO,EAAE,CAAC;IAEb,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC5D,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;QAChC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC;KACrD,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,MAAM,KAAK,GAAG,SAAS,CAAY,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;IAEnF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QACjC,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/utils/state.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBH,8BAQC;AAKD,8BAYC;AAKD,8BASC;AAKD,0BAeC;AAKD,0CAoBC;AAKD,0CAMC;AAKD,0DASC;AAKD,8CAMC;AAKD,4CAMC;AAKD,0CAeC;AAKD,wCAYC;AAKD,kDAcC;AA1MD,uCAAyB;AACzB,2CAA6B;AAC7B,iCAAkC;AAUlC;;GAEG;AACH,SAAgB,SAAS,CAAC,SAAiB,EAAE,KAAU;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAU,SAAiB;IAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;IAClC,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,uCAAuC,SAAS,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,OAAe,EAAE,KAAU;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC1C,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,SAAgB,OAAO,CAAU,OAAe;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,OAAO;aACX,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,qCAAqC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAC7B,QAAgB,EAChB,MAAoB,EACpB,SAAkB,EAClB,UAA6D,EAAE;IAE/D,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;QACjB,gBAAgB,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;QACxC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;QAC9C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,iBAAiB,EAAE,IAAI;QACvB,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;KAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAgB,EAAE,OAA2B;IAC3E,OAAO;QACL,GAAG,KAAK;QACR,GAAG,OAAO;QACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,uBAAuB,CAAC,IAA+B,EAAE,IAAY,EAAE,UAA6C,EAAE;IACpI,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;QAC1B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAAC,SAAiB,EAAE,UAAe,EAAE;IACpE,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAa,EAAE,OAAY,EAAE;IAC5D,OAAO;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;QACL,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;SACjC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAA,eAAQ,EAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC5D,IAAI,EAAE;SACN,OAAO,EAAE,CAAC;IAEb,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAA,eAAQ,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,MAAc;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAA,eAAQ,EAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC3D,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,CAAC;QAC/B,SAAS,EAAE,IAAA,eAAQ,EAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC;KACpD,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,MAAM,KAAK,GAAG,SAAS,CAAY,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;IAEnF,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;QACjC,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC"}

package/dist/utils/template.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Template loading utilities for CursorFlow
+ */
+/**
+ * Fetch remote template from URL
+ */
+export declare function fetchRemoteTemplate(url: string): Promise<any>;
+/**
+ * Resolve template from various sources:
+ * 1. URL (starts with http:// or https://)
+ * 2. Built-in template (name without .json)
+ * 3. Local file path
+ */
+export declare function resolveTemplate(templatePath: string): Promise<any>;

package/dist/utils/template.js

@@ -0,0 +1,122 @@
+"use strict";
+/**
+ * Template loading utilities for CursorFlow
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchRemoteTemplate = fetchRemoteTemplate;
+exports.resolveTemplate = resolveTemplate;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const https = __importStar(require("https"));
+const http = __importStar(require("http"));
+const logger = __importStar(require("./logger"));
+const path_1 = require("./path");
+const config_1 = require("./config");
+/**
+ * Fetch remote template from URL
+ */
+async function fetchRemoteTemplate(url) {
+    return new Promise((resolve, reject) => {
+        const protocol = url.startsWith('https') ? https : http;
+        protocol.get(url, (res) => {
+            if (res.statusCode !== 200) {
+                reject(new Error(`Failed to fetch template from ${url}: Status ${res.statusCode}`));
+                return;
+            }
+            let data = '';
+            res.on('data', (chunk) => {
+                data += chunk;
+            });
+            res.on('end', () => {
+                try {
+                    resolve(JSON.parse(data));
+                }
+                catch (e) {
+                    reject(new Error(`Failed to parse template JSON from ${url}: ${e}`));
+                }
+            });
+        }).on('error', (err) => {
+            reject(new Error(`Network error while fetching template from ${url}: ${err.message}`));
+        });
+    });
+}
+/**
+ * Resolve template from various sources:
+ * 1. URL (starts with http:// or https://)
+ * 2. Built-in template (name without .json)
+ * 3. Local file path
+ */
+async function resolveTemplate(templatePath) {
+    // 1. Remote URL
+    if (templatePath.startsWith('http://') || templatePath.startsWith('https://')) {
+        logger.info(`Fetching remote template: ${templatePath}`);
+        return fetchRemoteTemplate(templatePath);
+    }
+    // 2. Built-in template
+    // Search in templates/ directory of the project root
+    try {
+        const projectRoot = (0, config_1.findProjectRoot)();
+        const builtInPath = (0, path_1.safeJoin)(projectRoot, 'templates', templatePath.endsWith('.json') ? templatePath : `${templatePath}.json`);
+        if (fs.existsSync(builtInPath)) {
+            logger.info(`Using built-in template: ${templatePath}`);
+            return JSON.parse(fs.readFileSync(builtInPath, 'utf8'));
+        }
+    }
+    catch (e) {
+        // Ignore error if project root not found, try other methods
+    }
+    // Fallback for built-in templates relative to the module (for installed package)
+    const templatesDir = path.resolve(__dirname, '../../templates');
+    const templateFileName = templatePath.endsWith('.json') ? templatePath : `${templatePath}.json`;
+    const modulePath = (0, path_1.safeJoin)(templatesDir, templateFileName);
+    if (fs.existsSync(modulePath)) {
+        logger.info(`Using module template: ${templatePath}`);
+        return JSON.parse(fs.readFileSync(modulePath, 'utf8'));
+    }
+    // 3. Local file path
+    const localPath = (0, path_1.safeJoin)(process.cwd(), templatePath);
+    if (fs.existsSync(localPath)) {
+        logger.info(`Using local template: ${templatePath}`);
+        try {
+            return JSON.parse(fs.readFileSync(localPath, 'utf8'));
+        }
+        catch (e) {
+            throw new Error(`Failed to parse local template ${templatePath}: ${e}`);
+        }
+    }
+    throw new Error(`Template not found: ${templatePath}. It must be a URL, a built-in template name, or a local file path.`);
+}
+//# sourceMappingURL=template.js.map

package/dist/utils/template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.js","sourceRoot":"","sources":["../../src/utils/template.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaH,kDA0BC;AAQD,0CAyCC;AAtFD,uCAAyB;AACzB,2CAA6B;AAC7B,6CAA+B;AAC/B,2CAA6B;AAC7B,iDAAmC;AACnC,iCAAkC;AAClC,qCAA2C;AAE3C;;GAEG;AACI,KAAK,UAAU,mBAAmB,CAAC,GAAW;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAExD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,GAAG,YAAY,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YAED,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5B,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,8CAA8C,GAAG,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,YAAoB;IACxD,gBAAgB;IAChB,IAAI,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QACzD,OAAO,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,uBAAuB;IACvB,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAA,wBAAe,GAAE,CAAC;QACtC,MAAM,WAAW,GAAG,IAAA,eAAQ,EAAC,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,CAAC,CAAC;QAC/H,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,4DAA4D;IAC9D,CAAC;IAED,iFAAiF;IACjF,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAChE,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,OAAO,CAAC;IAChG,MAAM,UAAU,GAAG,IAAA,eAAQ,EAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,0BAA0B,YAAY,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,qBAAqB;IACrB,MAAM,SAAS,GAAG,IAAA,eAAQ,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC,CAAC;IACxD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,YAAY,qEAAqE,CAAC,CAAC;AAC5H,CAAC"}

package/dist/utils/types.d.ts

@@ -167,6 +167,7 @@ export interface RunnerConfig {
     tasks: Task[];
     dependsOn?: string[];
     pipelineBranch?: string;
+    worktreeDir?: string;
     branchPrefix?: string;
     worktreeRoot?: string;
     baseBranch?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litmers/cursorflow-orchestrator",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Git worktree-based parallel AI agent orchestration system for Cursor",
   "main": "dist/cli/index.js",
   "bin": {

package/src/cli/clean.ts

@@ -9,6 +9,7 @@ import * as path from 'path';
 import * as logger from '../utils/logger';
 import * as git from '../utils/git';
 import { loadConfig, getLogsDir, getTasksDir } from '../utils/config';
+import { safeJoin } from '../utils/path';
 
 interface CleanOptions {
   type?: string;
@@ -105,7 +106,7 @@ async function cleanWorktrees(config: any, repoRoot: string, options: CleanOptio
   logger.info('\nChecking worktrees...');
   const worktrees = git.listWorktrees(repoRoot);
   
-  const worktreeRoot = path.join(repoRoot, config.worktreeRoot || '_cursorflow/worktrees');
+  const worktreeRoot = safeJoin(repoRoot, config.worktreeRoot || '_cursorflow/worktrees');
   let toRemove = worktrees.filter(wt => {
     // Skip main worktree
     if (wt.path === repoRoot) return false;
@@ -226,9 +227,9 @@ async function cleanLogs(config: any, options: CleanOptions) {
     const entries = fs.readdirSync(logsDir, { withFileTypes: true });
     let items = entries.map(entry => ({
       name: entry.name,
-      path: path.join(logsDir, entry.name),
+      path: safeJoin(logsDir, entry.name),
       isDir: entry.isDirectory(),
-      mtime: getModTime(path.join(logsDir, entry.name))
+      mtime: getModTime(safeJoin(logsDir, entry.name))
     }));
 
     if (items.length <= 1) {
@@ -288,9 +289,9 @@ async function cleanTasks(config: any, options: CleanOptions) {
       .filter(entry => entry.name !== 'example')
       .map(entry => ({
         name: entry.name,
-        path: path.join(tasksDir, entry.name),
+        path: safeJoin(tasksDir, entry.name),
         isDir: entry.isDirectory(),
-        mtime: getModTime(path.join(tasksDir, entry.name))
+        mtime: getModTime(safeJoin(tasksDir, entry.name))
       }));
 
     if (items.length <= 1) {
@@ -325,7 +326,7 @@ async function cleanTasks(config: any, options: CleanOptions) {
         const entries = fs.readdirSync(tasksDir, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.name === 'example') continue;
-          const itemPath = path.join(tasksDir, entry.name);
+          const itemPath = safeJoin(tasksDir, entry.name);
           logger.info(`  Removing task: ${entry.name}...`);
           fs.rmSync(itemPath, { recursive: true, force: true });
         }

package/src/cli/index.ts

@@ -34,10 +34,11 @@ function printHelp(): void {
 
 \x1b[1mCOMMANDS\x1b[0m
   \x1b[33minit\x1b[0m [options]              Initialize CursorFlow in project
+  \x1b[33msetup\x1b[0m [options]             Install Cursor IDE commands
   \x1b[33mprepare\x1b[0m <feature> [opts]    Prepare task directory and JSON files
   \x1b[33mrun\x1b[0m <tasks-dir> [options]   Run orchestration (DAG-based)
   \x1b[33mmonitor\x1b[0m [run-dir] [options] \x1b[36mInteractive\x1b[0m lane dashboard
-  \x1b[33mclean\x1b[0m <type> [options]      Clean branches/worktrees/logs
+  \x1b[33mclean\x1b[0m <type> [options]      Clean branches/worktrees/logs/tasks
   \x1b[33mresume\x1b[0m [lane] [options]     Resume lane(s) - use --all for batch resume
   \x1b[33mdoctor\x1b[0m [options]            Check environment and preflight
   \x1b[33msignal\x1b[0m <lane> <msg>         Directly intervene in a running lane
@@ -54,6 +55,9 @@ function printHelp(): void {
   $ \x1b[32mcursorflow prepare NewFeature --lanes 3\x1b[0m
   $ \x1b[32mcursorflow run _cursorflow/tasks/MyFeature/\x1b[0m
   $ \x1b[32mcursorflow monitor latest\x1b[0m
+  $ \x1b[32mcursorflow logs --all --follow\x1b[0m
+  $ \x1b[32mcursorflow resume --all\x1b[0m
+  $ \x1b[32mcursorflow doctor\x1b[0m
   $ \x1b[32mcursorflow models\x1b[0m
 
 \x1b[1mDOCUMENTATION\x1b[0m

package/src/cli/init.ts

@@ -9,6 +9,7 @@ import * as path from 'path';
 import * as logger from '../utils/logger';
 import { findProjectRoot, createDefaultConfig, CursorFlowConfig } from '../utils/config';
 import { setupCommands } from './setup-commands';
+import { safeJoin } from '../utils/path';
 
 interface InitOptions {
   example: boolean;
@@ -84,8 +85,8 @@ Examples:
 }
 
 function createDirectories(projectRoot: string, config: CursorFlowConfig): void {
-  const tasksDir = path.join(projectRoot, config.tasksDir);
-  const logsDir = path.join(projectRoot, config.logsDir);
+  const tasksDir = safeJoin(projectRoot, config.tasksDir);
+  const logsDir = safeJoin(projectRoot, config.logsDir);
   
   if (!fs.existsSync(tasksDir)) {
     fs.mkdirSync(tasksDir, { recursive: true });
@@ -103,7 +104,7 @@ function createDirectories(projectRoot: string, config: CursorFlowConfig): void
 }
 
 function createExampleTasks(projectRoot: string, config: CursorFlowConfig): void {
-  const exampleDir = path.join(projectRoot, config.tasksDir, 'example');
+  const exampleDir = safeJoin(projectRoot, config.tasksDir, 'example');
   
   if (!fs.existsSync(exampleDir)) {
     fs.mkdirSync(exampleDir, { recursive: true });
@@ -134,13 +135,13 @@ Create a simple hello.txt file with a greeting message.
     ]
   };
   
-  const taskPath = path.join(exampleDir, '01-hello.json');
+  const taskPath = safeJoin(exampleDir, '01-hello.json');
   fs.writeFileSync(taskPath, JSON.stringify(exampleTask, null, 2) + '\n', 'utf8');
   
   logger.success(`Created example task: ${path.relative(projectRoot, taskPath)}`);
   
   // Create README
-  const readmePath = path.join(exampleDir, 'README.md');
+  const readmePath = safeJoin(exampleDir, 'README.md');
   const readme = `# Example Task
 
 This is an example CursorFlow task to help you get started.
@@ -172,7 +173,7 @@ cursorflow run ${config.tasksDir}/example/
  * Add _cursorflow to .gitignore
  */
 function updateGitignore(projectRoot: string): void {
-  const gitignorePath = path.join(projectRoot, '.gitignore');
+  const gitignorePath = safeJoin(projectRoot, '.gitignore');
   const entry = '_cursorflow/';
   
   // Try to read existing .gitignore (avoid TOCTOU by reading directly)