@litmers/cursorflow-orchestrator 0.1.18 → 0.1.20

package/src/cli/logs.ts

@@ -6,12 +6,14 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as logger from '../utils/logger';
 import { loadConfig } from '../utils/config';
+import { safeJoin } from '../utils/path';
 import { 
   readJsonLog, 
   exportLogs, 
   stripAnsi,
   JsonLogEntry 
 } from '../utils/enhanced-logger';
+import { formatPotentialJsonMessage } from '../utils/log-formatter';
 
 interface LogsOptions {
   runDir?: string;
@@ -114,15 +116,15 @@ function parseArgs(args: string[]): LogsOptions {
  * Find the latest run directory
  */
 function findLatestRunDir(logsDir: string): string | null {
-  const runsDir = path.join(logsDir, 'runs');
+  const runsDir = safeJoin(logsDir, 'runs');
   if (!fs.existsSync(runsDir)) return null;
   
   const runs = fs.readdirSync(runsDir)
     .filter(d => d.startsWith('run-'))
     .map(d => ({ 
       name: d, 
-      path: path.join(runsDir, d), 
-      mtime: fs.statSync(path.join(runsDir, d)).mtime.getTime() 
+      path: safeJoin(runsDir, d), 
+      mtime: fs.statSync(safeJoin(runsDir, d)).mtime.getTime() 
     }))
     .sort((a, b) => b.mtime - a.mtime);
   
@@ -133,11 +135,11 @@ function findLatestRunDir(logsDir: string): string | null {
  * List lanes in a run directory
  */
 function listLanes(runDir: string): string[] {
-  const lanesDir = path.join(runDir, 'lanes');
+  const lanesDir = safeJoin(runDir, 'lanes');
   if (!fs.existsSync(lanesDir)) return [];
   
   return fs.readdirSync(lanesDir)
-    .filter(d => fs.statSync(path.join(lanesDir, d)).isDirectory());
+    .filter(d => fs.statSync(safeJoin(lanesDir, d)).isDirectory());
 }
 
 /**
@@ -148,9 +150,9 @@ function displayTextLogs(
   options: LogsOptions
 ): void {
   let logFile: string;
-  const readableLog = path.join(laneDir, 'terminal-readable.log');
-  const rawLog = path.join(laneDir, 'terminal-raw.log');
-  const cleanLog = path.join(laneDir, 'terminal.log');
+  const readableLog = safeJoin(laneDir, 'terminal-readable.log');
+  const rawLog = safeJoin(laneDir, 'terminal-raw.log');
+  const cleanLog = safeJoin(laneDir, 'terminal.log');
 
   if (options.raw) {
     logFile = rawLog;
@@ -171,10 +173,10 @@ function displayTextLogs(
   let content = fs.readFileSync(logFile, 'utf8');
   let lines = content.split('\n');
   
-  // Apply filter (escape to prevent regex injection)
+  // Apply filter (case-insensitive string match to avoid ReDoS)
   if (options.filter) {
-    const regex = new RegExp(escapeRegex(options.filter), 'i');
-    lines = lines.filter(line => regex.test(line));
+    const filterLower = options.filter.toLowerCase();
+    lines = lines.filter(line => line.toLowerCase().includes(filterLower));
   }
   
   // Apply tail
@@ -197,7 +199,7 @@ function displayJsonLogs(
   laneDir: string, 
   options: LogsOptions
 ): void {
-  const logFile = path.join(laneDir, 'terminal.jsonl');
+  const logFile = safeJoin(laneDir, 'terminal.jsonl');
   
   if (!fs.existsSync(logFile)) {
     console.log('No JSON log file found.');
@@ -211,10 +213,13 @@ function displayJsonLogs(
     entries = entries.filter(e => e.level === options.level);
   }
   
-  // Apply regex filter (escape to prevent regex injection)
+  // Apply filter (case-insensitive string match to avoid ReDoS)
   if (options.filter) {
-    const regex = new RegExp(escapeRegex(options.filter), 'i');
-    entries = entries.filter(e => regex.test(e.message) || regex.test(e.task || ''));
+    const filterLower = options.filter.toLowerCase();
+    entries = entries.filter(e => 
+      e.message.toLowerCase().includes(filterLower) || 
+      (e.task && e.task.toLowerCase().includes(filterLower))
+    );
   }
   
   // Apply tail
@@ -229,7 +234,8 @@ function displayJsonLogs(
     for (const entry of entries) {
       const levelColor = getLevelColor(entry.level);
       const ts = new Date(entry.timestamp).toLocaleTimeString();
-      console.log(`${levelColor}[${ts}] [${entry.level.toUpperCase().padEnd(6)}]${logger.COLORS.reset} ${entry.message}`);
+      const formattedMsg = formatPotentialJsonMessage(entry.message);
+      console.log(`${levelColor}[${ts}] [${entry.level.toUpperCase().padEnd(6)}]${logger.COLORS.reset} ${formattedMsg}`);
     }
   }
 }
@@ -290,8 +296,8 @@ function readAllLaneLogs(runDir: string): MergedLogEntry[] {
   const allEntries: MergedLogEntry[] = [];
   
   lanes.forEach((laneName, index) => {
-    const laneDir = path.join(runDir, 'lanes', laneName);
-    const jsonLogPath = path.join(laneDir, 'terminal.jsonl');
+    const laneDir = safeJoin(runDir, 'lanes', laneName);
+    const jsonLogPath = safeJoin(laneDir, 'terminal.jsonl');
     
     if (fs.existsSync(jsonLogPath)) {
       const entries = readJsonLog(jsonLogPath);
@@ -333,13 +339,13 @@ function displayMergedLogs(runDir: string, options: LogsOptions): void {
     entries = entries.filter(e => e.level === options.level);
   }
   
-  // Apply regex filter (escape to prevent regex injection)
+  // Apply filter (case-insensitive string match to avoid ReDoS)
   if (options.filter) {
-    const regex = new RegExp(escapeRegex(options.filter), 'i');
+    const filterLower = options.filter.toLowerCase();
     entries = entries.filter(e => 
-      regex.test(e.message) || 
-      regex.test(e.task || '') ||
-      regex.test(e.laneName)
+      e.message.toLowerCase().includes(filterLower) || 
+      (e.task && e.task.toLowerCase().includes(filterLower)) ||
+      e.laneName.toLowerCase().includes(filterLower)
     );
   }
   
@@ -387,7 +393,8 @@ function displayMergedLogs(runDir: string, options: LogsOptions): void {
       continue;
     }
     
-    console.log(`${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ${laneColor}[${lanePad}]${logger.COLORS.reset} ${levelColor}[${levelPad}]${logger.COLORS.reset} ${entry.message}`);
+    const formattedMsg = formatPotentialJsonMessage(entry.message);
+    console.log(`${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ${laneColor}[${lanePad}]${logger.COLORS.reset} ${levelColor}[${levelPad}]${logger.COLORS.reset} ${formattedMsg}`);
   }
   
   console.log(`\n${logger.COLORS.cyan}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${logger.COLORS.reset}`);
@@ -426,8 +433,8 @@ function followAllLogs(runDir: string, options: LogsOptions): void {
     const newEntries: MergedLogEntry[] = [];
     
     for (const lane of lanes) {
-      const laneDir = path.join(runDir, 'lanes', lane);
-      const jsonLogPath = path.join(laneDir, 'terminal.jsonl');
+      const laneDir = safeJoin(runDir, 'lanes', lane);
+      const jsonLogPath = safeJoin(laneDir, 'terminal.jsonl');
       
       try {
         // Use statSync directly to avoid TOCTOU race condition
@@ -473,10 +480,12 @@ function followAllLogs(runDir: string, options: LogsOptions): void {
       // Apply level filter
       if (options.level && entry.level !== options.level) continue;
       
-      // Apply regex filter (escape to prevent regex injection)
+      // Apply filter (case-insensitive string match to avoid ReDoS)
       if (options.filter) {
-        const regex = new RegExp(escapeRegex(options.filter), 'i');
-        if (!regex.test(entry.message) && !regex.test(entry.task || '') && !regex.test(entry.laneName)) {
+        const filterLower = options.filter.toLowerCase();
+        if (!entry.message.toLowerCase().includes(filterLower) && 
+            !(entry.task && entry.task.toLowerCase().includes(filterLower)) && 
+            !entry.laneName.toLowerCase().includes(filterLower)) {
           continue;
         }
       }
@@ -496,7 +505,8 @@ function followAllLogs(runDir: string, options: LogsOptions): void {
         continue;
       }
       
-      console.log(`${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ${entry.laneColor}[${lanePad}]${logger.COLORS.reset} ${levelColor}[${levelPad}]${logger.COLORS.reset} ${entry.message}`);
+      const formattedMsg = formatPotentialJsonMessage(entry.message);
+      console.log(`${logger.COLORS.gray}[${ts}]${logger.COLORS.reset} ${entry.laneColor}[${lanePad}]${logger.COLORS.reset} ${levelColor}[${levelPad}]${logger.COLORS.reset} ${formattedMsg}`);
     }
   }, 100);
   
@@ -644,9 +654,9 @@ function escapeHtml(text: string): string {
  */
 function followLogs(laneDir: string, options: LogsOptions): void {
   let logFile: string;
-  const readableLog = path.join(laneDir, 'terminal-readable.log');
-  const rawLog = path.join(laneDir, 'terminal-raw.log');
-  const cleanLog = path.join(laneDir, 'terminal.log');
+  const readableLog = safeJoin(laneDir, 'terminal-readable.log');
+  const rawLog = safeJoin(laneDir, 'terminal-raw.log');
+  const cleanLog = safeJoin(laneDir, 'terminal.log');
 
   if (options.raw) {
     logFile = rawLog;
@@ -687,11 +697,11 @@ function followLogs(laneDir: string, options: LogsOptions): void {
         
         let content = buffer.toString();
         
-        // Apply filter (escape to prevent regex injection)
+        // Apply filter (case-insensitive string match to avoid ReDoS)
         if (options.filter) {
-          const regex = new RegExp(escapeRegex(options.filter), 'i');
+          const filterLower = options.filter.toLowerCase();
           const lines = content.split('\n');
-          content = lines.filter(line => regex.test(line)).join('\n');
+          content = lines.filter(line => line.toLowerCase().includes(filterLower)).join('\n');
         }
         
         // Clean ANSI if needed (unless raw mode)
@@ -734,11 +744,11 @@ function displaySummary(runDir: string): void {
   }
   
   for (const lane of lanes) {
-    const laneDir = path.join(runDir, 'lanes', lane);
-    const cleanLog = path.join(laneDir, 'terminal.log');
-    const rawLog = path.join(laneDir, 'terminal-raw.log');
-    const jsonLog = path.join(laneDir, 'terminal.jsonl');
-    const readableLog = path.join(laneDir, 'terminal-readable.log');
+    const laneDir = safeJoin(runDir, 'lanes', lane);
+    const cleanLog = safeJoin(laneDir, 'terminal.log');
+    const rawLog = safeJoin(laneDir, 'terminal-raw.log');
+    const jsonLog = safeJoin(laneDir, 'terminal.jsonl');
+    const readableLog = safeJoin(laneDir, 'terminal-readable.log');
     
     console.log(`  ${logger.COLORS.green}📁 ${lane}${logger.COLORS.reset}`);
     
@@ -839,7 +849,7 @@ async function logs(args: string[]): Promise<void> {
   }
   
   // Find lane directory
-  const laneDir = path.join(runDir, 'lanes', options.lane);
+  const laneDir = safeJoin(runDir, 'lanes', options.lane);
   if (!fs.existsSync(laneDir)) {
     const lanes = listLanes(runDir);
     throw new Error(`Lane not found: ${options.lane}\nAvailable lanes: ${lanes.join(', ')}`);

package/src/cli/monitor.ts

@@ -9,6 +9,7 @@ import * as logger from '../utils/logger';
 import { loadState, readLog } from '../utils/state';
 import { LaneState, ConversationEntry } from '../utils/types';
 import { loadConfig } from '../utils/config';
+import { safeJoin } from '../utils/path';
 
 interface LaneWithDeps {
   name: string;
@@ -339,11 +340,11 @@ class InteractiveMonitor {
     if (!lane) return;
 
     try {
-      const interventionPath = path.join(lane.path, 'intervention.txt');
+      const interventionPath = safeJoin(lane.path, 'intervention.txt');
       fs.writeFileSync(interventionPath, message, 'utf8');
 
       // Also log it to the conversation
-      const convoPath = path.join(lane.path, 'conversation.jsonl');
+      const convoPath = safeJoin(lane.path, 'conversation.jsonl');
       const entry = {
         timestamp: new Date().toISOString(),
         role: 'user',
@@ -372,7 +373,7 @@ class InteractiveMonitor {
         return;
       }
 
-      const timeoutPath = path.join(lane.path, 'timeout.txt');
+      const timeoutPath = safeJoin(lane.path, 'timeout.txt');
       fs.writeFileSync(timeoutPath, String(timeoutMs), 'utf8');
       
       this.showNotification(`Timeout updated to ${Math.round(timeoutMs/1000)}s`, 'success');
@@ -385,7 +386,7 @@ class InteractiveMonitor {
     if (!this.selectedLaneName) return;
     const lane = this.lanes.find(l => l.name === this.selectedLaneName);
     if (!lane) return;
-    const convoPath = path.join(lane.path, 'conversation.jsonl');
+    const convoPath = safeJoin(lane.path, 'conversation.jsonl');
     this.currentLogs = readLog<ConversationEntry>(convoPath);
     // Keep selection in bounds after refresh
     if (this.selectedMessageIndex >= this.currentLogs.length) {
@@ -537,7 +538,7 @@ class InteractiveMonitor {
     }
 
     const status = this.getLaneStatus(lane.path, lane.name);
-    const logPath = path.join(lane.path, 'terminal.log');
+    const logPath = safeJoin(lane.path, 'terminal.log');
     let liveLog = '(No live terminal output)';
     if (fs.existsSync(logPath)) {
       const content = fs.readFileSync(logPath, 'utf8');
@@ -680,7 +681,7 @@ class InteractiveMonitor {
       return;
     }
 
-    const logPath = path.join(lane.path, 'terminal.log');
+    const logPath = safeJoin(lane.path, 'terminal.log');
     let logLines: string[] = [];
     if (fs.existsSync(logPath)) {
       const content = fs.readFileSync(logPath, 'utf8');
@@ -761,21 +762,21 @@ class InteractiveMonitor {
   }
 
   private listLanesWithDeps(runDir: string): LaneWithDeps[] {
-    const lanesDir = path.join(runDir, 'lanes');
+    const lanesDir = safeJoin(runDir, 'lanes');
     if (!fs.existsSync(lanesDir)) return [];
     
     const config = loadConfig();
-    const tasksDir = path.join(config.projectRoot, config.tasksDir);
+    const tasksDir = safeJoin(config.projectRoot, config.tasksDir);
     
     const laneConfigs = this.listLaneFilesFromDir(tasksDir);
     
     return fs.readdirSync(lanesDir)
-      .filter(d => fs.statSync(path.join(lanesDir, d)).isDirectory())
+      .filter(d => fs.statSync(safeJoin(lanesDir, d)).isDirectory())
       .map(name => {
         const config = laneConfigs.find(c => c.name === name);
         return {
           name,
-          path: path.join(lanesDir, name),
+          path: safeJoin(lanesDir, name),
           dependsOn: config?.dependsOn || [],
         };
       });
@@ -786,7 +787,7 @@ class InteractiveMonitor {
     return fs.readdirSync(tasksDir)
       .filter(f => f.endsWith('.json'))
       .map(f => {
-        const filePath = path.join(tasksDir, f);
+        const filePath = safeJoin(tasksDir, f);
         try {
           const config = JSON.parse(fs.readFileSync(filePath, 'utf8'));
           return { name: path.basename(f, '.json'), dependsOn: config.dependsOn || [] };
@@ -797,7 +798,7 @@ class InteractiveMonitor {
   }
 
   private getLaneStatus(lanePath: string, laneName: string) {
-    const statePath = path.join(lanePath, 'state.json');
+    const statePath = safeJoin(lanePath, 'state.json');
     const state = loadState<LaneState & { chatId?: string }>(statePath);
     
     const laneInfo = this.lanes.find(l => l.name === laneName);
@@ -857,11 +858,11 @@ class InteractiveMonitor {
  * Find the latest run directory
  */
 function findLatestRunDir(logsDir: string): string | null {
-  const runsDir = path.join(logsDir, 'runs');
+  const runsDir = safeJoin(logsDir, 'runs');
   if (!fs.existsSync(runsDir)) return null;
   const runs = fs.readdirSync(runsDir)
     .filter(d => d.startsWith('run-'))
-    .map(d => ({ name: d, path: path.join(runsDir, d), mtime: fs.statSync(path.join(runsDir, d)).mtime.getTime() }))
+    .map(d => ({ name: d, path: safeJoin(runsDir, d), mtime: fs.statSync(safeJoin(runsDir, d)).mtime.getTime() }))
     .sort((a, b) => b.mtime - a.mtime);
   return runs.length > 0 ? runs[0]!.path : null;
 }

package/src/cli/prepare.ts

@@ -9,6 +9,8 @@ import * as path from 'path';
 import * as logger from '../utils/logger';
 import { loadConfig, getTasksDir } from '../utils/config';
 import { Task, RunnerConfig } from '../utils/types';
+import { safeJoin } from '../utils/path';
+import { resolveTemplate } from '../utils/template';
 
 // Preset template types
 type PresetType = 'complex' | 'simple' | 'merge';
@@ -113,8 +115,8 @@ Prepare task files for a new feature - Terminal-first workflow.
     --add-task <file>         Append task(s) to existing lane JSON file
 
   Advanced:
-    --template <path>         Custom template JSON file
-    --force                   Overwrite existing files
+    --template <path|url|name>  External template JSON file, URL, or built-in name
+    --force                     Overwrite existing files
 
 ═══════════════════════════════════════════════════════════════════════════════
 
@@ -612,7 +614,7 @@ function getFeatureNameFromDir(taskDir: string): string {
 }
 
 async function addLaneToDir(options: PrepareOptions): Promise<void> {
-  const taskDir = path.resolve(process.cwd(), options.addLane!);
+  const taskDir = path.resolve(process.cwd(), options.addLane!); // nosemgrep
   
   if (!fs.existsSync(taskDir)) {
     throw new Error(`Task directory not found: ${taskDir}`);
@@ -622,17 +624,38 @@ async function addLaneToDir(options: PrepareOptions): Promise<void> {
   const laneNumber = getNextLaneNumber(taskDir);
   const laneName = `lane-${laneNumber}`;
   const fileName = `${laneNumber.toString().padStart(2, '0')}-${laneName}.json`;
-  const filePath = path.join(taskDir, fileName);
+  const filePath = safeJoin(taskDir, fileName);
   
   const hasDependencies = options.dependsOnLanes.length > 0;
   
-  // Build tasks from options (auto-detects merge preset if has dependencies)
-  const tasks = buildTasksFromOptions(options, laneNumber, featureName, hasDependencies);
-  const config = getDefaultConfig(laneNumber, featureName, tasks);
+  // Load template if provided
+  let template = null;
+  if (options.template) {
+    template = await resolveTemplate(options.template);
+  }
+
+  let taskConfig;
+  let effectivePreset: EffectivePresetType = options.preset || (hasDependencies ? 'merge' : 'complex');
+
+  if (template) {
+    taskConfig = { ...template, laneNumber, devPort: 3000 + laneNumber };
+    effectivePreset = 'custom';
+  } else {
+    // Build tasks from options (auto-detects merge preset if has dependencies)
+    const tasks = buildTasksFromOptions(options, laneNumber, featureName, hasDependencies);
+    taskConfig = getDefaultConfig(laneNumber, featureName, tasks);
+  }
+
+  // Replace placeholders
+  const processedConfig = replacePlaceholders(taskConfig, {
+    featureName,
+    laneNumber,
+    devPort: 3000 + laneNumber,
+  });
   
   // Add dependencies if specified
   const finalConfig = {
-    ...config,
+    ...processedConfig,
     ...(hasDependencies ? { dependsOn: options.dependsOnLanes } : {}),
   };
   
@@ -647,9 +670,10 @@ async function addLaneToDir(options: PrepareOptions): Promise<void> {
     throw err;
   }
   
-  const taskSummary = tasks.map(t => t.name).join(' → ');
+  const tasksList = finalConfig.tasks || [];
+  const taskSummary = tasksList.map((t: any) => t.name).join(' → ');
   const depsInfo = hasDependencies ? ` (depends: ${options.dependsOnLanes.join(', ')})` : '';
-  const presetInfo = options.preset ? ` [${options.preset}]` : (hasDependencies ? ' [merge]' : '');
+  const presetInfo = options.preset ? ` [${options.preset}]` : (hasDependencies ? ' [merge]' : (template ? ' [template]' : ''));
   
   logger.success(`Added lane: ${fileName} [${taskSummary}]${presetInfo}${depsInfo}`);
   logger.info(`Directory: ${taskDir}`);
@@ -660,7 +684,7 @@ async function addLaneToDir(options: PrepareOptions): Promise<void> {
 }
 
 async function addTaskToLane(options: PrepareOptions): Promise<void> {
-  const laneFile = path.resolve(process.cwd(), options.addTask!);
+  const laneFile = path.resolve(process.cwd(), options.addTask!); // nosemgrep
   
   if (options.taskSpecs.length === 0) {
     throw new Error('No task specified. Use --task "name|model|prompt|criteria" to define a task.');
@@ -708,7 +732,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
   const now = new Date();
   const timestamp = now.toISOString().replace(/[-T:]/g, '').substring(2, 12);
   const taskDirName = `${timestamp}_${options.featureName}`;
-  const taskDir = path.join(tasksBaseDir, taskDirName);
+  const taskDir = safeJoin(tasksBaseDir, taskDirName);
 
   if (fs.existsSync(taskDir) && !options.force) {
     throw new Error(`Task directory already exists: ${taskDir}. Use --force to overwrite.`);
@@ -723,12 +747,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
   // Load template if provided (overrides --prompt/--task/--preset)
   let template = null;
   if (options.template) {
-    const templatePath = path.resolve(process.cwd(), options.template);
-    if (!fs.existsSync(templatePath)) {
-      throw new Error(`Template file not found: ${templatePath}`);
-    }
-    template = JSON.parse(fs.readFileSync(templatePath, 'utf8'));
-    logger.info(`Using template: ${options.template}`);
+    template = await resolveTemplate(options.template);
   }
 
   // Calculate dependencies
@@ -741,7 +760,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
   for (let i = 1; i <= options.lanes; i++) {
     const laneName = `lane-${i}`;
     const fileName = `${i.toString().padStart(2, '0')}-${laneName}.json`;
-    const filePath = path.join(taskDir, fileName);
+    const filePath = safeJoin(taskDir, fileName);
     
     const depNums = dependencyMap.get(i) || [];
     const dependsOn = depNums.map(n => {
@@ -788,7 +807,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
   }
 
   // Create README
-  const readmePath = path.join(taskDir, 'README.md');
+  const readmePath = safeJoin(taskDir, 'README.md');
   const readme = `# Task: ${options.featureName}
 
 Prepared at: ${now.toISOString()}