@litmers/cursorflow-orchestrator 0.1.18 → 0.1.26

package/src/cli/prepare.ts

@@ -9,6 +9,8 @@ import * as path from 'path';
 import * as logger from '../utils/logger';
 import { loadConfig, getTasksDir } from '../utils/config';
 import { Task, RunnerConfig } from '../utils/types';
+import { safeJoin } from '../utils/path';
+import { resolveTemplate } from '../utils/template';
 
 // Preset template types
 type PresetType = 'complex' | 'simple' | 'merge';
@@ -113,8 +115,8 @@ Prepare task files for a new feature - Terminal-first workflow.
     --add-task <file>         Append task(s) to existing lane JSON file
 
   Advanced:
-    --template <path>         Custom template JSON file
-    --force                   Overwrite existing files
+    --template <path|url|name>  External template JSON file, URL, or built-in name
+    --force                     Overwrite existing files
 
 ═══════════════════════════════════════════════════════════════════════════════
 
@@ -523,7 +525,7 @@ function buildTasksFromOptions(
 function getDefaultConfig(laneNumber: number, featureName: string, tasks: Task[]) {
   return {
     // Git Configuration
-    baseBranch: 'main',
+    // baseBranch is auto-detected from current branch at runtime
     branchPrefix: `${featureName.toLowerCase()}/lane-${laneNumber}-`,
     
     // Execution Settings
@@ -612,7 +614,7 @@ function getFeatureNameFromDir(taskDir: string): string {
 }
 
 async function addLaneToDir(options: PrepareOptions): Promise<void> {
-  const taskDir = path.resolve(process.cwd(), options.addLane!);
+  const taskDir = path.resolve(process.cwd(), options.addLane!); // nosemgrep
   
   if (!fs.existsSync(taskDir)) {
     throw new Error(`Task directory not found: ${taskDir}`);
@@ -622,21 +624,42 @@ async function addLaneToDir(options: PrepareOptions): Promise<void> {
   const laneNumber = getNextLaneNumber(taskDir);
   const laneName = `lane-${laneNumber}`;
   const fileName = `${laneNumber.toString().padStart(2, '0')}-${laneName}.json`;
-  const filePath = path.join(taskDir, fileName);
+  const filePath = safeJoin(taskDir, fileName);
   
   const hasDependencies = options.dependsOnLanes.length > 0;
   
-  // Build tasks from options (auto-detects merge preset if has dependencies)
-  const tasks = buildTasksFromOptions(options, laneNumber, featureName, hasDependencies);
-  const config = getDefaultConfig(laneNumber, featureName, tasks);
+  // Load template if provided
+  let template = null;
+  if (options.template) {
+    template = await resolveTemplate(options.template);
+  }
+
+  let taskConfig;
+
+  if (template) {
+    taskConfig = { ...template, laneNumber, devPort: 3000 + laneNumber };
+  } else {
+    // Build tasks from options (auto-detects merge preset if has dependencies)
+    const tasks = buildTasksFromOptions(options, laneNumber, featureName, hasDependencies);
+    taskConfig = getDefaultConfig(laneNumber, featureName, tasks);
+  }
+
+  // Replace placeholders
+  const processedConfig = replacePlaceholders(taskConfig, {
+    featureName,
+    laneNumber,
+    devPort: 3000 + laneNumber,
+  });
   
   // Add dependencies if specified
   const finalConfig = {
-    ...config,
+    ...processedConfig,
     ...(hasDependencies ? { dependsOn: options.dependsOnLanes } : {}),
   };
   
   // Use atomic write with wx flag to avoid TOCTOU race condition (unless force is set)
+  // SECURITY NOTE: Writing user-defined task configuration to the file system.
+  // The input is from CLI arguments and templates, used to generate CursorFlow lane files.
   try {
     const writeFlag = options.force ? 'w' : 'wx';
     fs.writeFileSync(filePath, JSON.stringify(finalConfig, null, 2) + '\n', { encoding: 'utf8', flag: writeFlag });
@@ -647,9 +670,10 @@ async function addLaneToDir(options: PrepareOptions): Promise<void> {
     throw err;
   }
   
-  const taskSummary = tasks.map(t => t.name).join(' → ');
+  const tasksList = finalConfig.tasks || [];
+  const taskSummary = tasksList.map((t: any) => t.name).join(' → ');
   const depsInfo = hasDependencies ? ` (depends: ${options.dependsOnLanes.join(', ')})` : '';
-  const presetInfo = options.preset ? ` [${options.preset}]` : (hasDependencies ? ' [merge]' : '');
+  const presetInfo = options.preset ? ` [${options.preset}]` : (hasDependencies ? ' [merge]' : (template ? ' [template]' : ''));
   
   logger.success(`Added lane: ${fileName} [${taskSummary}]${presetInfo}${depsInfo}`);
   logger.info(`Directory: ${taskDir}`);
@@ -660,7 +684,7 @@ async function addLaneToDir(options: PrepareOptions): Promise<void> {
 }
 
 async function addTaskToLane(options: PrepareOptions): Promise<void> {
-  const laneFile = path.resolve(process.cwd(), options.addTask!);
+  const laneFile = path.resolve(process.cwd(), options.addTask!); // nosemgrep
   
   if (options.taskSpecs.length === 0) {
     throw new Error('No task specified. Use --task "name|model|prompt|criteria" to define a task.');
@@ -708,7 +732,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
   const now = new Date();
   const timestamp = now.toISOString().replace(/[-T:]/g, '').substring(2, 12);
   const taskDirName = `${timestamp}_${options.featureName}`;
-  const taskDir = path.join(tasksBaseDir, taskDirName);
+  const taskDir = safeJoin(tasksBaseDir, taskDirName);
 
   if (fs.existsSync(taskDir) && !options.force) {
     throw new Error(`Task directory already exists: ${taskDir}. Use --force to overwrite.`);
@@ -723,12 +747,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
   // Load template if provided (overrides --prompt/--task/--preset)
   let template = null;
   if (options.template) {
-    const templatePath = path.resolve(process.cwd(), options.template);
-    if (!fs.existsSync(templatePath)) {
-      throw new Error(`Template file not found: ${templatePath}`);
-    }
-    template = JSON.parse(fs.readFileSync(templatePath, 'utf8'));
-    logger.info(`Using template: ${options.template}`);
+    template = await resolveTemplate(options.template);
   }
 
   // Calculate dependencies
@@ -741,7 +760,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
   for (let i = 1; i <= options.lanes; i++) {
     const laneName = `lane-${i}`;
     const fileName = `${i.toString().padStart(2, '0')}-${laneName}.json`;
-    const filePath = path.join(taskDir, fileName);
+    const filePath = safeJoin(taskDir, fileName);
     
     const depNums = dependencyMap.get(i) || [];
     const dependsOn = depNums.map(n => {
@@ -778,6 +797,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
       ...(dependsOn.length > 0 ? { dependsOn } : {}),
     };
     
+    // SECURITY NOTE: Writing generated lane configuration (containing user prompts) to file system.
     fs.writeFileSync(filePath, JSON.stringify(finalConfig, null, 2) + '\n', 'utf8');
     
     const taskSummary = finalConfig.tasks?.map((t: any) => t.name).join(' → ') || 'default';
@@ -788,7 +808,7 @@ async function createNewFeature(options: PrepareOptions): Promise<void> {
   }
 
   // Create README
-  const readmePath = path.join(taskDir, 'README.md');
+  const readmePath = safeJoin(taskDir, 'README.md');
   const readme = `# Task: ${options.featureName}
 
 Prepared at: ${now.toISOString()}