claudekit-cli 1.2.2 → 1.4.0

package/dist/index.js

@@ -5800,11 +5800,6 @@ var require_ignore = __commonJS((exports, module) => {
   }
 });
 
-// src/index.ts
-import { readFileSync } from "fs";
-import { join as join6 } from "path";
-import { fileURLToPath } from "url";
-
 // node_modules/cac/dist/index.mjs
 import { EventEmitter } from "events";
 function toArr(any) {
@@ -6405,10 +6400,70 @@ class CAC extends EventEmitter {
   }
 }
 var cac = (name = "") => new CAC(name);
+// package.json
+var package_default = {
+  name: "claudekit-cli",
+  version: "1.3.0",
+  description: "CLI tool for bootstrapping and updating ClaudeKit projects",
+  type: "module",
+  bin: {
+    ck: "./dist/index.js"
+  },
+  scripts: {
+    dev: "bun run src/index.ts >> logs.txt 2>&1",
+    build: "bun build src/index.ts --outdir dist --target node --external keytar --external @octokit/rest >> logs.txt 2>&1",
+    compile: "bun build src/index.ts --compile --outfile ck >> logs.txt 2>&1",
+    test: "bun test >> logs.txt 2>&1",
+    "test:watch": "bun test --watch >> logs.txt 2>&1",
+    lint: "biome check . >> logs.txt 2>&1",
+    format: "biome format --write . >> logs.txt 2>&1",
+    typecheck: "tsc --noEmit >> logs.txt 2>&1"
+  },
+  keywords: [
+    "cli",
+    "claudekit",
+    "boilerplate",
+    "bootstrap",
+    "template"
+  ],
+  author: "ClaudeKit",
+  license: "MIT",
+  engines: {
+    bun: ">=1.0.0"
+  },
+  dependencies: {
+    "@clack/prompts": "^0.7.0",
+    "@octokit/rest": "^22.0.0",
+    cac: "^6.7.14",
+    "cli-progress": "^3.12.0",
+    "extract-zip": "^2.0.1",
+    "fs-extra": "^11.2.0",
+    ignore: "^5.3.2",
+    keytar: "^7.9.0",
+    ora: "^9.0.0",
+    picocolors: "^1.1.1",
+    tar: "^7.4.3",
+    tmp: "^0.2.3",
+    zod: "^3.23.8"
+  },
+  devDependencies: {
+    "@biomejs/biome": "^1.9.4",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@types/bun": "latest",
+    "@types/cli-progress": "^3.11.6",
+    "@types/fs-extra": "^11.0.4",
+    "@types/node": "^22.10.1",
+    "@types/tar": "^6.1.13",
+    "@types/tmp": "^0.2.6",
+    "semantic-release": "^24.2.0",
+    typescript: "^5.7.2"
+  }
+};
 
 // src/commands/new.ts
 var import_fs_extra2 = __toESM(require_lib(), 1);
-import { resolve } from "node:path";
+import { resolve as resolve2 } from "node:path";
 
 // src/lib/auth.ts
 import { execSync } from "node:child_process";
@@ -10927,15 +10982,19 @@ var coerce = {
 var NEVER = INVALID;
 // src/types.ts
 var KitType = exports_external.enum(["engineer", "marketing"]);
+var ExcludePatternSchema = exports_external.string().trim().min(1, "Exclude pattern cannot be empty").max(500, "Exclude pattern too long").refine((val) => !val.startsWith("/"), "Absolute paths not allowed in exclude patterns").refine((val) => !val.includes(".."), "Path traversal not allowed in exclude patterns");
 var NewCommandOptionsSchema = exports_external.object({
   dir: exports_external.string().default("."),
   kit: KitType.optional(),
-  version: exports_external.string().optional()
+  version: exports_external.string().optional(),
+  force: exports_external.boolean().default(false),
+  exclude: exports_external.array(ExcludePatternSchema).optional().default([])
 });
 var UpdateCommandOptionsSchema = exports_external.object({
   dir: exports_external.string().default("."),
   kit: KitType.optional(),
-  version: exports_external.string().optional()
+  version: exports_external.string().optional(),
+  exclude: exports_external.array(ExcludePatternSchema).optional().default([])
 });
 var VersionCommandOptionsSchema = exports_external.object({
   kit: KitType.optional(),
@@ -11328,7 +11387,7 @@ var import_ignore = __toESM(require_ignore(), 1);
 import { createWriteStream as createWriteStream2 } from "node:fs";
 import { mkdir as mkdir3 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join3, relative, resolve } from "node:path";
 
 // node_modules/@isaacs/fs-minipass/dist/esm/index.js
 import EE from "events";
@@ -21204,6 +21263,7 @@ function createSpinner(options) {
 
 // src/lib/download.ts
 class DownloadManager {
+  static MAX_EXTRACTION_SIZE = 500 * 1024 * 1024;
   static EXCLUDE_PATTERNS = [
     ".git",
     ".git/**",
@@ -21215,9 +21275,37 @@ class DownloadManager {
     "Thumbs.db",
     "*.log"
   ];
+  totalExtractedSize = 0;
+  ig;
+  userExcludePatterns = [];
+  constructor() {
+    this.ig = import_ignore.default().add(DownloadManager.EXCLUDE_PATTERNS);
+  }
+  setExcludePatterns(patterns) {
+    this.userExcludePatterns = patterns;
+    this.ig = import_ignore.default().add([...DownloadManager.EXCLUDE_PATTERNS, ...this.userExcludePatterns]);
+    if (patterns.length > 0) {
+      logger.info(`Added ${patterns.length} custom exclude pattern(s)`);
+      patterns.forEach((p) => logger.debug(`  - ${p}`));
+    }
+  }
   shouldExclude(filePath) {
-    const ig = import_ignore.default().add(DownloadManager.EXCLUDE_PATTERNS);
-    return ig.ignores(filePath);
+    return this.ig.ignores(filePath);
+  }
+  isPathSafe(basePath, targetPath) {
+    const resolvedBase = resolve(basePath);
+    const resolvedTarget = resolve(targetPath);
+    const relativePath = relative(resolvedBase, resolvedTarget);
+    return !relativePath.startsWith("..") && !relativePath.startsWith("/") && resolvedTarget.startsWith(resolvedBase);
+  }
+  checkExtractionSize(fileSize) {
+    this.totalExtractedSize += fileSize;
+    if (this.totalExtractedSize > DownloadManager.MAX_EXTRACTION_SIZE) {
+      throw new ExtractionError(`Archive exceeds maximum extraction size of ${this.formatBytes(DownloadManager.MAX_EXTRACTION_SIZE)}. Possible archive bomb detected.`);
+    }
+  }
+  resetExtractionSize() {
+    this.totalExtractedSize = 0;
   }
   async downloadAsset(asset, destDir) {
     try {
@@ -21328,6 +21416,7 @@ class DownloadManager {
   async extractArchive(archivePath, destDir, archiveType) {
     const spinner = createSpinner("Extracting files...").start();
     try {
+      this.resetExtractionSize();
       const detectedType = archiveType || this.detectArchiveType(archivePath);
       await mkdir3(destDir, { recursive: true });
       if (detectedType === "tar.gz") {
@@ -21398,8 +21487,8 @@ class DownloadManager {
     }
   }
   isWrapperDirectory(dirName) {
-    const versionPattern = /^[\w-]+-v?\d+\.\d+\.\d+/;
-    const hashPattern = /^[\w-]+-[a-f0-9]{7,}$/;
+    const versionPattern = /^[\w-]+-v?\d+\.\d+\.\d+(-[\w.]+)?$/;
+    const hashPattern = /^[\w-]+-[a-f0-9]{7,40}$/;
     return versionPattern.test(dirName) || hashPattern.test(dirName);
   }
   async extractZip(archivePath, destDir) {
@@ -21447,13 +21536,17 @@ class DownloadManager {
   }
   async moveDirectoryContents(sourceDir, destDir) {
     const { readdir, stat, mkdir: mkdirPromise, copyFile } = await import("node:fs/promises");
-    const { join: pathJoin, relative } = await import("node:path");
+    const { join: pathJoin, relative: relative2 } = await import("node:path");
     await mkdirPromise(destDir, { recursive: true });
     const entries = await readdir(sourceDir);
     for (const entry of entries) {
       const sourcePath = pathJoin(sourceDir, entry);
       const destPath = pathJoin(destDir, entry);
-      const relativePath = relative(sourceDir, sourcePath);
+      const relativePath = relative2(sourceDir, sourcePath);
+      if (!this.isPathSafe(destDir, destPath)) {
+        logger.warning(`Skipping unsafe path: ${relativePath}`);
+        throw new ExtractionError(`Path traversal attempt detected: ${relativePath}`);
+      }
       if (this.shouldExclude(relativePath)) {
         logger.debug(`Excluding: ${relativePath}`);
         continue;
@@ -21462,19 +21555,24 @@ class DownloadManager {
       if (entryStat.isDirectory()) {
         await this.copyDirectory(sourcePath, destPath);
       } else {
+        this.checkExtractionSize(entryStat.size);
         await copyFile(sourcePath, destPath);
       }
     }
   }
   async copyDirectory(sourceDir, destDir) {
     const { readdir, stat, mkdir: mkdirPromise, copyFile } = await import("node:fs/promises");
-    const { join: pathJoin, relative } = await import("node:path");
+    const { join: pathJoin, relative: relative2 } = await import("node:path");
     await mkdirPromise(destDir, { recursive: true });
     const entries = await readdir(sourceDir);
     for (const entry of entries) {
       const sourcePath = pathJoin(sourceDir, entry);
       const destPath = pathJoin(destDir, entry);
-      const relativePath = relative(sourceDir, sourcePath);
+      const relativePath = relative2(sourceDir, sourcePath);
+      if (!this.isPathSafe(destDir, destPath)) {
+        logger.warning(`Skipping unsafe path: ${relativePath}`);
+        throw new ExtractionError(`Path traversal attempt detected: ${relativePath}`);
+      }
       if (this.shouldExclude(relativePath)) {
         logger.debug(`Excluding: ${relativePath}`);
         continue;
@@ -21483,6 +21581,7 @@ class DownloadManager {
       if (entryStat.isDirectory()) {
         await this.copyDirectory(sourcePath, destPath);
       } else {
+        this.checkExtractionSize(entryStat.size);
         await copyFile(sourcePath, destPath);
       }
     }
@@ -21504,22 +21603,28 @@ class DownloadManager {
       const entries = await readdir(extractDir);
       logger.debug(`Extracted files: ${entries.join(", ")}`);
       if (entries.length === 0) {
-        logger.warning("Extraction resulted in no files");
-        return false;
+        throw new ExtractionError("Extraction resulted in no files");
       }
       const criticalPaths = [".claude", "CLAUDE.md"];
+      const missingPaths = [];
       for (const path8 of criticalPaths) {
         try {
           await access(pathJoin(extractDir, path8), constants2.F_OK);
           logger.debug(`✓ Found: ${path8}`);
         } catch {
           logger.warning(`Expected path not found: ${path8}`);
+          missingPaths.push(path8);
         }
       }
-      return true;
+      if (missingPaths.length > 0) {
+        logger.warning(`Some expected paths are missing: ${missingPaths.join(", ")}. This may not be a ClaudeKit project.`);
+      }
+      logger.debug("Extraction validation passed");
     } catch (error2) {
-      logger.error(`Validation failed: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
-      return false;
+      if (error2 instanceof ExtractionError) {
+        throw error2;
+      }
+      throw new ExtractionError(`Validation failed: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
     }
   }
   async createTempDir() {
@@ -21679,7 +21784,7 @@ class GitHubClient {
 }
 
 // src/lib/merge.ts
-import { join as join4, relative } from "node:path";
+import { join as join4, relative as relative2 } from "node:path";
 var import_fs_extra = __toESM(require_lib(), 1);
 var import_ignore2 = __toESM(require_ignore(), 1);
 class FileMerger {
@@ -21705,7 +21810,7 @@ class FileMerger {
     const conflicts = [];
     const files = await this.getFiles(sourceDir);
     for (const file of files) {
-      const relativePath = relative(sourceDir, file);
+      const relativePath = relative2(sourceDir, file);
       if (this.ig.ignores(relativePath)) {
         continue;
       }
@@ -21721,7 +21826,7 @@ class FileMerger {
     let copiedCount = 0;
     let skippedCount = 0;
     for (const file of files) {
-      const relativePath = relative(sourceDir, file);
+      const relativePath = relative2(sourceDir, file);
       if (this.ig.ignores(relativePath)) {
         logger.debug(`Skipping protected file: ${relativePath}`);
         skippedCount++;
@@ -21859,27 +21964,42 @@ async function newCommand(options) {
   prompts.intro("\uD83D\uDE80 ClaudeKit - Create New Project");
   try {
     const validOptions = NewCommandOptionsSchema.parse(options);
+    const isNonInteractive = !process.stdin.isTTY || process.env.CI === "true" || process.env.NON_INTERACTIVE === "true";
     const config = await ConfigManager.get();
     let kit = validOptions.kit || config.defaults?.kit;
     if (!kit) {
+      if (isNonInteractive) {
+        throw new Error("Kit must be specified via --kit flag in non-interactive mode");
+      }
       kit = await prompts.selectKit();
     }
     const kitConfig = AVAILABLE_KITS[kit];
     logger.info(`Selected kit: ${kitConfig.name}`);
     let targetDir = validOptions.dir || config.defaults?.dir || ".";
     if (!validOptions.dir && !config.defaults?.dir) {
-      targetDir = await prompts.getDirectory(targetDir);
+      if (isNonInteractive) {
+        targetDir = ".";
+      } else {
+        targetDir = await prompts.getDirectory(targetDir);
+      }
     }
-    const resolvedDir = resolve(targetDir);
+    const resolvedDir = resolve2(targetDir);
     logger.info(`Target directory: ${resolvedDir}`);
     if (await import_fs_extra2.pathExists(resolvedDir)) {
       const files = await import_fs_extra2.readdir(resolvedDir);
       const isEmpty = files.length === 0;
       if (!isEmpty) {
-        const continueAnyway = await prompts.confirm("Directory is not empty. Files may be overwritten. Continue?");
-        if (!continueAnyway) {
-          logger.warning("Operation cancelled");
-          return;
+        if (isNonInteractive) {
+          if (!validOptions.force) {
+            throw new Error("Directory is not empty. Use --force flag to overwrite in non-interactive mode");
+          }
+          logger.info("Directory is not empty. Proceeding with --force flag");
+        } else {
+          const continueAnyway = await prompts.confirm("Directory is not empty. Files may be overwritten. Continue?");
+          if (!continueAnyway) {
+            logger.warning("Operation cancelled");
+            return;
+          }
         }
       }
     }
@@ -21905,6 +22025,9 @@ async function newCommand(options) {
     logger.info(`Download source: ${downloadInfo.type}`);
     logger.debug(`Download URL: ${downloadInfo.url}`);
     const downloadManager = new DownloadManager;
+    if (validOptions.exclude && validOptions.exclude.length > 0) {
+      downloadManager.setExcludePatterns(validOptions.exclude);
+    }
     const tempDir = await downloadManager.createTempDir();
     const { token } = await AuthManager.getToken();
     let archivePath;
@@ -21940,6 +22063,9 @@ async function newCommand(options) {
     await downloadManager.extractArchive(archivePath, extractDir);
     await downloadManager.validateExtraction(extractDir);
     const merger = new FileMerger;
+    if (validOptions.exclude && validOptions.exclude.length > 0) {
+      merger.addIgnorePatterns(validOptions.exclude);
+    }
     await merger.merge(extractDir, resolvedDir, true);
     prompts.outro(`✨ Project created successfully at ${resolvedDir}`);
     prompts.note(`cd ${targetDir !== "." ? targetDir : "into the directory"}
@@ -21953,11 +22079,11 @@ bun run dev`, "Next steps");
 
 // src/commands/update.ts
 var import_fs_extra4 = __toESM(require_lib(), 1);
-import { resolve as resolve3 } from "node:path";
+import { resolve as resolve4 } from "node:path";
 
 // src/utils/file-scanner.ts
 var import_fs_extra3 = __toESM(require_lib(), 1);
-import { join as join5, relative as relative2, resolve as resolve2 } from "node:path";
+import { join as join5, relative as relative3, resolve as resolve3 } from "node:path";
 class FileScanner {
   static async getFiles(dirPath, relativeTo) {
     const basePath = relativeTo || dirPath;
@@ -21982,7 +22108,7 @@ class FileScanner {
           const subFiles = await FileScanner.getFiles(fullPath, basePath);
           files.push(...subFiles);
         } else if (stats.isFile()) {
-          const relativePath = relative2(basePath, fullPath);
+          const relativePath = relative3(basePath, fullPath);
           files.push(relativePath);
         }
       }
@@ -22010,8 +22136,8 @@ class FileScanner {
     return customFiles;
   }
   static isSafePath(basePath, targetPath) {
-    const resolvedBase = resolve2(basePath);
-    const resolvedTarget = resolve2(targetPath);
+    const resolvedBase = resolve3(basePath);
+    const resolvedTarget = resolve3(targetPath);
     return resolvedTarget.startsWith(resolvedBase);
   }
 }
@@ -22033,7 +22159,7 @@ async function updateCommand(options) {
     if (!validOptions.dir && !config.defaults?.dir) {
       targetDir = await prompts.getDirectory(targetDir);
     }
-    const resolvedDir = resolve3(targetDir);
+    const resolvedDir = resolve4(targetDir);
     logger.info(`Target directory: ${resolvedDir}`);
     if (!await import_fs_extra4.pathExists(resolvedDir)) {
       logger.error(`Directory does not exist: ${resolvedDir}`);
@@ -22062,6 +22188,9 @@ async function updateCommand(options) {
     logger.info(`Download source: ${downloadInfo.type}`);
     logger.debug(`Download URL: ${downloadInfo.url}`);
     const downloadManager = new DownloadManager;
+    if (validOptions.exclude && validOptions.exclude.length > 0) {
+      downloadManager.setExcludePatterns(validOptions.exclude);
+    }
     const tempDir = await downloadManager.createTempDir();
     const { token } = await AuthManager.getToken();
     let archivePath;
@@ -22103,6 +22232,9 @@ async function updateCommand(options) {
       merger.addIgnorePatterns(customClaudeFiles);
       logger.success(`Protected ${customClaudeFiles.length} custom .claude file(s)`);
     }
+    if (validOptions.exclude && validOptions.exclude.length > 0) {
+      merger.addIgnorePatterns(validOptions.exclude);
+    }
     await merger.merge(extractDir, resolvedDir, false);
     prompts.outro(`✨ Project updated successfully at ${resolvedDir}`);
     const protectedNote = customClaudeFiles.length > 0 ? `Your project has been updated with the latest version.
@@ -22317,21 +22449,26 @@ if (process.stdout.setEncoding) {
 if (process.stderr.setEncoding) {
   process.stderr.setEncoding("utf8");
 }
-var __dirname2 = fileURLToPath(new URL(".", import.meta.url));
-var packageJson = JSON.parse(readFileSync(join6(__dirname2, "../package.json"), "utf-8"));
+var packageVersion = package_default.version;
 var cli = cac("ck");
 cli.option("--verbose, -v", "Enable verbose logging for debugging");
 cli.option("--log-file <path>", "Write logs to file");
-cli.command("new", "Bootstrap a new ClaudeKit project").option("--dir <dir>", "Target directory (default: .)").option("--kit <kit>", "Kit to use (engineer, marketing)").option("--version <version>", "Specific version to download (default: latest)").action(async (options) => {
+cli.command("new", "Bootstrap a new ClaudeKit project").option("--dir <dir>", "Target directory (default: .)").option("--kit <kit>", "Kit to use (engineer, marketing)").option("--version <version>", "Specific version to download (default: latest)").option("--force", "Overwrite existing files without confirmation").option("--exclude <pattern>", "Exclude files matching glob pattern (can be used multiple times)").action(async (options) => {
+  if (options.exclude && !Array.isArray(options.exclude)) {
+    options.exclude = [options.exclude];
+  }
   await newCommand(options);
 });
-cli.command("update", "Update existing ClaudeKit project").option("--dir <dir>", "Target directory (default: .)").option("--kit <kit>", "Kit to use (engineer, marketing)").option("--version <version>", "Specific version to download (default: latest)").action(async (options) => {
+cli.command("update", "Update existing ClaudeKit project").option("--dir <dir>", "Target directory (default: .)").option("--kit <kit>", "Kit to use (engineer, marketing)").option("--version <version>", "Specific version to download (default: latest)").option("--exclude <pattern>", "Exclude files matching glob pattern (can be used multiple times)").action(async (options) => {
+  if (options.exclude && !Array.isArray(options.exclude)) {
+    options.exclude = [options.exclude];
+  }
   await updateCommand(options);
 });
 cli.command("versions", "List available versions of ClaudeKit repositories").option("--kit <kit>", "Filter by specific kit (engineer, marketing)").option("--limit <limit>", "Number of releases to show (default: 30)").option("--all", "Show all releases including prereleases").action(async (options) => {
   await versionCommand(options);
 });
-cli.version(packageJson.version);
+cli.version(packageVersion);
 cli.help();
 var parsed = cli.parse(process.argv, { run: false });
 var envVerbose = process.env.CLAUDEKIT_VERBOSE === "1" || process.env.CLAUDEKIT_VERBOSE === "true";
@@ -22343,7 +22480,7 @@ if (parsed.options.logFile) {
   logger2.setLogFile(parsed.options.logFile);
 }
 logger2.verbose("ClaudeKit CLI starting", {
-  version: packageJson.version,
+  version: packageVersion,
   command: parsed.args[0] || "none",
   options: parsed.options,
   cwd: process.cwd(),

package/package.json

@@ -1,20 +1,20 @@
 {
 	"name": "claudekit-cli",
-	"version": "1.2.2",
+	"version": "1.4.0",
 	"description": "CLI tool for bootstrapping and updating ClaudeKit projects",
 	"type": "module",
 	"bin": {
 		"ck": "./dist/index.js"
 	},
 	"scripts": {
-		"dev": "bun run src/index.ts",
-		"build": "bun build src/index.ts --outdir dist --target node --external unzipper --external keytar --external @octokit/rest",
-		"compile": "bun build src/index.ts --compile --outfile ck",
-		"test": "bun test",
-		"test:watch": "bun test --watch",
-		"lint": "biome check .",
-		"format": "biome format --write .",
-		"typecheck": "tsc --noEmit"
+		"dev": "bun run src/index.ts >> logs.txt 2>&1",
+		"build": "bun build src/index.ts --outdir dist --target node --external keytar --external @octokit/rest >> logs.txt 2>&1",
+		"compile": "bun build src/index.ts --compile --outfile ck >> logs.txt 2>&1",
+		"test": "bun test >> logs.txt 2>&1",
+		"test:watch": "bun test --watch >> logs.txt 2>&1",
+		"lint": "biome check . >> logs.txt 2>&1",
+		"format": "biome format --write . >> logs.txt 2>&1",
+		"typecheck": "tsc --noEmit >> logs.txt 2>&1"
 	},
 	"keywords": [
 		"cli",
@@ -53,7 +53,6 @@
 		"@types/node": "^22.10.1",
 		"@types/tar": "^6.1.13",
 		"@types/tmp": "^0.2.6",
-		"@types/unzipper": "^0.10.10",
 		"semantic-release": "^24.2.0",
 		"typescript": "^5.7.2"
 	}

package/src/commands/new.ts

@@ -19,12 +19,19 @@ export async function newCommand(options: NewCommandOptions): Promise<void> {
 		// Validate and parse options
 		const validOptions = NewCommandOptionsSchema.parse(options);
 
+		// Detect non-interactive mode
+		const isNonInteractive =
+			!process.stdin.isTTY || process.env.CI === "true" || process.env.NON_INTERACTIVE === "true";
+
 		// Load config for defaults
 		const config = await ConfigManager.get();
 
 		// Get kit selection
 		let kit = validOptions.kit || config.defaults?.kit;
 		if (!kit) {
+			if (isNonInteractive) {
+				throw new Error("Kit must be specified via --kit flag in non-interactive mode");
+			}
 			kit = await prompts.selectKit();
 		}
 
@@ -34,7 +41,11 @@ export async function newCommand(options: NewCommandOptions): Promise<void> {
 		// Get target directory
 		let targetDir = validOptions.dir || config.defaults?.dir || ".";
 		if (!validOptions.dir && !config.defaults?.dir) {
-			targetDir = await prompts.getDirectory(targetDir);
+			if (isNonInteractive) {
+				targetDir = ".";
+			} else {
+				targetDir = await prompts.getDirectory(targetDir);
+			}
 		}
 
 		const resolvedDir = resolve(targetDir);
@@ -45,12 +56,21 @@ export async function newCommand(options: NewCommandOptions): Promise<void> {
 			const files = await readdir(resolvedDir);
 			const isEmpty = files.length === 0;
 			if (!isEmpty) {
-				const continueAnyway = await prompts.confirm(
-					"Directory is not empty. Files may be overwritten. Continue?",
-				);
-				if (!continueAnyway) {
-					logger.warning("Operation cancelled");
-					return;
+				if (isNonInteractive) {
+					if (!validOptions.force) {
+						throw new Error(
+							"Directory is not empty. Use --force flag to overwrite in non-interactive mode",
+						);
+					}
+					logger.info("Directory is not empty. Proceeding with --force flag");
+				} else {
+					const continueAnyway = await prompts.confirm(
+						"Directory is not empty. Files may be overwritten. Continue?",
+					);
+					if (!continueAnyway) {
+						logger.warning("Operation cancelled");
+						return;
+					}
 				}
 			}
 		}
@@ -90,6 +110,12 @@ export async function newCommand(options: NewCommandOptions): Promise<void> {
 
 		// Download asset
 		const downloadManager = new DownloadManager();
+
+		// Apply user exclude patterns if provided
+		if (validOptions.exclude && validOptions.exclude.length > 0) {
+			downloadManager.setExcludePatterns(validOptions.exclude);
+		}
+
 		const tempDir = await downloadManager.createTempDir();
 
 		// Get authentication token for API requests
@@ -137,6 +163,12 @@ export async function newCommand(options: NewCommandOptions): Promise<void> {
 
 		// Copy files to target directory
 		const merger = new FileMerger();
+
+		// Apply user exclude patterns if provided
+		if (validOptions.exclude && validOptions.exclude.length > 0) {
+			merger.addIgnorePatterns(validOptions.exclude);
+		}
+
 		await merger.merge(extractDir, resolvedDir, true); // Skip confirmation for new projects
 
 		prompts.outro(`✨ Project created successfully at ${resolvedDir}`);

package/src/commands/update.ts

@@ -83,6 +83,12 @@ export async function updateCommand(options: UpdateCommandOptions): Promise<void
 
 		// Download asset
 		const downloadManager = new DownloadManager();
+
+		// Apply user exclude patterns if provided
+		if (validOptions.exclude && validOptions.exclude.length > 0) {
+			downloadManager.setExcludePatterns(validOptions.exclude);
+		}
+
 		const tempDir = await downloadManager.createTempDir();
 
 		// Get authentication token for API requests
@@ -141,6 +147,11 @@ export async function updateCommand(options: UpdateCommandOptions): Promise<void
 			logger.success(`Protected ${customClaudeFiles.length} custom .claude file(s)`);
 		}
 
+		// Apply user exclude patterns if provided
+		if (validOptions.exclude && validOptions.exclude.length > 0) {
+			merger.addIgnorePatterns(validOptions.exclude);
+		}
+
 		await merger.merge(extractDir, resolvedDir, false); // Show confirmation for updates
 
 		prompts.outro(`✨ Project updated successfully at ${resolvedDir}`);