flowsh-cli 0.4.0__tar.gz → 0.4.2__tar.gz

{flowsh_cli-0.4.0 → flowsh_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowsh-cli
-Version: 0.4.0
+Version: 0.4.2
 Summary: Generate Bash harness scripts from workflow YAML files.
 License-Expression: MIT
 Classifier: Programming Language :: Python :: 3.11

{flowsh_cli-0.4.0 → flowsh_cli-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "uv_build"
 
 [project]
 name = "flowsh-cli"
-version = "0.4.0"
+version = "0.4.2"
 description = "Generate Bash harness scripts from workflow YAML files."
 readme = "README.md"
 requires-python = ">=3.11"

{flowsh_cli-0.4.0 → flowsh_cli-0.4.2}/src/flowsh_cli/__init__.py

@@ -3,7 +3,7 @@
 from flowsh_cli.models import Workflow, WorkflowParseError, parse_workflows
 from flowsh_cli.render import harness_path, render_harness
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"
 
 __all__ = [
     "Workflow",

{flowsh_cli-0.4.0 → flowsh_cli-0.4.2}/src/flowsh_cli/models.py

@@ -73,7 +73,14 @@ class BashStep(BaseStep):
 
 class AgentStep(BaseStep):
     type: Literal["agent"]
-    prompt: str
+    prompt: str = Field(
+        description=(
+            "The prompt text sent to the agent. "
+            "May contain markdown, code fences, backticks, $(...), and other shell syntax freely — "
+            "the prompt is never passed through a shell. "
+            "Use expandPrompt: true to substitute ${VAR} / $VAR tokens from vars steps."
+        )
+    )
     agent: str | None = None
     model: str | None = None
     command: str | None = None
@@ -84,7 +91,17 @@ class AgentStep(BaseStep):
             "dangerously-skip-permissions",
         ),
     )
-    expandPrompt: bool = False
+    expandPrompt: bool = Field(
+        default=False,
+        description=(
+            "When true, substitutes ${VAR} and $VAR tokens from vars steps into the prompt "
+            "at runtime using safe plain-text replacement. "
+            "Shell expressions such as $(cmd), `cmd`, $((expr)), and globs are NOT evaluated — "
+            "they pass through to the agent literally. "
+            "Only uppercase variable names matching [A-Z_][A-Z0-9_]* found in the prompt text "
+            "are replaced. All other shell syntax in the prompt is safe to use."
+        ),
+    )
 
     @model_validator(mode="before")
     @classmethod

{flowsh_cli-0.4.0 → flowsh_cli-0.4.2}/src/flowsh_cli/render.py

@@ -257,16 +257,25 @@ def render_step(index: int, step: Step, used_function_names: set[str] | None = N
         )
     elif isinstance(step, AgentStep):
         delimiter = heredoc_delimiter("PROMPT", step.prompt)
-        heredoc = f"<<{delimiter}" if step.expandPrompt else f"<<'{delimiter}'"
         lines.extend(
             [
                 "  local prompt",
-                f"  prompt=$(cat {heredoc}",
+                f"  prompt=$(cat <<'{delimiter}'",
                 *step.prompt.splitlines(),
                 delimiter,
                 "  )",
             ]
         )
+        if step.expandPrompt:
+            braced = re.findall(r"\$\{([A-Z_][A-Z0-9_]*)\}", step.prompt)
+            bare = re.findall(r"\$([A-Z_][A-Z0-9_]*)(?!\w)", step.prompt)
+            seen: dict[str, None] = {}
+            for var in braced + bare:
+                seen[var] = None
+            for var in seen:
+                lines.append(f'  _p=\'${{{var}}}\'; prompt="${{prompt//"$_p"/"${var}"}}"')
+                lines.append(f'  _p=\'${var}\'; prompt="${{prompt//"$_p"/"${var}"}}"')
+
         lines.append(f"  local agent={bash_quote(step.agent or '')}")
         lines.append(f"  local model={bash_quote(step.model or '')}")
         lines.append(f"  local command={bash_quote(step.command or '')}")