fix(cli): wire up --template flag so advertised templates actually apply - #12
Open
jodunk wants to merge 1 commit into
Open
fix(cli): wire up --template flag so advertised templates actually apply#12jodunk wants to merge 1 commit into
jodunk wants to merge 1 commit into
Conversation
The README advertised `npx create-auto-co my-saas --template saas` with three templates (saas, docs-site, api-backend), and those template files (template.conf, mission.md, consensus-next-action.md) ship in the repo -- but init() only took a project name, so `--template` was silently dropped and users got the generic scaffold regardless of the flag. False advertising on the primary install path. Fix: parse `--template`, read the chosen template's conf, inject its mission into the cloned CLAUDE.md, and use its consensus Next Action + Product label for Day 0. The template's EXTRA_DIRS are created AFTER the metaFiles cleanup (so a declared dir like projects/landing isn't deleted by the existing landing-project removal). templates/ is then cleaned from the scaffold like the other meta files. REPO is now overridable via AUTO_CO_REPO so the flag can be exercised against a local clone in tests. Adds tests/test-cli-template.sh (self-contained: stubs `claude`, clones the repo as a stand-in origin) asserting the saas template lands its mission, Next Action, extra dirs, and cleanup -- 5/5. Runnable standalone; picked up by run-all.sh once that harness lands. Co-Authored-By: Claude <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe CLI now accepts templates during project initialization, applies template configuration to scaffolded files and directories, removes template sources, and records template metadata. Documentation and a regression test cover the new scaffolding behavior. ChangesTemplate scaffolding
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Developer
participant AutoCoCLI
participant Repository
participant Scaffold
Developer->>AutoCoCLI: initialize project with --template
AutoCoCLI->>Repository: clone repository
AutoCoCLI->>Repository: read template.conf
Repository-->>AutoCoCLI: template mission and metadata
AutoCoCLI->>Scaffold: update CLAUDE.md and consensus
AutoCoCLI->>Scaffold: remove templates and create extra directories
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
tests/test-cli-template.sh (1)
48-56: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAssert the configured Product label.
DESCRIPTION→Company State > Productis part of this change, but this test never checks it. Read the expectedDESCRIPTIONfrom the source template (or use a fixed expected value) and assert it appears inmemories/consensus.md.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test-cli-template.sh` around lines 48 - 56, Extend the CLI template test around the existing consensus assertions to verify the configured Product label from DESCRIPTION appears in $P/memories/consensus.md. Read the expected value from the source template or use the change’s fixed expected label, then assert its presence without altering the existing scaffold checks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cli/bin/auto-co.js`:
- Around line 214-217: Validate each path in the tpl.extraDirs loop before
calling mkdirSync: reject absolute paths and resolve it against target, ensuring
the resolved directory remains beneath the target scaffold root. Only create
directories that pass both checks, using the validated resolved path rather than
the raw template value.
- Line 330: The init argument parsing must ignore the --template option and its
value when selecting the project name. Update the init handling at
cli/bin/auto-co.js lines 330-330 and unknown-argument handling at
cli/bin/auto-co.js lines 356-356 to derive the name from the first non-template
positional argument, while preserving optional-name behavior.
- Line 8: Update the clone invocation in the auto-co startup flow to avoid
interpolating REPO into a shell command. Use the existing spawn or spawnSync API
with git clone arguments passed as an array, preserving AUTO_CO_REPO as a
literal repository URL and keeping the current command behavior.
---
Nitpick comments:
In `@tests/test-cli-template.sh`:
- Around line 48-56: Extend the CLI template test around the existing consensus
assertions to verify the configured Product label from DESCRIPTION appears in
$P/memories/consensus.md. Read the expected value from the source template or
use the change’s fixed expected label, then assert its presence without altering
the existing scaffold checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: cf383086-989b-4f1d-be39-e5ea98b2929a
📒 Files selected for processing (3)
README.mdcli/bin/auto-co.jstests/test-cli-template.sh
|
|
||
| const VERSION = "1.1.1"; | ||
| const REPO = "https://github.com/NikitaDmitrieff/auto-co-meta.git"; | ||
| const REPO = process.env.AUTO_CO_REPO || "https://github.com/NikitaDmitrieff/auto-co-meta.git"; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
ast-grep outline cli/bin/auto-co.js --items all
ast-grep run --pattern 'function run($$$) { $$$ }' --lang javascript cli/bin/auto-co.js
rg -nP -C3 '^(?:function\s+run\b|const\s+run\s*=|let\s+run\s*=|import\s+.*\brun\b)|git clone --depth 1|AUTO_CO_REPO' cli/bin/auto-co.jsRepository: NikitaDmitrieff/auto-co-meta
Length of output: 2205
🏁 Script executed:
#!/bin/bash
set -euo pipefail
node - <<'JS'
const { spawnSync } = require("child_process");
const targets = [
"/tmp/injection-safe-dir",
`"; git status; ls > /tmp/auto-co-injection-marker", "bad-name`,
`", git status; ls > /tmp/auto-co-injection-marker", "bad-name`
];
console.log("command_string_simulation_results");
for (const repo of targets) {
try {
const { status, stdout, stderr } = spawnSync("/bin/bash", ["-c", `git clone --depth 1 ${repo} "/dev/null"`], { stdio: ["ignore", "pipe", "pipe"], timeout: 5000 });
console.log(JSON.stringify({
repo,
status,
stdout: stdout?.toString().slice(0, 120),
stderr: stderr?.toString().slice(0, 240),
marked: require("fs").existsSync("/tmp/auto-co-injection-marker")
}));
} catch (e) {
console.log(`repo:${JSON.stringify(repo)}_error:${e.message}`);
}
}
console.log("\nargument_array_safe_simulation_results");
for (const repo of targets) {
const target = "/tmp/injection-safe-dir";
try {
const { status, stdout, stderr } = spawnSync("git", ["clone", "--depth", "1", repo, target], { stdio: ["ignore", "pipe", "pipe"], timeout: 5000 });
console.log(JSON.stringify({
repo,
status,
stdout: stdout?.toString().slice(0, 120),
stderr: stderr?.toString().slice(0, 240),
marked: require("fs").existsSync("/tmp/auto-co-injection-marker")
}));
} catch (e) {
console.log(`repo:${JSON.stringify(repo)}_error:${e.message}`);
}
}
JS
printf '\nRelevant auto-co.js slice:\n'
sed -n '1,160p' cli/bin/auto-co.js
printf '\nRepository marker cleanup:\n'
rm -f /tmp/auto-co-injection-markerRepository: NikitaDmitrieff/auto-co-meta
Length of output: 7091
Pass the repository URL to git clone as an argument.
REPO is interpolated into a shell command via run(), so a crafted AUTO_CO_REPO can escape as shell syntax. Use the existing spawn import or spawnSync with an argument array so the URL cannot execute injected commands.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cli/bin/auto-co.js` at line 8, Update the clone invocation in the auto-co
startup flow to avoid interpolating REPO into a shell command. Use the existing
spawn or spawnSync API with git clone arguments passed as an array, preserving
AUTO_CO_REPO as a literal repository URL and keeping the current command
behavior.
Comment on lines
+214
to
+217
| // Template-declared dirs (created AFTER cleanup so metaFiles can't remove them). | ||
| for (const d of tpl.extraDirs) { | ||
| mkdirSync(resolve(target, d), { recursive: true }); | ||
| } |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Keep template paths inside the scaffold.
EXTRA_DIRS is used as a raw path, so ../outside or an absolute path can create directories outside target. Reject absolute paths and verify each resolved path remains beneath the scaffold root.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cli/bin/auto-co.js` around lines 214 - 217, Validate each path in the
tpl.extraDirs loop before calling mkdirSync: reject absolute paths and resolve
it against target, ensuring the resolved directory remains beneath the target
scaffold root. Only create directories that pass both checks, using the
validated resolved path rather than the raw template value.
| switch (cmd) { | ||
| case "init": | ||
| init(args[1]); | ||
| init(args[1], parseTemplateArg(args)); |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Do not treat --template as the project name.
Because the name is optional, auto-co init --template saas scaffolds ./--template; the direct invocation has the same failure. Derive the project name from the first non-template positional argument.
cli/bin/auto-co.js#L330-L330: exclude--templateand its value before selecting theinitname.cli/bin/auto-co.js#L356-L356: exclude template-option tokens before treating an unknown first argument as the project name.
📍 Affects 1 file
cli/bin/auto-co.js#L330-L330(this comment)cli/bin/auto-co.js#L356-L356
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@cli/bin/auto-co.js` at line 330, The init argument parsing must ignore the
--template option and its value when selecting the project name. Update the init
handling at cli/bin/auto-co.js lines 330-330 and unknown-argument handling at
cli/bin/auto-co.js lines 356-356 to derive the name from the first non-template
positional argument, while preserving optional-name behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
init()only took a project name, so--templatewas silently dropped:The README advertises three templates (
saas,docs-site,api-backend), and those template files (template.conf,mission.md,consensus-next-action.md) ship in the repo — but nothing in the CLI read them. Users got the generic scaffold regardless of the flag. False advertising on the primary install path, live onmaintoday.Fix
Parse
--template, then for the chosen template:template.conf(DESCRIPTION,EXTRA_DIRS)mission.mdinto the clonedCLAUDE.md## Missionsectionconsensus-next-action.mdas the Day-0## Next Action## Company State > ProductfromDESCRIPTIONEXTRA_DIRSafter the metaFiles cleanup (so a declared dir likeprojects/landingisn't deleted by the existing landing-project removal — this is the one non-obvious ordering point)templates/from the scaffold like the other meta filesREPOis now overridable viaAUTO_CO_REPOso the flag can be exercised against a local clone in tests.Test
tests/test-cli-template.sh— self-contained (stubsclaude, clones the repo as a stand-in origin). Asserts thesaastemplate lands its mission inCLAUDE.md, its Next Action inconsensus.md, createsprojects/app+projects/landing, and removestemplates/:Runnable standalone (
bash tests/test-cli-template.sh); auto-discovered byrun-all.shvia thetests/test-*.shglob once that harness lands. No overlap with the reliability PRs.Scope
cli/bin/auto-co.js— arg parsing + template application (+89)README.md— clarifies templates preconfigure mission + stack direction (agents build toward them), not an instant stack scaffoldtests/test-cli-template.sh— new regression guard🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
saas,docs-site, andapi-backend.AUTO_CO_REPOsupport for overriding the repository source.Documentation
Tests