Add source-agnostic template fetching for private template families

[next-devin]

What

campaign-init fetched starter-template source from one hardcoded public repo, so it couldn't scaffold template families hosted elsewhere (e.g. an outside, access-controlled repo). This adds a source-agnostic resolver + authenticated fetch — while keeping page-kit a generic build tool that holds no per-family knowledge.

Design

• lib/template-source.js (new) — resolveTemplateSource(overrides) overlays caller-supplied {repo, ref, source_path, private} on the public starter-templates default. Names no families, no private repos. As the trust boundary it validates shape (INVALID_SOURCE on bad repo / ref / traversing or non-POSIX source_path).
• lib/actions/init.js — new --source-repo / --source-ref / --source-path / --private flags.
  • Default (no flags): public starter-templates, anonymous — unchanged behavior.
  • --private: authenticated tarball (GITHUB_TOKEN/GH_TOKEN or gh auth token), skips the public picker, requires --template. Token dropped on the signed redirect (pinned to https + GitHub-owned hosts), never serialized.
  • Missing token → exit 5; malformed --source-* → exit 6.
  • extractTemplate honors source_path via path.posix.join (platform-independent), instead of hardcoding src/.

The opinionated part — which family lives in which private repo — stays in the orchestrating layer (campaigns-os / the operator's invocation), never in page-kit.

Verification

• --template <slug> --source-repo <owner/repo> --private → authenticated extract; name refined from campaigns.json.
• --private without a token → exit 5; bad --source-path → exit 6.
• Public --template <slug> with no flags → anonymous (unchanged).
• 208 tests green.

---

Supersedes #19 — identical net change, but presented as one clean commit instead of #19's build-then-refactor history. Pairs with campaigns-os#101 (the Arjuna recognition contracts; repo-agnostic).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Merge (minor gap)

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

All 8 issues from the previous review have been resolved by this commit:

• lib/template-source.js: both tarball URLs now take a plain ref (no refs/heads/ prefix), so a tag/SHA ref works on both and api.github.com no longer 404s on a refs/heads/... value. (WARNING x2 — fixed)
• lib/template-source.js: ai_context_doc_url is now always derived from the public default repo, so it can't 404 for a --private source. (SUGGESTION — fixed)
• lib/actions/init.js: AI-context URL is resolved lazily via aiContextDocUrl() instead of a module-load constant, so a future validation tightening can't turn an import into a hard module-load failure. (WARNING — fixed)
• lib/actions/init.js: gh auth token now runs with a 5s timeout; a wedged gh is treated as "no token" instead of hanging. (WARNING — fixed)
• lib/actions/init.js: the untrusted-redirect error now reports only the host, not the full signed URL. (SUGGESTION — fixed)
• test/init.test.js: new e2e test asserts fetchBufferAuthed drops the Authorization header when it follows the 302 to codeload. (SUGGESTION — fixed)

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
test/init.test.js	52	The new e2e test covers the trusted-redirect / drop-Authorization path, but the untrusted-redirect / reject path of fetchBufferAuthed is still only covered by the isTrustedGithubRedirect unit test. Consider adding a negative case to lock in the integration.

Files Reviewed (3 files)

• lib/actions/init.js - 0 issues (all 4 previous findings resolved: lazy AI-context URL, host-only redirect error, gh timeout)
• lib/template-source.js - 0 issues (all 3 previous findings resolved: plain ref in both tarball URLs, AI-context from public default)
• test/init.test.js - 1 issue (drop-Authorization e2e test added; untrusted-redirect negative case still missing)
• test/template-source.test.js - 0 issues (assertions updated to match plain-ref tarball URLs; positive coverage of tag/SHA/plain-ref shapes)

Fix these issues in Kilo Cloud

Previous Review Summary (commit 329010e)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 329010e)

Status: 8 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	4
SUGGESTION	4

The PR cleanly adds a source-agnostic resolver + authenticated tarball fetch, with a strong trust boundary in lib/template-source.js and a host-pinned redirect check in isTrustedGithubRedirect. The main risks are around URL-shape inconsistencies between the public and authenticated tarball endpoints, a module-load-time side effect in init.js, and a couple of secondary hardening gaps.

Issue Details (click to expand)

WARNING

File	Line	Issue
lib/template-source.js	95	tarball_url_anonymous hardcodes refs/heads/${ref} but ref validation accepts tags/SHAs/refs/heads/... — URL is misleading and inconsistent with the validator.
lib/template-source.js	93	tarball_url_authenticated uses api.github.com/repos/{repo}/tarball/{ref} which does NOT accept the refs/heads/... form; passing one with --private will 404.
lib/actions/init.js	31	AI_CONTEXT_DOC_URL is evaluated at module-load time; a future tightening of resolveTemplateSource validation could hard-fail the whole module, and tests cannot influence it.
lib/actions/init.js	187	execSync('gh auth token', ...) has no timeout — a hung gh (locked keyring, slow credential helper) blocks the entire campaign-init invocation.

SUGGESTION

File	Line	Issue
lib/template-source.js	96	ai_context_doc_url is built from rawBase even for private sources, where the URL will 404. Resolve from defaults unconditionally.
lib/actions/init.js	156	Error message echoes the full redirect URL into thrown errors; consider logging only the host.
lib/actions/init.js	714	Synthetic pickedTemplate.description interpolates source.repo; low risk given validation, but a sentinel constant would harden the trust boundary.
test/init.test.js	26	isTrustedGithubRedirect is unit-tested in isolation, but the end-to-end redirect-strips-Authorization behavior of fetchBufferAuthed is not asserted.

Files Reviewed (3 files)

• lib/actions/init.js - 5 issues
• lib/template-source.js - 3 issues
• test/init.test.js - 1 issue
• test/template-source.test.js - 0 issues (no concerns; validation paths and override overlay are well covered)

Fix these issues in Kilo Cloud

---

_{Reviewed by minimax-m3 · 311,693 tokens}

[kilo-code-bot]

SUGGESTION: The new e2e test covers the trusted-redirect / drop-Authorization path, but the untrusted-redirect / reject path of fetchBufferAuthed is still only covered by the isTrustedGithubRedirect unit test. Consider adding a negative case (e.g. a 302 to https://attacker.example/... asserting the promise rejects with the "untrusted host" error) to lock in the integration of the trust check with the authed fetch helper.

---

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

[alexphelps]

This feature was done in #21

[next-devin]

Closing — superseded by #21 (merged, v0.2.0), which solves this more completely and is the canonical mechanism now. Named sources in _data/template-sources.json (git + local types), selected via --source <name>, using ambient SSH keys. That's the cleaner layering this PR was reaching for — the source config lives in the consuming repo, page-kit stays agnostic — and it drops the token/tarball/redirect-pinning machinery entirely (SSH git clone instead of an authenticated api.github.com tarball). Adopting #21's mechanism for the Arjuna/Adsbranded use case.