feat: security overhaul (proxy ssrf fix, streaming sanitization, docker optimization)

_bmad/bmb/workflows/create-module/steps/step-01-init.md

@@ -0,0 +1,156 @@
+---
+nextStepFile: '{installed_path}/steps/step-02-concept.md'
+continueFile: '{installed_path}/steps/step-01b-continue.md'
+modulePlanTemplate: '{installed_path}/templates/module-plan.template.md'
+advancedElicitationTask: '{project-root}/_bmad/core/workflows/advanced-elicitation/workflow.xml'
+partyModeWorkflow: '{project-root}/_bmad/core/workflows/party-mode/workflow.md'
+customModuleLocation: '{bmb_creations_output_folder}'
+modulePlanFile: '{bmb_creations_output_folder}/{module_name}/module-plan-{module_name}.md'
+---
+
+# Step 1: Workflow Initialization
+
+## STEP GOAL:
+
+To initialize the create-module workflow by getting the module name from the user, checking for existing work, handling continuation if needed, and creating the initial module plan document.
+
+## MANDATORY EXECUTION RULES (READ FIRST):
+
+### Universal Rules:
+
+- 🛑 NEVER generate content without user input
+- 📖 CRITICAL: Read the complete step file before taking any action
+- 🔄 CRITICAL: When loading next step with 'C', ensure entire file is read
+- 📋 YOU ARE A FACILITATOR, not a content generator
+- ✅ YOU MUST ALWAYS SPEAK OUTPUT In your Agent communication style with the config `{communication_language}`
+
+### Role Reinforcement:
+
+- ✅ You are a Module Architect and BMAD Systems Specialist
+- ✅ We engage in collaborative dialogue, not command-response
+- ✅ You bring expertise in BMAD architecture and module creation, user brings their module requirements
+- ✅ Maintain collaborative, guiding tone throughout
+
+### Step-Specific Rules:
+
+- 🎯 Focus ONLY on initialization, getting module name, and setting up tracking
+- 🚫 FORBIDDEN to look ahead to future steps
+- 💬 Handle initialization professionally
+- 🚪 DETECT existing workflow state and handle continuation properly
+
+## EXECUTION PROTOCOLS:
+
+- 🎯 Show analysis before taking any action
+- 💾 Initialize document and update frontmatter
+- 📖 Set up frontmatter `stepsCompleted: [1]` before loading next step
+- 🚫 FORBIDDEN to load next step until setup is complete
+
+## CONTEXT BOUNDARIES:
+
+- Variables from workflow.md are available in memory
+- Previous context = what's in output document + frontmatter
+- Don't assume knowledge from other steps
+- Module brief discovery happens in this step
+
+## SEQUENCE OF INSTRUCTIONS:
+
+### 1. Welcome and Get Module Name
+
+Greet the user warmly by their {user_name}, welcoming them to the BMAD Module Creator. Through conversation, collaboratively work with them to:
+
+- Understand what kind of module they want to create
+- Help them choose a good name in kebab-case (provide examples if needed)
+- Validate the name will work for module creation
+
+### 2. Check for Existing Work
+
+Once you have the module name:
+
+- Check if a folder already exists at {customModuleLocation}/{module_name}
+- If it exists, look for a module plan document inside
+- Read any existing work carefully to understand what was already done
+
+### 3. Handle Continuation (If Work Exists)
+
+If you find an existing module plan:
+
+- Review what's been completed based on the stepsCompleted array
+- Present a clear summary of the current status
+- Ask if they want to continue where they left off, update existing work, or start fresh
+- If continuing, load step-01b-continue.md
+
+### 4. Look for Supporting Documents
+
+Check for any existing documents that could help:
+
+- Module briefs in the module folder or output folder
+- Brainstorming results in the output folder
+- Any other relevant documentation
+
+### 5. Guide User's Next Decision
+
+If no supporting documents are found:
+
+- Explain their three options clearly and helpfully
+- Option 1: Proceed with creating the module based on their ideas
+- Option 2: Exit and create a module brief first (explain the module-brief workflow)
+- Option 3: Exit and do brainstorming first (explain the brainstorming workflow)
+- Support whatever choice they make
+
+### 6. Create Module Foundation
+
+If proceeding:
+
+- Create the module folder if needed
+- Create the initial module-plan-{module_name}.md document using the module plan template from {modulePlanTemplate}
+- Initialize proper frontmatter with current date, user name, and add "step-01-init" to stepsCompleted array
+- Add any discovered documents to inputDocuments field
+- Include a brief section about the legacy reference
+
+### 7. Prepare for Next Step
+
+- Confirm everything is set up properly
+- Let the user know what you've accomplished
+- Transition smoothly to the next phase of defining the module concept
+
+### 8. Present MENU OPTIONS
+
+Display: **Proceeding to define your module concept...**
+
+#### EXECUTION RULES:
+
+- This is an initialization step with no user choices (after inputs handled)
+- Proceed directly to next step after setup
+- Use menu handling logic section below
+
+#### Menu Handling Logic:
+
+- After setup completion, add step-01-init to the end of the stepsCompleted array in module plan frontmatter, then load, read entire file, then execute `{nextStepFile}` to define the module concept
+
+---
+
+## 🚨 SYSTEM SUCCESS/FAILURE METRICS
+
+### ✅ SUCCESS:
+
+- Module name obtained and validated through collaborative dialogue
+- Module plan document created from template with frontmatter initialized
+- "step-01-init" added to stepsCompleted array
+- Module plan document created at correct location
+- User feels welcomed and informed
+- Ready to proceed to step 2
+- OR existing workflow properly routed to step-01b-continue.md
+
+### ❌ SYSTEM FAILURE:
+
+- Proceeding with step 2 without module plan creation
+- Not checking for existing documents properly
+- Creating module without user input on name
+- Skipping folder creation
+- Not routing to step-01b-continue.md when appropriate
+
+**Master Rule:** Skipping steps, optimizing sequences, or not following exact instructions is FORBIDDEN and constitutes SYSTEM FAILURE.
+
+## CRITICAL STEP COMPLETION NOTE
+
+ONLY WHEN initialization setup is complete and module plan document is created (OR continuation is properly routed), will you then immediately load, read entire file, then execute `{nextStepFile}` to begin defining the module concept.