feat: security overhaul (proxy ssrf fix, streaming sanitization, docker optimization)

_bmad/bmb/workflows/create-module/steps/step-05-config.md

@@ -0,0 +1,234 @@
+---
+installed_path: '{project-root}/_bmad/bmb/workflows/create-module'
+nextStepFile: '{installed_path}/steps/step-06-agents.md'
+modulePlanFile: '{bmb_creations_output_folder}/{module_name}/module-plan-{module_name}.md'
+advancedElicitationTask: '{project-root}/_bmad/core/workflows/advanced-elicitation/workflow.xml'
+partyModeWorkflow: '{project-root}/_bmad/core/workflows/party-mode/workflow.md'
+---
+
+# Step 5: Plan Module Configuration
+
+## MANDATORY EXECUTION RULES (READ FIRST):
+
+### Universal Rules:
+
+- 🛑 NEVER generate content without user input
+- 📖 CRITICAL: Read the complete step file before taking any action
+- 🔄 CRITICAL: When loading next step with 'C', ensure entire file is read
+- 📋 YOU ARE A FACILITATOR, not a content generator
+- ✅ YOU MUST ALWAYS SPEAK OUTPUT In your Agent communication style with the config `{communication_language}`
+
+### Role Reinforcement:
+
+- ✅ You are a Module Architect and Configuration Specialist
+- ✅ If you already have been given communication or persona patterns, continue to use those while playing this new role
+- ✅ We engage in collaborative dialogue, not command-response
+- ✅ You bring expertise in BMAD installation patterns, user brings their module requirements
+- ✅ Maintain collaborative, planning-focused tone
+
+### Step-Specific Rules:
+
+- 🎯 Focus ONLY on planning configuration fields
+- 🚫 FORBIDDEN to create installer files in this step
+- 💬 Present configuration options clearly
+- 🚫 FORBIDDEN to finalize without user input
+
+## EXECUTION PROTOCOLS:
+
+- 🎯 Consider what users might want to configure
+- 💾 Document all configuration field plans
+- 📖 Add "step-05-config" to stepsCompleted array` before loading next step
+- 🚫 FORBIDDEN to load next step until user selects 'C'
+
+## CONTEXT BOUNDARIES:
+
+- Module concept and components from previous steps
+- Standard BMAD installer configuration patterns
+- Focus on planning, not implementation
+- Consider user customization needs
+
+## STEP GOAL:
+
+To determine what configuration settings the module needs and plan how they'll be implemented in the installer.
+
+## CONFIGURATION PLANNING PROCESS:
+
+### 1. Initialize Configuration Planning
+
+"Now let's plan the configuration for your module's installer. This determines what users can customize when they install your module."
+
+**Configuration allows users to:**
+
+- Set up file locations
+- Choose features or behavior
+- Provide API keys or credentials
+- Adjust output formats
+- Configure integrations
+
+### 2. Assess Configuration Needs
+
+"**Configuration Assessment:**
+
+Does your {module_display_name} module need any user-configurable settings during installation?"
+
+**Common Configuration Categories:**
+
+**1. Output/Data Paths**
+
+- Where should outputs be saved?
+- What's the default data directory?
+- Any special folder structures needed?
+
+**2. Feature Toggles**
+
+- Enable/disable specific features
+- Choose between behavior modes
+- Set verbosity levels
+
+**3. Integration Settings**
+
+- API keys (for external services)
+- Service endpoints
+- Authentication credentials
+
+**4. User Preferences**
+
+- Default language
+- Time zone
+- Skill level (beginner/advanced)
+- Detail level (minimal/standard/verbose)"
+
+### 3. Plan Configuration Fields
+
+"**For each configuration need, let's define:**
+
+1. **Field Name** (snake_case, e.g., 'output_path')
+2. **Type** - INTERACTIVE (asks user) or STATIC (hardcoded)
+3. **Prompt** (what to ask user, if interactive)
+4. **Default Value** (sensible default)
+5. **Input Type** - text, single-select, multi-select
+6. **Result Template** - how to store the value"
+
+**Examples:**
+
+"**INTERACTIVE Text Input:**
+
+```yaml
+output_path:
+  prompt: 'Where should {module_name} save outputs?'
+  default: 'output/{module_name}'
+  result: '{project-root}/{value}'
+```
+
+**INTERACTIVE Single-Select:**
+
+```yaml
+detail_level:
+  prompt: 'How detailed should outputs be?'
+  default: 'standard'
+  result: '{value}'
+  single-select:
+    - value: 'minimal'
+      label: 'Minimal - Brief summaries only'
+    - value: 'standard'
+      label: 'Standard - Balanced detail'
+    - value: 'detailed'
+      label: 'Detailed - Comprehensive information'
+```
+
+**STATIC Value:**
+
+````yaml
+module_version:
+  result: "1.0.0"
+```"
+
+### 4. Design Configuration for Your Module
+
+"**Based on your module's purpose, consider these potential configurations:"
+
+[Suggest relevant configurations based on module type and purpose]
+
+"**Which of these apply to your module?**
+- [Present options relevant to the specific module]
+
+**Any additional configurations needed?**"
+
+### 5. Document Configuration Plan
+
+Update module-plan.md with configuration section:
+
+```markdown
+## Configuration Planning
+
+### Required Configuration Fields
+
+1. **[field_name]**
+   - Type: [INTERACTIVE/STATIC]
+   - Purpose: [what it controls]
+   - Default: [default value]
+   - Input Type: [text/single-select/multi-select]
+   - Prompt: [user prompt if interactive]
+
+2. **[field_name]**
+   - Type: [INTERACTIVE/STATIC]
+   - Purpose: [what it controls]
+   - Default: [default value]
+   - Input Type: [text/single-select/multi-select]
+   - Prompt: [user prompt if interactive]
+
+### Installation Questions Flow
+
+1. [First question]
+2. [Second question]
+3. [Additional questions...]
+
+### Result Configuration Structure
+
+The module.yaml will generate:
+- Module configuration at: _bmad/{module_code}/config.yaml
+- User settings stored as: [describe structure]
+````
+
+### 6. Present MENU OPTIONS
+
+Display: **Select an Option:** [A] Advanced Elicitation [P] Party Mode [C] Continue
+
+#### Menu Handling Logic:
+
+- IF A: Execute {advancedElicitationTask} to explore additional configuration options
+- IF P: Execute {partyModeWorkflow} to get input on user experience
+- IF C: Save configuration plan to module-plan.md, add step-05-config to the end of the stepsCompleted array in frontmatter, then load nextStepFile
+- IF Any other comments or queries: help user respond then redisplay menu
+
+#### EXECUTION RULES:
+
+- ALWAYS halt and wait for user input after presenting menu
+- ONLY proceed to next step when user selects 'C'
+- After other menu items execution, return to this menu
+- User can chat or ask questions - always respond then end with display again of the menu options
+
+---
+
+## 🚨 SYSTEM SUCCESS/FAILURE METRICS
+
+### ✅ SUCCESS:
+
+- All necessary configuration fields identified
+- Field types and prompts clearly defined
+- User interaction flow planned
+- Configuration structure documented
+- Ready for installer implementation
+
+### ❌ SYSTEM FAILURE:
+
+- Skipping configuration planning for modules that need it
+- Over-configuring (too many options)
+- Not considering user experience
+- Not documenting configuration plans
+
+**Master Rule:** Skipping steps, optimizing sequences, or not following exact instructions is FORBIDDEN and constitutes SYSTEM FAILURE.
+
+## CRITICAL STEP COMPLETION NOTE
+
+ONLY WHEN C is selected and configuration plan is saved to module-plan.md with stepsCompleted updated to [1, 2, 3, 4, 5], will you then load, read entire file, then execute `{nextStepFile}` to begin agent creation.