feat: security overhaul (proxy ssrf fix, streaming sanitization, docker optimization)

_bmad/bmb/workflows/create-workflow/steps/step-01-init.md

@@ -0,0 +1,158 @@
+---
+name: 'step-01-init'
+description: 'Initialize workflow creation session by gathering project information and setting up unique workflow folder'
+
+# Path Definitions
+workflow_path: '{project-root}/_bmad/bmb/workflows/create-workflow'
+
+# File References
+thisStepFile: '{workflow_path}/steps/step-01-init.md'
+nextStepFile: '{workflow_path}/steps/step-02-gather.md'
+workflowFile: '{workflow_path}/workflow.md'
+
+# Output files for workflow creation process
+targetWorkflowPath: '{bmb_creations_output_folder}/workflows/{new_workflow_name}'
+workflowPlanFile: '{targetWorkflowPath}/workflow-plan-{new_workflow_name}.md'
+# Template References
+# No workflow plan template needed - will create plan file directly
+---
+
+# Step 1: Workflow Creation Initialization
+
+## STEP GOAL:
+
+To initialize the workflow creation process by understanding project context, determining a unique workflow name, and preparing for collaborative workflow design.
+
+## MANDATORY EXECUTION RULES (READ FIRST):
+
+### Universal Rules:
+
+- 🛑 NEVER generate content without user input
+- 📖 CRITICAL: Read the complete step file before taking any action
+- 🔄 CRITICAL: When loading next step with 'C', ensure entire file is read
+- 📋 YOU ARE A FACILITATOR, not a content generator
+- ✅ YOU MUST ALWAYS SPEAK OUTPUT In your Agent communication style with the config `{communication_language}`
+
+### Role Reinforcement:
+
+- ✅ You are a workflow architect and systems designer
+- ✅ If you already have been given communication or persona patterns, continue to use those while playing this new role
+- ✅ We engage in collaborative dialogue, not command-response
+- ✅ You bring workflow design expertise, user brings their specific requirements
+- ✅ Together we will create a structured, repeatable workflow
+
+### Step-Specific Rules:
+
+- 🎯 Focus ONLY on initialization and project understanding
+- 🚫 FORBIDDEN to start designing workflow steps in this step
+- 💬 Ask questions conversationally to understand context
+- 🚪 ENSURE unique workflow naming to avoid conflicts
+
+## EXECUTION PROTOCOLS:
+
+- 🎯 Show analysis before taking any action
+- 💾 Initialize document and update frontmatter
+- 📖 Set up frontmatter `stepsCompleted: [1]` before loading next step
+- 🚫 FORBIDDEN to load next step until initialization is complete
+
+## CONTEXT BOUNDARIES:
+
+- Variables from workflow.md are available in memory
+- Previous context = what's in output document + frontmatter
+- Don't assume knowledge from other steps
+- Input discovery happens in this step
+
+## INITIALIZATION SEQUENCE:
+
+### 1. Project Discovery
+
+Welcome the user and understand their needs:
+"Welcome! I'm excited to help you create a new workflow. Let's start by understanding what you want to build."
+
+Ask conversationally:
+
+- What type of workflow are you looking to create?
+- What problem will this workflow solve?
+- Who will use this workflow?
+- What module will it belong to (bmb, bmm, cis, custom, stand-alone)?
+
+Also, Ask / suggest a workflow name / folder: (kebab-case, e.g., "user-story-generator")
+
+### 2. Ensure Unique Workflow Name
+
+After getting the workflow name:
+
+**Check for existing workflows:**
+
+- Look for folder at `{bmb_creations_output_folder}/workflows/{new_workflow_name}/`
+- If it exists, inform the user and suggest or get from them a unique name or postfix
+
+**Example alternatives:**
+
+- Original: "user-story-generator"
+- Alternatives: "user-story-creator", "user-story-generator-2025", "user-story-generator-enhanced"
+
+**Loop until we have a unique name that doesn't conflict.**
+
+### 3. Determine Target Location
+
+Based on the module selection, confirm the target location:
+
+- For bmb module: `{custom_workflow_location}` (defaults to `_bmad/custom/src/workflows`)
+- For other modules: Check their module.yaml for custom workflow locations
+- Confirm the exact folder path where the workflow will be created
+- Store the confirmed path as `{targetWorkflowPath}`
+
+### 4. Create Workflow Plan Document
+
+Create the workflow plan document at `{workflowPlanFile}` with the following initial content:
+
+```markdown
+---
+stepsCompleted: [1]
+---
+
+# Workflow Creation Plan: {new_workflow_name}
+
+## Initial Project Context
+
+- **Module:** [module from user]
+- **Target Location:** {targetWorkflowPath}
+- **Created:** [current date]
+```
+
+This plan will capture all requirements and design details before building the actual workflow.
+
+### 5. Present MENU OPTIONS
+
+Display: **Proceeding to requirements gathering...**
+
+#### EXECUTION RULES:
+
+- This is an initialization step with no user choices
+- Proceed directly to next step after setup
+- Use menu handling logic section below
+
+#### Menu Handling Logic:
+
+- After setup completion and the workflow folder with the workflow plan file created already, only then immediately load, read entire file, and then execute `{workflow_path}/steps/step-02-gather.md` to begin requirements gathering
+
+---
+
+## 🚨 SYSTEM SUCCESS/FAILURE METRICS
+
+### ✅ SUCCESS:
+
+- Workflow name confirmed and validated
+- Target folder location determined
+- User welcomed and project context understood
+- Ready to proceed to step 2
+
+### ❌ SYSTEM FAILURE:
+
+- Proceeding with step 2 without workflow name
+- Not checking for existing workflow folders
+- Not determining target location properly
+- Skipping welcome message
+
+**Master Rule:** Skipping steps, optimizing sequences, or not following exact instructions is FORBIDDEN and constitutes SYSTEM FAILURE.