Support default values for variables in request files

[mantono]

Support two types of default values in request files:

• static {{FOO:bar}} - if no value is present for variable FOO use static value bar
• dynamic {{FOO|bar}} - if no value is present for variable FOO invoke shell command bar which should provide a value instead

Static default value

For example

url: https://example.com
method: POST
headers:
  content-type: {{CONTENT_TYPE:application/json}}

So if a value is provided for CONTENT_TYPE it will always be used, regardless of where (i.e interactively, on the command line, through an environment or secret file) and only if no value is provided will we use the default value (application/json).

If a default value is provided and the --interactive flag is present, the user will NOT be asked to provide a value. Asking the user will only be done as a last resort.

Dynamic default value

For example

url: https://example.com
method: POST
headers:
  x-correlation-id: {{CORRELATION_ID|uuidgen}}

Similar to a static default value; if a value id provided somehow for CORRELATION_ID it will be used, but otherwise we will get a value by invoking the shell command uuidgen. So

[mantono]

Implementation plan: default template values

Decisions locked in

• Static fallback: {{NAME:value}}; dynamic fallback: {{NAME|command}}.
• Sources already supported by Fire retain precedence: CLI -E, discovered environment files, then inherited system environment. An explicitly empty sourced value counts as resolved and suppresses fallback execution.
• Fallbacks are evaluated before interactive input; any fallback occurrence never prompts.
• Dynamic fallbacks require a new explicit opt-in CLI flag, --allow-command-fallbacks. When absent, reaching a dynamic fallback is a clear error; a sourced value still wins and therefore does not require the flag.
• Execute commands through sh -c on Unix and cmd /C on Windows. Capture stdout as UTF-8, remove only trailing CR/LF line endings, preserve all other whitespace, and stop with a dedicated error for launch, non-zero exit, or non-UTF-8 output.
• Fallbacks resolve per occurrence. Thus different fallback values/types for the same missing NAME are valid and independently resolved.

Scope

In: parser/substitution behavior, CLI permission gate, cross-platform command runner, user-facing errors, focused unit tests, README and example request files. Out: arbitrary shell selection, timeouts/sandboxing, nested expressions, whitespace/new grammar beyond the three forms, and changes to existing property-source precedence.

Work loop for every task

1. Inspect the stated files and existing tests before changing behavior.
2. Add the focused failing test(s) listed below; run cargo test and confirm red.
3. Implement only the behavior required by that task; run cargo fmt and cargo test until green.
4. Keep the task’s change logically isolated. Before a final PR run cargo build --all-features, cargo test, and cargo clippy --all-targets --all-features -- -D warnings (CI also covers macOS and Windows).

Tasks

• Define and test parsed template references in src/templ.rs.** Replace the plain-key-only regex API with a scanner/parser that preserves text boundaries and yields one reference per occurrence: plain {{NAME}}, static {{NAME:value}}, and command {{NAME|command}}. Keep the present NAME rule ([A-Za-z0-9_-], 1–32 chars); treat delimiter contents literally until }}, so :/| after the first delimiter remain part of the fallback. Invalid/unterminated/non-name constructs remain ordinary Handlebars text and retain current rendering behavior. Add parser tests for all forms, repeated names with distinct fallbacks, and legacy-key discovery.
• Refactor src/template.rs around occurrence-level resolution, test first. Merge properties exactly as today, then resolve each parsed reference in this order: a merged property by NAME; otherwise that occurrence’s static value; otherwise that occurrence’s dynamic result; otherwise prompt only a plain missing occurrence in interactive mode; otherwise MissingValue. Convert extended occurrences to unique internal Handlebars keys (or equivalently safely render their individual literal values) before strict Handlebars rendering, so distinct fallback occurrences for one NAME remain distinct while supplied values still replace every occurrence. Preserve no_escape, strict-mode failure mapping, and existing normal-template behavior. Add tests covering static fallback, sourced-value override from every Property::Source, empty source override, per-occurrence mixed/default values, fallback suppression of interactive prompting, and legacy missing-value behavior.
• Add the command-fallback authorization and runner boundary, test first. Add Args::allow_command_fallbacks() backed by --allow-command-fallbacks, thread it from main.rs into substitution, and make command resolution return a distinct substitution error if reached without permission. Isolate command invocation behind an injectable/testable function or small adapter; production implementation uses std::process::Command with sh -c under cfg(unix) and cmd /C under cfg(windows). Test that the flag parses, a source value bypasses both authorization and runner, denied execution yields the new error, stdout line endings are removed, whitespace otherwise survives, and launch/non-zero/non-UTF-8 failures are surfaced deterministically without calling the network/request parser.
• Expose command-fallback failures to users. Add a dedicated FireError variant and a stable non-conflicting exit code (document the selected code in the variant test) for denied/failed dynamic fallback execution; map the new SubstitutionError in main.rs rather than collapsing it into generic rendering. Add Display/termination tests or direct unit coverage for messages and exit code. Do not log resolved fallback values or command stdout, as they may be secrets.
• Document and demonstrate the contract. Update README’s templating section to show both syntaxes, source precedence, per-occurrence semantics, the interactive ordering, exact command-output normalization/failure behavior, platform shells, and the required --allow-command-fallbacks security warning. Add minimal example request file(s) for static and gated dynamic syntax, explicitly ensuring examples do not execute a command during tests.
• Final compatibility verification. Run formatter, build, complete test suite, and Clippy command above. Manually verify fire --help describes the opt-in flag; on Unix run a harmless gated dynamic fallback and verify that a supplied -E NAME=value skips it. Let GitHub Actions validate the Windows command path; address only failures directly caused by this feature.

Acceptance criteria

• {{FOO:bar}} uses bar only when FOO is not supplied and does not prompt.
• {{FOO|command}} executes only when FOO is not supplied and the opt-in flag is present; its normalized stdout is used only for that occurrence.
• Existing value precedence and legacy {{FOO}} behavior are unchanged.
• Multiple missing occurrences of FOO may use different static/dynamic fallbacks without occurrence-order coupling.
• Clear, non-secret errors are emitted for disabled or failed commands.