@alexismunozdev/claude-session-topics 2.0.1 → 2.1.0

package/bin/install.js

@@ -50,7 +50,7 @@ const WRAPPER_CMD = `bash "$HOME/.claude/session-topics/wrapper-statusline.sh"`;
 
 // ─── Permission rule ─────────────────────────────────────────────────────────
 
-const PERMISSION_RULE = 'Bash(*session-topics*)';
+const PERMISSION_RULE = 'Bash(*/.claude/session-topics/*)';
 
 // ─── Wrapper script content ──────────────────────────────────────────────────
 
@@ -59,7 +59,27 @@ input=$(cat)
 TOPIC_OUTPUT=$(echo "$input" | bash "$HOME/.claude/session-topics/statusline.sh" 2>/dev/null || echo "")
 ORIG_CMD=$(cat "$HOME/.claude/session-topics/.original-statusline-cmd" 2>/dev/null || echo "")
 ORIG_OUTPUT=""
-[ -n "$ORIG_CMD" ] && ORIG_OUTPUT=$(echo "$input" | eval "$ORIG_CMD" 2>/dev/null || echo "")
+
+# Validate the original command before executing it
+validate_cmd() {
+    local cmd="\$1"
+    # Reject dangerous patterns: command substitution, backticks, chaining,
+    # process substitution, and /dev/tcp|udp redirection
+    if echo "\$cmd" | grep -qF '\$(' ; then return 1; fi
+    if echo "\$cmd" | grep -qF '\`' ; then return 1; fi
+    if echo "\$cmd" | grep -q '[;&|]' ; then return 1; fi
+    if echo "\$cmd" | grep -qE '>\\(' ; then return 1; fi
+    if echo "\$cmd" | grep -qE '<\\(' ; then return 1; fi
+    if echo "\$cmd" | grep -qE '/dev/(tcp|udp)' ; then return 1; fi
+    # Must start with an allowed command pattern (bash <path> or absolute path)
+    if ! echo "\$cmd" | grep -qE '^(bash |/[a-zA-Z0-9._/-]+)' ; then return 1; fi
+    return 0
+}
+
+if [ -n "$ORIG_CMD" ] && validate_cmd "$ORIG_CMD"; then
+    ORIG_OUTPUT=$(echo "$input" | bash -c "$ORIG_CMD" 2>/dev/null || echo "")
+fi
+
 if [ -n "$TOPIC_OUTPUT" ] && [ -n "$ORIG_OUTPUT" ]; then
     echo -e "\${TOPIC_OUTPUT} | \${ORIG_OUTPUT}"
 elif [ -n "$TOPIC_OUTPUT" ]; then
@@ -83,7 +103,10 @@ function readSettings() {
 function writeSettings(obj) {
     const dir = path.dirname(SETTINGS_FILE);
     fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(SETTINGS_FILE, JSON.stringify(obj, null, 2) + '\n', 'utf8');
+    // Atomic write: write to temp file then rename to avoid TOCTOU race condition
+    const tmpFile = SETTINGS_FILE + '.tmp.' + process.pid;
+    fs.writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    fs.renameSync(tmpFile, SETTINGS_FILE);
 }
 
 function copyDirRecursive(src, dest) {
@@ -110,6 +133,15 @@ function hasJq() {
 
 // ─── CLI argument parsing ────────────────────────────────────────────────────
 
+const VALID_NAMED_COLORS = ['green', 'blue', 'cyan', 'magenta', 'yellow', 'red', 'white', 'orange', 'grey'];
+const VALID_ANSI_CODE_RE = /^[0-9;]{1,15}$/;
+
+function validateColor(value) {
+    if (VALID_NAMED_COLORS.includes(value.toLowerCase())) return true;
+    if (VALID_ANSI_CODE_RE.test(value)) return true;
+    return false;
+}
+
 function parseArgs(argv) {
     const args = argv.slice(2);
     const result = { action: 'install', color: null };
@@ -126,7 +158,12 @@ function parseArgs(argv) {
         }
         if (arg === '--color') {
             if (i + 1 < args.length) {
-                result.color = args[i + 1];
+                const colorValue = args[i + 1];
+                if (!validateColor(colorValue)) {
+                    err(`Invalid color: "${colorValue}". Use a named color (${VALID_NAMED_COLORS.join(', ')}) or a numeric ANSI code (max 15 chars).`);
+                    process.exit(1);
+                }
+                result.color = colorValue;
                 i++;
             } else {
                 err('--color requires a value (e.g., --color cyan)');
@@ -222,12 +259,12 @@ function install(color) {
             // Another command exists — create wrapper
             const origCmd = settings.statusLine.command;
 
-            // Backup original command
-            fs.writeFileSync(ORIG_CMD_FILE, origCmd, 'utf8');
+            // Backup original command (read-only: 0400 to prevent tampering)
+            fs.writeFileSync(ORIG_CMD_FILE, origCmd, { encoding: 'utf8', mode: 0o400 });
             info(`Backed up original statusLine command to .original-statusline-cmd`);
 
             // Write wrapper
-            fs.writeFileSync(DEST_WRAPPER, WRAPPER_SCRIPT, 'utf8');
+            fs.writeFileSync(DEST_WRAPPER, WRAPPER_SCRIPT, { encoding: 'utf8', mode: 0o600 });
             fs.chmodSync(DEST_WRAPPER, 0o755);
             info('Created wrapper-statusline.sh');
 
@@ -282,7 +319,7 @@ function install(color) {
     // ── Step 7: Configure color ──────────────────────────────────────────
 
     if (color) {
-        fs.writeFileSync(COLOR_CONFIG, color, 'utf8');
+        fs.writeFileSync(COLOR_CONFIG, color, { encoding: 'utf8', mode: 0o600 });
         ok(`Topic color set to: ${BOLD}${color}${RESET}`);
     }
 
@@ -374,8 +411,9 @@ function uninstall() {
         Array.isArray(settings.permissions.allow)
     ) {
         const before = settings.permissions.allow.length;
+        const OLD_PERMISSION_RULE = 'Bash(*session-topics*)';
         settings.permissions.allow = settings.permissions.allow.filter(
-            (rule) => rule !== PERMISSION_RULE
+            (rule) => rule !== PERMISSION_RULE && rule !== OLD_PERMISSION_RULE
         );
         if (settings.permissions.allow.length < before) {
             writeSettings(settings);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexismunozdev/claude-session-topics",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Session topics for Claude Code — auto-set and display a topic in the statusline, change anytime with /set-topic",
   "bin": {
     "claude-session-topics": "bin/install.js"

package/scripts/auto-topic-hook.sh

@@ -0,0 +1,238 @@
+#!/bin/bash
+set -euo pipefail
+
+# ── Stop hook: automatically set session topic from first user message
+# Receives Stop event JSON on stdin: {"session_id": "...", "transcript_path": "..."}
+# Fast-path: exits immediately if topic already exists for this session.
+
+input=$(cat)
+
+# ── Parse JSON fields
+SESSION_ID=$(echo "$input" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    print(d.get('session_id', ''))
+except:
+    print('')
+" 2>/dev/null || echo "")
+
+TRANSCRIPT_PATH=$(echo "$input" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    print(d.get('transcript_path', ''))
+except:
+    print('')
+" 2>/dev/null || echo "")
+
+# ── Sanitize session ID (only allow alphanumeric, hyphens, underscores)
+SESSION_ID=$(echo "$SESSION_ID" | tr -cd 'a-zA-Z0-9_-')
+if [ -z "$SESSION_ID" ]; then
+    exit 0
+fi
+
+# ── Ensure topics directory exists and write active session
+mkdir -p "$HOME/.claude/session-topics"
+echo "$SESSION_ID" > "$HOME/.claude/session-topics/.active-session"
+
+# ── Fast path: topic already exists — nothing to do
+TOPIC_FILE="$HOME/.claude/session-topics/${SESSION_ID}"
+if [ -f "$TOPIC_FILE" ] && [ -s "$TOPIC_FILE" ]; then
+    exit 0
+fi
+
+# ── No topic yet — extract one from the transcript
+if [ -z "$TRANSCRIPT_PATH" ] || [ ! -f "$TRANSCRIPT_PATH" ]; then
+    exit 0
+fi
+
+# ── Use python3 for robust JSON + text processing
+TOPIC=$(python3 -c "
+import sys, json, re
+
+def extract_user_text(transcript_path):
+    \"\"\"Read JSONL transcript and return the first user/human message text.\"\"\"
+    try:
+        with open(transcript_path, 'r', encoding='utf-8') as f:
+            for line in f:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    obj = json.loads(line)
+                except json.JSONDecodeError:
+                    continue
+
+                text = None
+
+                # Format 1: {\"role\": \"user\", \"content\": \"message text\"}
+                if obj.get('role') == 'user':
+                    content = obj.get('content', '')
+                    if isinstance(content, str):
+                        text = content
+                    elif isinstance(content, list):
+                        # Format 2: {\"role\": \"user\", \"content\": [{\"type\": \"text\", \"text\": \"...\"}]}
+                        for item in content:
+                            if isinstance(item, dict) and item.get('type') == 'text':
+                                text = item.get('text', '')
+                                break
+
+                # Format 3: {\"type\": \"human\", \"message\": {\"role\": \"user\", \"content\": \"text\"}}
+                elif obj.get('type') == 'human':
+                    msg = obj.get('message', {})
+                    if isinstance(msg, dict):
+                        content = msg.get('content', '')
+                        if isinstance(content, str):
+                            text = content
+                        elif isinstance(content, list):
+                            for item in content:
+                                if isinstance(item, dict) and item.get('type') == 'text':
+                                    text = item.get('text', '')
+                                    break
+
+                if text and text.strip():
+                    return text.strip()
+    except Exception:
+        pass
+    return ''
+
+def extract_topic(text):
+    \"\"\"Extract a concise 2-4 word topic from user text.\"\"\"
+    if not text:
+        return ''
+
+    # Remove markdown formatting
+    text = re.sub(r'\`\`\`[\s\S]*?\`\`\`', '', text)  # code blocks
+    text = re.sub(r'\`[^\`]+\`', '', text)              # inline code
+    text = re.sub(r'[#*_~>\[\]()!]', '', text)          # markdown chars
+    text = re.sub(r'https?://\S+', '', text)             # URLs
+    text = re.sub(r'\s+', ' ', text).strip()
+
+    # Take only the first sentence/line for topic extraction
+    first_line = text.split('\n')[0].strip()
+    first_sentence = re.split(r'[.!?]', first_line)[0].strip()
+    if first_sentence:
+        text = first_sentence
+
+    # Strip common prefixes (English and Spanish)
+    prefixes = [
+        # Greetings first (often followed by other prefixes)
+        r'^hey\b',
+        r'^hi\b',
+        r'^hello\b',
+        r'^hola\b',
+        # Polite qualifiers
+        r'^please\b',
+        r'^por favor\b',
+        # English request patterns (longer patterns first)
+        r'^i would like to\b',
+        r'^i\'d like to\b',
+        r'^i need to\b',
+        r'^i want to\b',
+        r'^i need\b',
+        r'^i want\b',
+        r'^can you\b',
+        r'^could you\b',
+        r'^would you\b',
+        r'^help me\b',
+        r'^we need to\b',
+        r'^we should\b',
+        r'^let\'s\b',
+        # Spanish request patterns
+        r'^me gustaria\b',
+        r'^ayudame a\b',
+        r'^ayudame\b',
+        r'^necesito\b',
+        r'^quiero\b',
+        r'^puedes\b',
+        r'^podrias\b',
+        r'^podr.as\b',
+        r'^vamos a\b',
+    ]
+    # Multi-pass: keep stripping until no more prefixes match
+    changed = True
+    while changed:
+        changed = False
+        for prefix in prefixes:
+            old = text
+            text = re.sub(prefix, '', text, flags=re.IGNORECASE).strip()
+            text = re.sub(r'^[,;:\s]+', '', text).strip()
+            if text != old:
+                changed = True
+
+    # Stop words (English + Spanish)
+    stop_words = {
+        # English
+        'a', 'an', 'the', 'is', 'are', 'was', 'were', 'be', 'been', 'being',
+        'have', 'has', 'had', 'do', 'does', 'did', 'will', 'would', 'could',
+        'should', 'may', 'might', 'shall', 'can', 'to', 'of', 'in', 'for',
+        'on', 'with', 'at', 'by', 'from', 'as', 'into', 'through', 'during',
+        'before', 'after', 'above', 'below', 'between', 'out', 'off', 'over',
+        'under', 'again', 'further', 'then', 'once', 'here', 'there', 'when',
+        'where', 'why', 'how', 'all', 'each', 'every', 'both', 'few', 'more',
+        'most', 'other', 'some', 'such', 'no', 'nor', 'not', 'only', 'own',
+        'same', 'so', 'than', 'too', 'very', 'just', 'about', 'up', 'it',
+        'its', 'this', 'that', 'these', 'those', 'my', 'your', 'his', 'her',
+        'our', 'their', 'me', 'him', 'us', 'them', 'what', 'which', 'who',
+        'whom', 'and', 'but', 'or', 'if', 'while', 'because', 'until',
+        'also', 'still', 'get', 'got', 'make', 'made',
+        # Spanish
+        'el', 'la', 'los', 'las', 'un', 'una', 'unos', 'unas', 'de', 'del',
+        'en', 'con', 'por', 'para', 'al', 'es', 'son', 'ser', 'estar',
+        'este', 'esta', 'estos', 'estas', 'ese', 'esa', 'esos', 'esas',
+        'que', 'como', 'mas', 'pero', 'si', 'ya', 'se', 'le', 'lo',
+        'nos', 'les', 'su', 'sus', 'mi', 'mis', 'tu', 'tus',
+    }
+
+    words = text.split()
+    # Filter stop words but keep words that look important (capitalized, technical)
+    meaningful = []
+    for w in words:
+        clean = re.sub(r'[^a-zA-Z0-9\u00C0-\u024F-]', '', w)
+        if not clean:
+            continue
+        if clean.lower() in stop_words and not clean[0].isupper():
+            continue
+        meaningful.append(clean)
+
+    if not meaningful:
+        # Fallback: just take first few words if all were stop words
+        meaningful = [re.sub(r'[^a-zA-Z0-9\u00C0-\u024F-]', '', w) for w in words[:4]]
+        meaningful = [w for w in meaningful if w]
+
+    # Take 2-4 words
+    topic_words = meaningful[:4]
+    if not topic_words:
+        return ''
+
+    # Title-case each word
+    topic = ' '.join(w.capitalize() if not w[0].isupper() else w for w in topic_words)
+
+    # Truncate to max 40 chars
+    if len(topic) > 40:
+        # Try to fit within 40 chars by reducing words
+        while len(topic) > 40 and len(topic_words) > 2:
+            topic_words.pop()
+            topic = ' '.join(w.capitalize() if not w[0].isupper() else w for w in topic_words)
+        if len(topic) > 40:
+            topic = topic[:40].rstrip()
+
+    return topic
+
+transcript_path = sys.argv[1]
+text = extract_user_text(transcript_path)
+topic = extract_topic(text)
+print(topic)
+" "$TRANSCRIPT_PATH" 2>/dev/null || echo "")
+
+# ── Write topic if we got one
+if [ -n "$TOPIC" ]; then
+    # Sanitize topic: remove shell metacharacters and non-printable chars, keep letters (incl. accented), digits, spaces, basic punctuation
+    TOPIC=$(printf '%s' "$TOPIC" | sed 's/[^a-zA-Z0-9àáâãäåèéêëìíîïòóôõöùúûüýÿñçÀÁÂÃÄÅÈÉÊËÌÍÎÏÒÓÔÕÖÙÚÛÜÝÑÇ .,:!?'"'"'-]//g' | cut -c1-40)
+    if [ -n "$TOPIC" ]; then
+        printf '%s\n' "$TOPIC" > "$TOPIC_FILE"
+    fi
+fi
+
+exit 0

package/scripts/statusline.sh

@@ -5,6 +5,11 @@ input=$(cat)
 
 # ── Parse JSON
 SESSION_ID=$(echo "$input" | jq -r '.session_id // ""')
+SESSION_ID=$(echo "$SESSION_ID" | tr -cd 'a-zA-Z0-9_-')
+if [ -z "$SESSION_ID" ]; then
+    # No valid session ID — skip session-dependent logic, just run original statusline
+    exit 0
+fi
 
 # ── Write active session file
 if [ -n "$SESSION_ID" ]; then
@@ -63,7 +68,7 @@ C_RESET='\033[0m'
 CLEANUP_LOCK="/tmp/.claude-topic-cleanup-lock"
 if mkdir "$CLEANUP_LOCK" 2>/dev/null; then
     trap "rmdir '$CLEANUP_LOCK' 2>/dev/null || true" EXIT
-    find "$HOME/.claude/session-topics" -type f -mtime +7 -delete 2>/dev/null || true
+    find "$HOME/.claude/session-topics" -type f -mtime +7 -not -name '.*' -delete 2>/dev/null || true
     rmdir "$CLEANUP_LOCK" 2>/dev/null
 fi
 

package/skills/auto-topic/SKILL.md

@@ -1,18 +1,23 @@
 ---
 name: auto-topic
-description: Use on EVERY user message to automatically set or update a short session topic (2-4 words) in the statusline. Activates continuously throughout the conversation to keep the topic current as the discussion evolves.
-version: 1.2.0
+description: Use on EVERY user message to refine or update the session topic (2-4 words) when the conversation shifts to a different subject. The initial topic is set automatically by the Stop hook — this skill handles ongoing topic evolution.
+version: 2.0.0
 allowed-tools: [Bash]
 ---
 
 # Auto Topic
 
-Automatically set and update a short, descriptive topic for the current Claude Code session as the conversation evolves.
+Refine and update the session topic as the conversation evolves. The initial topic is set automatically by a Stop hook after the first response — this skill's role is to **update the topic when the conversation shifts** to a different subject.
 
 ## When to Activate
 
 This skill activates on **every user message**. Run it silently — do not mention to the user that you are setting or updating the topic.
 
+## How It Works
+
+1. **Initial topic**: Handled automatically by the Stop hook (`auto-topic-hook.sh`). It extracts a 2-4 word topic from the first user message using heuristics. No action needed from this skill for the first message.
+2. **Ongoing updates**: This skill monitors the conversation and updates the topic when the user shifts to a genuinely different area of work.
+
 ## Rules
 
 1. After reading each user message, infer a topic of **2-4 words** (max 20 characters) that reflects what the user is currently working on
@@ -28,11 +33,14 @@ This skill activates on **every user message**. Run it silently — do not menti
 
 ```bash
 SESSION_ID=$(cat "$HOME/.claude/session-topics/.active-session" 2>/dev/null)
-if [ -n "$SESSION_ID" ]; then
-    TOPIC_FILE="$HOME/.claude/session-topics/${SESSION_ID}"
-    CURRENT_TOPIC=$(cat "$TOPIC_FILE" 2>/dev/null || echo "")
-    echo "Current topic: '$CURRENT_TOPIC'"
+SESSION_ID=$(echo "$SESSION_ID" | tr -cd 'a-zA-Z0-9_-')
+if [ -z "$SESSION_ID" ]; then
+    echo "No active session found. Skipping."
+    exit 0
 fi
+TOPIC_FILE="$HOME/.claude/session-topics/${SESSION_ID}"
+CURRENT_TOPIC=$(cat "$TOPIC_FILE" 2>/dev/null || echo "")
+echo "Current topic: '$CURRENT_TOPIC'"
 ```
 
 ### Step 2: Decide whether to update
@@ -41,11 +49,12 @@ Compare the inferred new topic with the current topic. **Only write a new topic
 - Minor variations of the same topic (e.g., "Auth Refactor" → "Refactor Auth")
 - Subtasks within the same broader topic (e.g., "Auth Refactor" → "Auth Tests" if still working on auth)
 - Rewording without a real subject change
+- The first message (the Stop hook already handles initial topic setting)
 
 DO update when:
 - The user has moved to a genuinely different area of work (e.g., "Auth Refactor" → "DB Migration")
 - The original topic no longer describes what the conversation is about
-- There is no current topic yet (first message)
+- The hook-generated topic is too generic and you can infer a better one from context
 
 ### Step 3: Write the new topic (only if changed)
 
@@ -53,18 +62,21 @@ If the topic has meaningfully changed, run:
 
 ```bash
 SESSION_ID=$(cat "$HOME/.claude/session-topics/.active-session" 2>/dev/null)
-if [ -n "$SESSION_ID" ]; then
-    mkdir -p "$HOME/.claude/session-topics"
-    echo "Your New Topic" > "$HOME/.claude/session-topics/${SESSION_ID}"
+SESSION_ID=$(echo "$SESSION_ID" | tr -cd 'a-zA-Z0-9_-')
+if [ -z "$SESSION_ID" ]; then
+    exit 0
 fi
+mkdir -p "$HOME/.claude/session-topics"
+printf '%s\n' "Your New Topic" > "$HOME/.claude/session-topics/${SESSION_ID}"
 ```
 
-Replace `Your New Topic` with the inferred 2-4 word topic.
+Replace `Your New Topic` with the inferred 2-4 word topic. The topic must contain only safe display text (letters, numbers, spaces, basic punctuation).
 
 If the topic has NOT meaningfully changed, **do nothing** — skip the write entirely.
 
 ## Important
 
+- The Stop hook sets the initial topic automatically — this skill complements it by handling topic evolution
 - Run this on **every** user message, but only write when the topic has genuinely changed
 - Do NOT mention the topic to the user — ever
 - Keep topics short and descriptive (2-4 words, max 20 characters)

package/skills/set-topic/SKILL.md

@@ -18,17 +18,24 @@ Set or change the topic displayed in the Claude Code statusline.
 
 1. The topic text is: $ARGUMENTS
 2. If the topic text is empty, inform the user they need to provide a topic (e.g., `/set-topic Auth Refactor`)
-3. Run this bash command to discover the session ID and write the topic file:
+3. **Sanitize the arguments:** Before writing, the topic must be cleaned to contain only safe display text — letters, numbers, spaces, and basic punctuation (`.,-:!?'`). Strip any shell metacharacters or non-printable characters, and truncate to a maximum of 100 characters.
+4. Run this bash command to discover the session ID, sanitize inputs, and write the topic file:
 
 ```bash
 SESSION_ID=$(cat "$HOME/.claude/session-topics/.active-session" 2>/dev/null)
-if [ -n "$SESSION_ID" ]; then
-    mkdir -p "$HOME/.claude/session-topics"
-    echo "$ARGUMENTS" > "$HOME/.claude/session-topics/${SESSION_ID}"
-    echo "Topic set to: $ARGUMENTS"
-else
+SESSION_ID=$(echo "$SESSION_ID" | tr -cd 'a-zA-Z0-9_-')
+if [ -z "$SESSION_ID" ]; then
     echo "Error: No active session found. The statusline must run at least once before setting a topic."
+    exit 1
 fi
+TOPIC=$(printf '%s' "$ARGUMENTS" | tr -cd 'a-zA-Z0-9 .,:!?'"'"'-' | cut -c1-100)
+if [ -z "$TOPIC" ]; then
+    echo "Error: Topic text is empty after sanitization."
+    exit 1
+fi
+mkdir -p "$HOME/.claude/session-topics"
+printf '%s\n' "$TOPIC" > "$HOME/.claude/session-topics/${SESSION_ID}"
+echo "Topic set to: $TOPIC"
 ```
 
-4. Confirm to the user that the topic has been set and will appear in the statusline.
+5. Confirm to the user that the topic has been set and will appear in the statusline.