@jxtools/promptline 1.3.6 → 1.3.8

package/bin/promptline.mjs

@@ -4,7 +4,6 @@ import { existsSync, readFileSync, writeFileSync, copyFileSync, chmodSync } from
 import { resolve, dirname, join } from 'path'
 import { fileURLToPath } from 'url'
 import { spawn, execSync } from 'child_process'
-import { createInterface } from 'readline'
 import { homedir } from 'os'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
@@ -59,32 +58,7 @@ const hookFiles = [
   'promptline-session-end.sh',
 ]
 
-const allHooksInstalled = hookFiles.every(f => existsSync(join(hooksDir, f)))
-
-if (!allHooksInstalled) {
-  const answer = await ask('Install PromptLine hooks for Claude Code? (Y/n) ')
-
-  if (answer.toLowerCase() === 'n') {
-    console.log('  Skipped. Run promptline again to install later.')
-    process.exit(0)
-  }
-
-  installHooks()
-} else {
-  const hooksOutdated = hookFiles.some(f => {
-    try {
-      const src = readFileSync(join(pkgDir, f), 'utf-8')
-      const dest = readFileSync(join(hooksDir, f), 'utf-8')
-      return src !== dest
-    } catch {
-      return true
-    }
-  })
-
-  if (hooksOutdated) {
-    installHooks()
-  }
-}
+installHooks()
 
 // Start Vite dev server
 const viteBin = resolve(pkgDir, 'node_modules', '.bin', 'vite')
@@ -127,16 +101,6 @@ process.on('SIGINT', () => {
 
 // --- Helpers ---
 
-function ask(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout })
-  return new Promise((resolve) => {
-    rl.question(question, (answer) => {
-      rl.close()
-      resolve(answer.trim() || 'y')
-    })
-  })
-}
-
 function installHooks() {
   // Copy hook scripts
   execSync(`mkdir -p "${hooksDir}"`)
@@ -191,5 +155,4 @@ function installHooks() {
   }
 
   writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n')
-  console.log(`\x1b[32m✓\x1b[0m Hooks installed`)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxtools/promptline",
-  "version": "1.3.6",
+  "version": "1.3.8",
   "type": "module",
   "license": "ISC",
   "bin": {

package/src/components/SessionSection.tsx

@@ -37,6 +37,7 @@ export function SessionSection({ session, project, onMutate, defaultExpanded = t
 
   async function handleClearPrompts(e: React.MouseEvent) {
     e.stopPropagation();
+    if (!window.confirm('Clear all prompts?')) return;
     try {
       await api.clearPrompts(project, session.sessionId);
       onMutate();

package/vite-plugin-api.ts

@@ -23,6 +23,10 @@ import {
 
 const QUEUES_DIR = join(homedir(), '.promptline', 'queues');
 
+export function isSafeSegment(s: string): boolean {
+  return s.length > 0 && !s.includes('/') && !s.includes('\\') && !s.includes('..');
+}
+
 function parseBody(req: IncomingMessage): Promise<Record<string, unknown>> {
   return new Promise((resolve, reject) => {
     let body = '';
@@ -160,6 +164,10 @@ async function handleApi(
   // Parse URL segments: /api/projects/:project/sessions/:sessionId/prompts/:promptId
   const segments = url.replace(/^\/api\//, '').split('/').map(decodeURIComponent);
 
+  if (!segments.every(isSafeSegment)) {
+    return jsonError(res, 400, 'Invalid path segment');
+  }
+
   // GET /api/projects
   if (segments[0] === 'projects' && segments.length === 1 && method === 'GET') {
     return json(res, 200, listProjects(QUEUES_DIR));