@jxtools/promptline 1.3.7 → 1.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxtools/promptline",
-  "version": "1.3.7",
+  "version": "1.3.9",
   "type": "module",
   "license": "ISC",
   "bin": {

package/promptline-session-end.sh

@@ -32,10 +32,11 @@ else
   exit 0
 fi
 
-export QUEUE_FILE
+QUEUE_DIR="$(dirname "$QUEUE_FILE")"
+export QUEUE_FILE QUEUE_DIR SESSION_ID
 
 python3 << 'PYEOF'
-import json, os, tempfile
+import json, os, glob, tempfile
 from datetime import datetime, timezone
 
 def atomic_write(path, obj):
@@ -50,18 +51,39 @@ def atomic_write(path, obj):
         except OSError: pass
         raise
 
+def close_session(path, now):
+    with open(path, "r") as f:
+        data = json.load(f)
+    data["closedAt"] = now
+    data["lastActivity"] = now
+    atomic_write(path, data)
+
 queue_file = os.environ["QUEUE_FILE"]
+queue_dir = os.environ["QUEUE_DIR"]
+session_id = os.environ["SESSION_ID"]
 now = datetime.now(timezone.utc).isoformat()
 
 try:
-    with open(queue_file, "r") as f:
-        data = json.load(f)
-    data["closedAt"] = now
-    data["lastActivity"] = now
-    atomic_write(queue_file, data)
+    close_session(queue_file, now)
 except (json.JSONDecodeError, IOError, OSError):
     pass
 
+# Close orphaned sessions in the same project
+for path in glob.glob(os.path.join(queue_dir, "*.json")):
+    if os.path.basename(path) == f"{session_id}.json":
+        continue
+    try:
+        with open(path, "r") as f:
+            data = json.load(f)
+        if data.get("closedAt") is not None:
+            continue
+        has_pending = any(p.get("status") in ("pending", "running") for p in data.get("prompts", []))
+        if has_pending:
+            continue
+        close_session(path, now)
+    except (json.JSONDecodeError, IOError, OSError):
+        continue
+
 PYEOF
 
 exit 0

package/src/components/SessionSection.tsx

@@ -37,6 +37,7 @@ export function SessionSection({ session, project, onMutate, defaultExpanded = t
 
   async function handleClearPrompts(e: React.MouseEvent) {
     e.stopPropagation();
+    if (!window.confirm('Clear all prompts?')) return;
     try {
       await api.clearPrompts(project, session.sessionId);
       onMutate();

package/vite-plugin-api.ts

@@ -23,6 +23,10 @@ import {
 
 const QUEUES_DIR = join(homedir(), '.promptline', 'queues');
 
+export function isSafeSegment(s: string): boolean {
+  return s.length > 0 && !s.includes('/') && !s.includes('\\') && !s.includes('..');
+}
+
 function parseBody(req: IncomingMessage): Promise<Record<string, unknown>> {
   return new Promise((resolve, reject) => {
     let body = '';
@@ -160,6 +164,10 @@ async function handleApi(
   // Parse URL segments: /api/projects/:project/sessions/:sessionId/prompts/:promptId
   const segments = url.replace(/^\/api\//, '').split('/').map(decodeURIComponent);
 
+  if (!segments.every(isSafeSegment)) {
+    return jsonError(res, 400, 'Invalid path segment');
+  }
+
   // GET /api/projects
   if (segments[0] === 'projects' && segments.length === 1 && method === 'GET') {
     return json(res, 200, listProjects(QUEUES_DIR));