claudectx 1.1.0 → 1.1.1

package/dist/index.mjs

@@ -2225,12 +2225,12 @@ async function handleLogStdin() {
   }
 }
 function readStdin() {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => data += chunk);
-    process.stdin.on("end", () => resolve11(data));
-    setTimeout(() => resolve11(data), 500);
+    process.stdin.on("end", () => resolve12(data));
+    setTimeout(() => resolve12(data), 500);
   });
 }
 
@@ -3223,29 +3223,65 @@ async function executeWarmup(claudeMdContent, model, ttl, client) {
     timestamp: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function installCron(cronExpr, apiKey) {
+function isValidCronExpr(expr) {
+  const parts = expr.trim().split(/\s+/);
+  if (parts.length < 5 || parts.length > 6) return false;
+  return parts.every((p) => /^[0-9*,/\-]+$/.test(p));
+}
+async function installCron(cronExpr) {
+  if (!isValidCronExpr(cronExpr)) {
+    process.stderr.write(
+      `Error: invalid cron expression "${cronExpr}".
+  Example: "0 9 * * 1-5" (weekdays at 9am)
+`
+    );
+    process.exit(1);
+  }
   const { execSync: execSync3 } = await import("child_process");
-  const command = `claudectx warmup --api-key ${apiKey}`;
+  const command = `claudectx warmup`;
   const cronLine = `${cronExpr} ${command}`;
+  const marker = "# claudectx warmup";
   try {
     let existing = "";
     try {
-      existing = execSync3("crontab -l 2>/dev/null", { encoding: "utf-8" });
+      existing = execSync3("crontab -l", {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"]
+      });
     } catch {
       existing = "";
     }
-    if (existing.includes("claudectx warmup")) {
-      process.stdout.write("Cron job already installed for claudectx warmup.\n");
+    if (existing.includes(marker)) {
+      process.stdout.write("  Cron job already installed for claudectx warmup.\n");
       return;
     }
-    const newCrontab = existing.trimEnd() + "\n" + cronLine + "\n";
-    execSync3(`echo ${JSON.stringify(newCrontab)} | crontab -`);
-    process.stdout.write(`\u2713 Cron job installed: ${cronLine}
+    const newCrontab = existing.trimEnd() + `
+${marker}
+${cronLine}
+`;
+    const { writeFileSync: writeFileSync11, unlinkSync: unlinkSync2 } = await import("fs");
+    const { tmpdir } = await import("os");
+    const { join: join17 } = await import("path");
+    const tmpFile = join17(tmpdir(), `claudectx-cron-${Date.now()}.txt`);
+    try {
+      writeFileSync11(tmpFile, newCrontab, "utf-8");
+      execSync3(`crontab ${tmpFile}`, { stdio: ["pipe", "pipe", "pipe"] });
+    } finally {
+      try {
+        unlinkSync2(tmpFile);
+      } catch {
+      }
+    }
+    process.stdout.write(`  \u2713 Cron job installed: ${cronLine}
 `);
+    process.stdout.write("  Note: Set ANTHROPIC_API_KEY in your cron environment (e.g. via ~/.profile).\n");
   } catch {
-    process.stdout.write(`Could not install cron automatically. Add manually:
+    process.stdout.write(
+      `  Could not install cron automatically. Add this line manually with "crontab -e":
+  ANTHROPIC_API_KEY=<your-key>
   ${cronLine}
-`);
+`
+    );
   }
 }
 async function warmupCommand(options) {
@@ -3315,7 +3351,7 @@ async function warmupCommand(options) {
   }
   process.stdout.write("\n");
   if (options.cron) {
-    await installCron(options.cron, apiKey);
+    await installCron(options.cron);
   }
 }
 
@@ -3374,15 +3410,15 @@ async function findGitDeletedMentions(content, projectRoot) {
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
     for (const deleted of deletedFiles) {
-      const basename7 = path23.basename(deleted);
-      if (line.includes(basename7) || line.includes(deleted)) {
+      const basename8 = path23.basename(deleted);
+      if (line.includes(basename8) || line.includes(deleted)) {
         issues.push({
           type: "git-deleted",
           line: i + 1,
           text: line.trim(),
           severity: "warning",
           estimatedTokenWaste: countTokens(line),
-          suggestion: `References "${basename7}" which was deleted from git. Consider removing this mention.`
+          suggestion: `References "${basename8}" which was deleted from git. Consider removing this mention.`
         });
         break;
       }
@@ -3589,11 +3625,34 @@ async function applyFix(claudeMdPath, issues) {
   const lines = content.split("\n");
   const lineSet = new Set(selectedLines.map((l) => l - 1));
   const newLines = lines.filter((_, i) => !lineSet.has(i));
-  fs20.writeFileSync(claudeMdPath, newLines.join("\n"), "utf-8");
+  const newContent = newLines.join("\n");
+  const backupPath = `${claudeMdPath}.bak`;
+  fs20.writeFileSync(backupPath, content, "utf-8");
+  const os5 = await import("os");
+  const tmpPath = `${claudeMdPath}.tmp-${Date.now()}`;
+  try {
+    fs20.writeFileSync(tmpPath, newContent, "utf-8");
+    fs20.renameSync(tmpPath, claudeMdPath);
+  } catch (err) {
+    try {
+      fs20.copyFileSync(backupPath, claudeMdPath);
+    } catch {
+    }
+    try {
+      fs20.unlinkSync(tmpPath);
+    } catch {
+    }
+    process.stderr.write(`Error writing CLAUDE.md: ${err instanceof Error ? err.message : String(err)}
+`);
+    process.exit(1);
+  }
   process.stdout.write(`
-  \u2713 Removed ${selectedLines.length} line(s) from ${claudeMdPath}
+  \u2713 Removed ${selectedLines.length} line(s) from ${path24.basename(claudeMdPath)}
+`);
+  process.stdout.write(`  \u2713 Backup saved to ${backupPath}
 
 `);
+  void os5;
 }
 
 // src/commands/hooks.ts
@@ -3609,10 +3668,10 @@ var HOOK_REGISTRY = [
     description: "Compress session when token count exceeds threshold",
     triggerEvent: "PostToolUse",
     matcher: "Read",
-    commandTemplate: "claudectx compress --auto --api-key {{config.apiKey}}",
+    // API key is read from ANTHROPIC_API_KEY env var — never stored in settings.json
+    commandTemplate: "claudectx compress --auto",
     configSchema: {
-      threshold: { type: "number", default: 5e4, description: "Token threshold to trigger compression" },
-      apiKey: { type: "string", description: "Anthropic API key for AI summarization", required: true }
+      threshold: { type: "number", default: 5e4, description: "Token threshold to trigger compression" }
     },
     category: "compression"
   },
@@ -3645,10 +3704,9 @@ var HOOK_REGISTRY = [
     description: "Pre-warm the Anthropic prompt cache on each session start",
     triggerEvent: "PostToolUse",
     matcher: "Read",
-    commandTemplate: "claudectx warmup --api-key {{config.apiKey}}",
-    configSchema: {
-      apiKey: { type: "string", description: "Anthropic API key", required: true }
-    },
+    // API key is read from ANTHROPIC_API_KEY env var — never stored in settings.json
+    commandTemplate: "claudectx warmup",
+    configSchema: {},
     category: "warmup"
   }
 ];
@@ -3677,9 +3735,18 @@ function buildHookEntry(def, config) {
 // src/commands/hooks.ts
 function readInstalledHooks(projectRoot) {
   const settingsPath = path25.join(projectRoot, ".claude", "settings.local.json");
+  if (!fs21.existsSync(settingsPath)) return {};
   try {
     return JSON.parse(fs21.readFileSync(settingsPath, "utf-8"));
   } catch {
+    process.stderr.write(
+      `Warning: ${settingsPath} exists but contains invalid JSON. Existing settings will be preserved as a backup.
+`
+    );
+    try {
+      fs21.copyFileSync(settingsPath, `${settingsPath}.bak`);
+    } catch {
+    }
     return {};
   }
 }
@@ -3766,6 +3833,16 @@ async function hooksAdd(name, projectRoot, configPairs) {
 `);
     process.exit(1);
   }
+  const sensitiveKeys = Object.keys(config).filter(
+    (k) => /key|token|secret|password|webhook/i.test(k)
+  );
+  if (sensitiveKeys.length > 0) {
+    process.stderr.write(
+      `Warning: config field(s) [${sensitiveKeys.join(", ")}] will be stored in plain text in
+  .claude/settings.local.json \u2014 ensure this file is in your .gitignore.
+`
+    );
+  }
   const entry = { ...buildHookEntry(def, config), name };
   const settings = readInstalledHooks(projectRoot);
   const hooksObj = settings.hooks ?? {};
@@ -3930,7 +4007,9 @@ Converting CLAUDE.md \u2192 ${files.length} Cursor rule file(s)
 `);
     for (const file of files) {
       const filePath = path26.join(targetDir, file.filename);
-      process.stdout.write(`  ${options.dryRun ? "[dry-run] " : ""}\u2192 .cursor/rules/${file.filename}
+      const exists = fs22.existsSync(filePath);
+      const prefix = options.dryRun ? "[dry-run] " : exists ? "[overwrite] " : "";
+      process.stdout.write(`  ${prefix}\u2192 .cursor/rules/${file.filename}
 `);
       if (!options.dryRun) {
         fs22.mkdirSync(targetDir, { recursive: true });
@@ -3941,8 +4020,9 @@ Converting CLAUDE.md \u2192 ${files.length} Cursor rule file(s)
   } else if (to === "copilot") {
     const converted = claudeMdToCopilot(content);
     const targetPath = path26.join(projectRoot, ".github", "copilot-instructions.md");
+    const exists = fs22.existsSync(targetPath);
     process.stdout.write(`
-Converting CLAUDE.md \u2192 .github/copilot-instructions.md
+Converting CLAUDE.md \u2192 .github/copilot-instructions.md${exists ? " [overwrite]" : ""}
 `);
     if (!options.dryRun) {
       fs22.mkdirSync(path26.dirname(targetPath), { recursive: true });
@@ -3958,8 +4038,9 @@ Converting CLAUDE.md \u2192 .github/copilot-instructions.md
   } else if (to === "windsurf") {
     const converted = claudeMdToWindsurf(content);
     const targetPath = path26.join(projectRoot, ".windsurfrules");
+    const exists = fs22.existsSync(targetPath);
     process.stdout.write(`
-Converting CLAUDE.md \u2192 .windsurfrules
+Converting CLAUDE.md \u2192 .windsurfrules${exists ? " [overwrite]" : ""}
 `);
     if (!options.dryRun) {
       fs22.writeFileSync(targetPath, converted, "utf-8");
@@ -4233,7 +4314,26 @@ async function teamsShare(options) {
   }
   const latest = exportFiles[0];
   const src = path28.join(storeDir, latest);
-  const destPath = fs24.statSync(dest).isDirectory() ? path28.join(dest, latest) : dest;
+  let destPath;
+  try {
+    const stat = fs24.statSync(dest);
+    destPath = stat.isDirectory() ? path28.join(dest, latest) : dest;
+  } catch {
+    destPath = dest;
+  }
+  const destDir = path28.dirname(path28.resolve(destPath));
+  let resolvedDir;
+  try {
+    resolvedDir = fs24.realpathSync(destDir);
+  } catch {
+    resolvedDir = destDir;
+  }
+  const systemDirs = ["/etc", "/bin", "/sbin", "/usr", "/var", "/proc", "/sys"];
+  if (systemDirs.some((d) => resolvedDir === d || resolvedDir.startsWith(d + "/"))) {
+    process.stderr.write(`Error: destination path resolves to a system directory (${resolvedDir}). Aborting.
+`);
+    process.exit(1);
+  }
   fs24.copyFileSync(src, destPath);
   process.stdout.write(`  \u2713 Copied ${latest} \u2192 ${destPath}