hotsheet 0.7.0 → 0.9.0

package/dist/cli.js

@@ -519,10 +519,17 @@ async function isChannelAlive(dataDir2) {
 async function triggerChannel(dataDir2, serverPort, message) {
   const port2 = getChannelPort(dataDir2);
   if (!port2) return false;
+  let secretHeader = "";
+  try {
+    const { readFileSettings: readFileSettings2 } = await Promise.resolve().then(() => (init_file_settings(), file_settings_exports));
+    const settings = readFileSettings2(dataDir2);
+    if (settings.secret) secretHeader = ` -H "X-Hotsheet-Secret: ${settings.secret}"`;
+  } catch {
+  }
   const doneSignal = `
 
 When you are completely finished (or if there was nothing to do), signal completion by running:
-curl -s -X POST http://localhost:${serverPort}/api/channel/done`;
+curl -s -X POST http://localhost:${serverPort}/api/channel/done${secretHeader}`;
   const content = message ? message + doneSignal : "Process the Hot Sheet worklist. Run /hotsheet to work through the current Up Next items." + doneSignal;
   try {
     const res = await fetch(`http://127.0.0.1:${port2}/trigger`, {
@@ -545,7 +552,7 @@ var init_channel_config = __esm({
 // src/cli.ts
 import { mkdirSync as mkdirSync6 } from "fs";
 import { tmpdir } from "os";
-import { join as join12, resolve as resolve3 } from "path";
+import { join as join12, resolve as resolve4 } from "path";
 
 // src/backup.ts
 init_connection();
@@ -2387,7 +2394,7 @@ import { fileURLToPath as fileURLToPath2 } from "url";
 // src/routes/api.ts
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, rmSync as rmSync5 } from "fs";
 import { Hono } from "hono";
-import { basename, extname, join as join9, relative as relative2 } from "path";
+import { basename, extname, join as join9, relative as relative2, resolve as resolve3 } from "path";
 
 // src/skills.ts
 init_file_settings();
@@ -2879,8 +2886,8 @@ function notifyChange() {
   changeVersion++;
   const waiters = pollWaiters;
   pollWaiters = [];
-  for (const resolve4 of waiters) {
-    resolve4(changeVersion);
+  for (const resolve5 of waiters) {
+    resolve5(changeVersion);
   }
 }
 apiRoutes.get("/poll", async (c) => {
@@ -2889,11 +2896,11 @@ apiRoutes.get("/poll", async (c) => {
     return c.json({ version: changeVersion });
   }
   const version = await Promise.race([
-    new Promise((resolve4) => {
-      pollWaiters.push(resolve4);
+    new Promise((resolve5) => {
+      pollWaiters.push(resolve5);
     }),
-    new Promise((resolve4) => {
-      setTimeout(() => resolve4(changeVersion), 3e4);
+    new Promise((resolve5) => {
+      setTimeout(() => resolve5(changeVersion), 3e4);
     })
   ]);
   return c.json({ version });
@@ -3133,7 +3140,11 @@ apiRoutes.post("/attachments/:id/reveal", async (c) => {
 apiRoutes.get("/attachments/file/*", async (c) => {
   const filePath = c.req.path.replace("/api/attachments/file/", "");
   const dataDir2 = c.get("dataDir");
-  const fullPath = join9(dataDir2, "attachments", filePath);
+  const attachDir = resolve3(join9(dataDir2, "attachments"));
+  const fullPath = resolve3(join9(attachDir, filePath));
+  if (!fullPath.startsWith(attachDir + "/") && fullPath !== attachDir) {
+    return c.json({ error: "Invalid path" }, 403);
+  }
   if (!existsSync7(fullPath)) {
     return c.json({ error: "File not found" }, 404);
   }
@@ -3206,7 +3217,8 @@ apiRoutes.patch("/settings", async (c) => {
 apiRoutes.get("/file-settings", async (c) => {
   const { readFileSettings: readFileSettings2 } = await Promise.resolve().then(() => (init_file_settings(), file_settings_exports));
   const dataDir2 = c.get("dataDir");
-  return c.json(readFileSettings2(dataDir2));
+  const { secret, secretPathHash, port: port2, ...safe } = readFileSettings2(dataDir2);
+  return c.json(safe);
 });
 apiRoutes.patch("/file-settings", async (c) => {
   const { writeFileSettings: writeFileSettings2 } = await Promise.resolve().then(() => (init_file_settings(), file_settings_exports));
@@ -3837,7 +3849,7 @@ pageRoutes.get("/", (c) => {
                 /* @__PURE__ */ jsx("div", { id: "detail-attachments", className: "detail-attachments" }),
                 /* @__PURE__ */ jsx("label", { className: "btn btn-sm upload-btn", children: [
                   "Attach File",
-                  /* @__PURE__ */ jsx("input", { type: "file", id: "detail-file-input", style: "display:none" })
+                  /* @__PURE__ */ jsx("input", { type: "file", id: "detail-file-input", style: "display:none", multiple: true })
                 ] })
               ] }),
               /* @__PURE__ */ jsx("div", { className: "detail-field detail-field-full", id: "detail-notes-section", children: [
@@ -3862,7 +3874,7 @@ pageRoutes.get("/", (c) => {
             /* @__PURE__ */ jsx("kbd", { children: "Enter" }),
             " new ticket"
           ] }),
-          /* @__PURE__ */ jsx("span", { children: [
+          /* @__PURE__ */ jsx("span", { "data-hint": "category", children: [
             /* @__PURE__ */ jsx("kbd", { children: [
               "\u2318",
               "I/B/F/R/K/G"
@@ -3958,7 +3970,10 @@ pageRoutes.get("/", (c) => {
         /* @__PURE__ */ jsx("div", { className: "settings-tab-panel active", "data-panel": "general", children: [
           /* @__PURE__ */ jsx("div", { className: "settings-field", children: [
             /* @__PURE__ */ jsx("label", { children: "App name" }),
-            /* @__PURE__ */ jsx("input", { type: "text", id: "settings-app-name", placeholder: "Hot Sheet" }),
+            /* @__PURE__ */ jsx("div", { className: "settings-app-name-row", children: [
+              /* @__PURE__ */ jsx("button", { className: "app-icon-picker-btn", id: "app-icon-picker-btn", title: "Change app icon", children: /* @__PURE__ */ jsx("img", { id: "app-icon-preview", src: "/static/assets/icon-default.png", width: "28", height: "28" }) }),
+              /* @__PURE__ */ jsx("input", { type: "text", id: "settings-app-name", placeholder: "Hot Sheet" })
+            ] }),
             /* @__PURE__ */ jsx("span", { className: "settings-hint", id: "settings-app-name-hint", children: "Custom name shown in the title bar. Leave empty for default." })
           ] }),
           /* @__PURE__ */ jsx("div", { className: "settings-field", children: [
@@ -4062,10 +4077,10 @@ pageRoutes.get("/", (c) => {
 
 // src/server.ts
 function tryServe(fetch2, port2) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const server = serve({ fetch: fetch2, port: port2 });
     server.on("listening", () => {
-      resolve4(port2);
+      resolve5(port2);
     });
     server.on("error", (err) => {
       reject(err);
@@ -4098,15 +4113,33 @@ async function startServer(port2, dataDir2, options) {
     return new Response(content, { headers: { "Content-Type": mimeTypes[ext || ""] || "application/octet-stream", "Cache-Control": "max-age=86400" } });
   });
   app.use("/api/*", async (c, next) => {
+    const settings = readFileSettings(dataDir2);
+    const expectedSecret = settings.secret;
+    if (!expectedSecret) {
+      await next();
+      return;
+    }
     const headerSecret = c.req.header("X-Hotsheet-Secret");
+    const method = c.req.method;
+    const isMutation = method === "POST" || method === "PATCH" || method === "PUT" || method === "DELETE";
     if (headerSecret) {
-      const settings = readFileSettings(dataDir2);
-      if (settings.secret && headerSecret !== settings.secret) {
+      if (headerSecret !== expectedSecret) {
         return c.json({
           error: "Secret mismatch \u2014 you may be connecting to the wrong Hot Sheet instance.",
           recovery: "Re-read .hotsheet/settings.json to get the correct port and secret, and re-read your skill files (e.g. .claude/skills/hotsheet/SKILL.md) for updated instructions."
         }, 403);
       }
+    } else if (isMutation) {
+      const origin = c.req.header("Origin");
+      const referer = c.req.header("Referer");
+      const localhostPattern = /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?(\/|$)/;
+      const isSameOrigin = origin && localhostPattern.test(origin) || referer && localhostPattern.test(referer);
+      if (!isSameOrigin) {
+        return c.json({
+          error: "Missing X-Hotsheet-Secret header. Read .hotsheet/settings.json for the correct port and secret.",
+          recovery: "Re-read .hotsheet/settings.json to get the correct port and secret, and re-read your skill files for updated instructions."
+        }, 403);
+      }
     }
     await next();
   });
@@ -4186,10 +4219,10 @@ function isFirstUseToday() {
   return last !== today;
 }
 function fetchLatestVersion() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const req = get(`https://registry.npmjs.org/${PACKAGE_NAME}/latest`, { timeout: 5e3 }, (res) => {
       if (res.statusCode !== 200) {
-        resolve4(null);
+        resolve5(null);
         return;
       }
       let data = "";
@@ -4198,18 +4231,18 @@ function fetchLatestVersion() {
       });
       res.on("end", () => {
         try {
-          resolve4(JSON.parse(data).version);
+          resolve5(JSON.parse(data).version);
         } catch {
-          resolve4(null);
+          resolve5(null);
         }
       });
     });
     req.on("error", () => {
-      resolve4(null);
+      resolve5(null);
     });
     req.on("timeout", () => {
       req.destroy();
-      resolve4(null);
+      resolve5(null);
     });
   });
 }
@@ -4311,7 +4344,7 @@ function parseArgs(argv) {
         }
         break;
       case "--data-dir":
-        dataDir2 = resolve3(args[++i]);
+        dataDir2 = resolve4(args[++i]);
         break;
       case "--check-for-updates":
         forceUpdateCheck = true;