pmpt-cli 1.7.0 → 1.7.1

package/README.md

@@ -20,30 +20,9 @@ No coding required. No complex setup. Just answer 5 questions.
 
 ## Demo
 
-```
-$ pmpt plan
-
-┌  pmpt — Let's plan your product!
-│
-◆  What should we call your project?
-│  my-budget-app
-│
-◆  What would you like to build with AI?
-│  A personal budget tracking app for freelancers
-│
-◆  Any additional context AI should know? (optional)
-│  Simple UI, mobile-friendly, works offline
-│
-◆  Key features to include?
-│  Expense tracking; Income categories; Monthly reports; Export to CSV
-│
-◆  Preferred tech stack? (optional)
-│  React, Node.js
-│
-└  Done! AI prompt copied to clipboard.
-
-→ Open Claude / ChatGPT / Cursor → Ctrl+V → Start building!
-```
+<img src="./demo.gif" alt="pmpt plan demo" width="600" />
+
+> Answer 5 questions → AI prompt auto-generated & copied to clipboard → Paste into Claude Code / Codex / Cursor → Start building!
 
 ---
 
@@ -69,7 +48,7 @@ pmpt init
 # 3. Answer 5 questions → AI prompt auto-generated & copied
 pmpt plan
 
-# 4. Paste into Claude / ChatGPT / Cursor → Build your product!
+# 4. Paste into Claude Code / Codex / Cursor → Build your product!
 
 # 5. Save your progress anytime
 pmpt save
@@ -124,13 +103,14 @@ The generated prompt is **automatically copied to your clipboard**. Just paste i
 | `pmpt squash v2 v5` | Merge versions v2–v5 into one |
 | `pmpt export` | Export project as `.pmpt` file |
 | `pmpt import <file>` | Import from `.pmpt` file |
+| `pmpt recover` | Recover damaged pmpt.md via AI-generated prompt |
 
 ### Platform
 
 | Command | Description |
 |---------|-------------|
 | `pmpt login` | Authenticate via GitHub (one-time) |
-| `pmpt publish` | Publish your project for others to discover |
+| `pmpt publish` | Publish your project (requires pmpt.md) |
 | `pmpt edit` | Edit published project metadata (description, tags, category) |
 | `pmpt unpublish` | Remove a published project from pmptwiki |
 | `pmpt clone <slug>` | Clone and reproduce someone's project |

package/dist/commands/browse.js

@@ -64,7 +64,7 @@ export async function cmdBrowse() {
         return;
     }
     if (action === 'url') {
-        const url = `https://pmptwiki.com/ko/p/${project.slug}`;
+        const url = `https://pmptwiki.com/p/${project.slug}`;
         p.log.info(`URL: ${url}`);
         p.log.message(`Download: ${project.downloadUrl}`);
         p.log.message(`\npmpt clone ${project.slug}  — clone via terminal`);

package/dist/commands/clone.js

@@ -1,8 +1,8 @@
 import * as p from '@clack/prompts';
-import { join, dirname } from 'path';
+import { join, dirname, resolve, sep } from 'path';
 import { existsSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { isInitialized, getConfigDir, getHistoryDir, getDocsDir, initializeProject } from '../lib/config.js';
-import { validatePmptFile } from '../lib/pmptFile.js';
+import { validatePmptFile, isSafeFilename } from '../lib/pmptFile.js';
 import { fetchPmptFile } from '../lib/api.js';
 /**
  * Restore history from .pmpt data (shared with import command)
@@ -15,7 +15,12 @@ export function restoreHistory(historyDir, history) {
         const snapshotDir = join(historyDir, snapshotName);
         mkdirSync(snapshotDir, { recursive: true });
         for (const [filename, content] of Object.entries(version.files)) {
+            if (!isSafeFilename(filename))
+                continue; // skip unsafe filenames
             const filePath = join(snapshotDir, filename);
+            // Double-check resolved path stays within snapshot dir
+            if (!resolve(filePath).startsWith(resolve(snapshotDir) + sep))
+                continue;
             const fileDir = dirname(filePath);
             if (fileDir !== snapshotDir) {
                 mkdirSync(fileDir, { recursive: true });
@@ -36,7 +41,11 @@ export function restoreHistory(historyDir, history) {
 export function restoreDocs(docsDir, docs) {
     mkdirSync(docsDir, { recursive: true });
     for (const [filename, content] of Object.entries(docs)) {
+        if (!isSafeFilename(filename))
+            continue; // skip unsafe filenames
         const filePath = join(docsDir, filename);
+        if (!resolve(filePath).startsWith(resolve(docsDir) + sep))
+            continue;
         const fileDir = dirname(filePath);
         if (fileDir !== docsDir) {
             mkdirSync(fileDir, { recursive: true });

package/dist/commands/import.js

@@ -1,8 +1,8 @@
 import * as p from '@clack/prompts';
-import { resolve, join, dirname } from 'path';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'fs';
+import { resolve, join, dirname, sep } from 'path';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync, rmSync } from 'fs';
 import { isInitialized, getConfigDir, getHistoryDir, getDocsDir, initializeProject } from '../lib/config.js';
-import { validatePmptFile } from '../lib/pmptFile.js';
+import { validatePmptFile, isSafeFilename } from '../lib/pmptFile.js';
 /**
  * Restore history from .pmpt file
  */
@@ -13,9 +13,13 @@ function restoreHistory(historyDir, history) {
         const snapshotName = `v${version.version}-${timestamp}`;
         const snapshotDir = join(historyDir, snapshotName);
         mkdirSync(snapshotDir, { recursive: true });
-        // Write files
+        // Write files (with path traversal protection)
         for (const [filename, content] of Object.entries(version.files)) {
+            if (!isSafeFilename(filename))
+                continue;
             const filePath = join(snapshotDir, filename);
+            if (!resolve(filePath).startsWith(resolve(snapshotDir) + sep))
+                continue;
             const fileDir = dirname(filePath);
             if (fileDir !== snapshotDir) {
                 mkdirSync(fileDir, { recursive: true });
@@ -38,7 +42,11 @@ function restoreHistory(historyDir, history) {
 function restoreDocs(docsDir, docs) {
     mkdirSync(docsDir, { recursive: true });
     for (const [filename, content] of Object.entries(docs)) {
+        if (!isSafeFilename(filename))
+            continue;
         const filePath = join(docsDir, filename);
+        if (!resolve(filePath).startsWith(resolve(docsDir) + sep))
+            continue;
         const fileDir = dirname(filePath);
         if (fileDir !== docsDir) {
             mkdirSync(fileDir, { recursive: true });
@@ -112,13 +120,23 @@ export async function cmdImport(pmptFile, options) {
     }
     const importSpinner = p.spinner();
     importSpinner.start('Importing project...');
+    const pmptDir = getConfigDir(projectPath);
+    const historyDir = getHistoryDir(projectPath);
+    const docsDir = getDocsDir(projectPath);
+    // --force: clean existing history and docs before restoring
+    if (options?.force && isInitialized(projectPath)) {
+        if (existsSync(historyDir))
+            rmSync(historyDir, { recursive: true, force: true });
+        if (existsSync(docsDir))
+            rmSync(docsDir, { recursive: true, force: true });
+        const planPath = join(pmptDir, 'plan-progress.json');
+        if (existsSync(planPath))
+            rmSync(planPath, { force: true });
+    }
     // Initialize project if not exists
     if (!isInitialized(projectPath)) {
         initializeProject(projectPath, { trackGit: true });
     }
-    const pmptDir = getConfigDir(projectPath);
-    const historyDir = getHistoryDir(projectPath);
-    const docsDir = getDocsDir(projectPath);
     // Restore history
     restoreHistory(historyDir, pmptData.history);
     // Restore docs

package/dist/commands/init.js

@@ -185,7 +185,7 @@ export async function cmdInit(path, options) {
                     `   Location: ${planPath}`,
                     '',
                     `2. pmpt.md — AI prompt (THE IMPORTANT ONE!)`,
-                    `   Copy this to Claude/ChatGPT/Codex`,
+                    `   Copy this to Claude Code / Codex / Cursor`,
                     `   Location: ${promptPath}`,
                 ];
                 p.note(docExplanation.join('\n'), 'Auto-generated from project scan');

package/dist/commands/plan.js

@@ -160,7 +160,7 @@ export async function cmdPlan(path, options) {
         `   Location: ${planPath}`,
         '',
         `2. pmpt.md — AI prompt (THE IMPORTANT ONE!)`,
-        `   • Copy this to Claude/ChatGPT/Codex`,
+        `   • Copy this to Claude Code / Codex / Cursor`,
         `   • AI will help you build step by step`,
         `   • AI will update this doc as you progress`,
         `   Location: ${promptPath}`,

package/dist/commands/publish.js

@@ -42,6 +42,17 @@ export async function cmdPublish(path) {
         p.outro('');
         return;
     }
+    // Validate pmpt.md exists and has content
+    const pmptMdPath = join(getDocsDir(projectPath), 'pmpt.md');
+    if (!existsSync(pmptMdPath)) {
+        p.log.error('pmpt.md not found. Run `pmpt plan` to generate it first.');
+        process.exit(1);
+    }
+    const pmptMdContent = readFileSync(pmptMdPath, 'utf-8').trim();
+    if (pmptMdContent.length === 0) {
+        p.log.error('pmpt.md is empty. Run `pmpt plan` to generate content.');
+        process.exit(1);
+    }
     const projectName = planProgress?.answers?.projectName || basename(projectPath);
     // Try to load existing published data for prefill
     let existing;

package/dist/commands/recover.js

@@ -0,0 +1,222 @@
+import * as p from '@clack/prompts';
+import { resolve, basename } from 'path';
+import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { isInitialized, getDocsDir } from '../lib/config.js';
+import { getAllSnapshots, resolveFileContent } from '../lib/history.js';
+import { getPlanProgress } from '../lib/plan.js';
+import { copyToClipboard } from '../lib/clipboard.js';
+export async function cmdRecover(path) {
+    const projectPath = path ? resolve(path) : process.cwd();
+    if (!isInitialized(projectPath)) {
+        p.log.error('Project not initialized. Run `pmpt init` first.');
+        process.exit(1);
+    }
+    p.intro('pmpt recover');
+    const docsDir = getDocsDir(projectPath);
+    const pmptMdPath = join(docsDir, 'pmpt.md');
+    const planMdPath = join(docsDir, 'plan.md');
+    // Check current state
+    const currentExists = existsSync(pmptMdPath);
+    const currentContent = currentExists ? readFileSync(pmptMdPath, 'utf-8').trim() : '';
+    if (currentExists && currentContent.length > 100) {
+        const proceed = await p.confirm({
+            message: `pmpt.md exists (${currentContent.length} chars). Overwrite with recovered version?`,
+            initialValue: false,
+        });
+        if (p.isCancel(proceed) || !proceed) {
+            p.cancel('Cancelled');
+            process.exit(0);
+        }
+    }
+    // Gather all available context
+    const context = [];
+    // 1. Plan progress answers
+    const planProgress = getPlanProgress(projectPath);
+    if (planProgress?.answers) {
+        const a = planProgress.answers;
+        context.push('## Project Plan Answers');
+        if (a.projectName)
+            context.push(`- **Project Name**: ${a.projectName}`);
+        if (a.productIdea)
+            context.push(`- **Product Idea**: ${a.productIdea}`);
+        if (a.coreFeatures)
+            context.push(`- **Core Features**: ${a.coreFeatures}`);
+        if (a.techStack)
+            context.push(`- **Tech Stack**: ${a.techStack}`);
+        if (a.additionalContext)
+            context.push(`- **Additional Context**: ${a.additionalContext}`);
+        context.push('');
+    }
+    // 2. plan.md content
+    if (existsSync(planMdPath)) {
+        const planMd = readFileSync(planMdPath, 'utf-8').trim();
+        if (planMd) {
+            context.push('## Current plan.md');
+            context.push('```markdown');
+            context.push(planMd);
+            context.push('```');
+            context.push('');
+        }
+    }
+    // 3. Last known good pmpt.md from history
+    const snapshots = getAllSnapshots(projectPath);
+    let lastPmptMd = null;
+    let lastPmptVersion = 0;
+    if (snapshots.length > 0) {
+        for (let i = snapshots.length - 1; i >= 0; i--) {
+            const content = resolveFileContent(snapshots, i, 'pmpt.md');
+            if (content && content.trim().length > 50) {
+                lastPmptMd = content;
+                lastPmptVersion = snapshots[i].version;
+                break;
+            }
+        }
+    }
+    if (lastPmptMd) {
+        context.push(`## Last Known pmpt.md (from v${lastPmptVersion})`);
+        context.push('```markdown');
+        context.push(lastPmptMd);
+        context.push('```');
+        context.push('');
+    }
+    // 4. package.json info
+    const pkgPath = join(projectPath, 'package.json');
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+            context.push('## package.json');
+            const fields = [];
+            if (pkg.name)
+                fields.push(`- **name**: ${pkg.name}`);
+            if (pkg.description)
+                fields.push(`- **description**: ${pkg.description}`);
+            if (pkg.dependencies)
+                fields.push(`- **dependencies**: ${Object.keys(pkg.dependencies).join(', ')}`);
+            if (pkg.devDependencies)
+                fields.push(`- **devDependencies**: ${Object.keys(pkg.devDependencies).join(', ')}`);
+            if (pkg.scripts)
+                fields.push(`- **scripts**: ${Object.keys(pkg.scripts).join(', ')}`);
+            context.push(fields.join('\n'));
+            context.push('');
+        }
+        catch { /* skip */ }
+    }
+    // 5. Directory structure
+    const dirEntries = readdirTopLevel(projectPath);
+    if (dirEntries.length > 0) {
+        context.push('## Project Structure');
+        context.push(dirEntries.join('\n'));
+        context.push('');
+    }
+    if (context.length === 0) {
+        p.log.error('No project context found. Nothing to recover from.');
+        process.exit(1);
+    }
+    // Show what we found
+    const sources = [];
+    if (planProgress?.answers)
+        sources.push('plan answers');
+    if (existsSync(planMdPath))
+        sources.push('plan.md');
+    if (lastPmptMd)
+        sources.push(`history v${lastPmptVersion}`);
+    if (existsSync(pkgPath))
+        sources.push('package.json');
+    p.log.info(`Found context: ${sources.join(', ')}`);
+    // Build recovery prompt
+    const projectName = planProgress?.answers?.projectName || basename(projectPath);
+    const prompt = `# pmpt.md Recovery Request
+
+I need you to regenerate the \`.pmpt/docs/pmpt.md\` file for my project "${projectName}".
+
+This file is the main AI prompt document — it contains the product development context that gets pasted into AI tools (Claude Code, Codex, Cursor, etc.) to continue development.
+
+## Available Context
+
+${context.join('\n')}
+
+## Instructions
+
+Based on the context above, regenerate \`.pmpt/docs/pmpt.md\` with the following structure:
+
+\`\`\`
+# {Project Name} — Product Development Request
+
+## What I Want to Build
+{describe the product idea}
+
+## Key Features
+- {feature 1}
+- {feature 2}
+...
+
+## Tech Stack Preferences
+{detected or specified tech stack}
+
+## Additional Context
+{any extra context}
+
+---
+
+Please help me build this product based on the requirements above.
+
+1. First, review the requirements and ask if anything is unclear.
+2. Propose a technical architecture.
+3. Outline the implementation steps.
+4. Start coding from the first step.
+
+I'll confirm progress at each step before moving to the next.
+
+## Documentation Rule
+
+**Important:** Update this document (located at \`.pmpt/docs/pmpt.md\`) at these moments:
+- When architecture or tech decisions are finalized
+- When a feature is implemented (mark as done)
+- When a development phase is completed
+- When requirements change or new decisions are made
+\`\`\`
+
+${lastPmptMd ? 'Use the "Last Known pmpt.md" as the primary reference — update it rather than starting from scratch.' : 'Generate a fresh pmpt.md based on the available context.'}
+
+Write the content directly to \`.pmpt/docs/pmpt.md\`. After writing, run \`pmpt save\` to create a snapshot.`;
+    // Copy to clipboard
+    const copied = copyToClipboard(prompt);
+    if (copied) {
+        p.log.success('Recovery prompt copied to clipboard!');
+    }
+    else {
+        p.log.warn('Could not copy to clipboard. Prompt printed below:');
+        console.log('\n' + prompt + '\n');
+    }
+    p.note([
+        '1. Paste the prompt into your AI tool (Claude Code, Cursor, etc.)',
+        '2. The AI will regenerate .pmpt/docs/pmpt.md',
+        '3. Run `pmpt save` to snapshot the recovered file',
+    ].join('\n'), 'Next Steps');
+    p.outro('');
+}
+function readdirTopLevel(projectPath) {
+    const ignore = new Set([
+        'node_modules', '.git', '.pmpt', 'dist', 'build', '.next',
+        '.nuxt', '.astro', '.vercel', '.cache', 'coverage', '.turbo',
+    ]);
+    try {
+        const entries = readdirSync(projectPath, { encoding: 'utf-8' });
+        return entries
+            .filter(e => !ignore.has(e) && !e.startsWith('.'))
+            .slice(0, 30)
+            .map(e => {
+            try {
+                const stat = statSync(join(projectPath, e));
+                return stat.isDirectory() ? `${e}/` : e;
+            }
+            catch {
+                return e;
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}

package/dist/index.js

@@ -15,6 +15,7 @@ import { cmdEdit } from './commands/edit.js';
 import { cmdUnpublish } from './commands/unpublish.js';
 import { cmdClone } from './commands/clone.js';
 import { cmdBrowse } from './commands/browse.js';
+import { cmdRecover } from './commands/recover.js';
 const program = new Command();
 program
     .name('pmpt')
@@ -34,6 +35,7 @@ Examples:
   $ pmpt publish                 Publish project to pmptwiki
   $ pmpt clone <slug>            Clone a project from pmptwiki
   $ pmpt browse                  Browse published projects
+  $ pmpt recover                 Recover damaged pmpt.md via AI
 
 Documentation: https://pmptwiki.com
 `);
@@ -66,12 +68,12 @@ program
     .action(cmdSquash);
 program
     .command('export [path]')
-    .description('Export project history as a shareable zip archive')
+    .description('Export project history as a shareable .pmpt file')
     .option('-o, --output <file>', 'Output file path')
     .action(cmdExport);
 program
     .command('import <file>')
-    .description('Import project from exported zip archive')
+    .description('Import project from .pmpt file')
     .option('-f, --force', 'Overwrite existing project')
     .action(cmdImport);
 program
@@ -112,4 +114,8 @@ program
     .command('browse')
     .description('Browse and search published projects')
     .action(cmdBrowse);
+program
+    .command('recover [path]')
+    .description('Generate a recovery prompt to regenerate pmpt.md via AI')
+    .action(cmdRecover);
 program.parse();

package/dist/lib/pmptFile.js

@@ -4,9 +4,36 @@
  * Single JSON file format for sharing pmpt projects.
  */
 import { z } from 'zod';
+import { resolve, relative } from 'path';
 // Schema version
 export const SCHEMA_VERSION = '1.0';
 export const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
+/**
+ * Validate that a filename is safe (no path traversal).
+ * Rejects absolute paths, ".." components, and backslash paths.
+ */
+export function isSafeFilename(filename) {
+    if (!filename || filename.length === 0)
+        return false;
+    // Reject absolute paths and backslashes
+    if (/^[/\\]/.test(filename) || /\\/.test(filename))
+        return false;
+    // Reject .. path components
+    const parts = filename.split('/');
+    if (parts.some(p => p === '..' || p === '.'))
+        return false;
+    // Double check: resolve and verify it stays within parent
+    const base = '/safe';
+    const resolved = resolve(base, filename);
+    const rel = relative(base, resolved);
+    if (rel.startsWith('..') || resolve(rel) !== resolve(base, rel))
+        return false;
+    return true;
+}
+// Safe filename zod refinement
+const safeFilenameKey = z.string().refine(isSafeFilename, {
+    message: 'Unsafe filename detected (path traversal)',
+});
 // Git info schema
 const GitInfoSchema = z.object({
     commit: z.string(),
@@ -20,7 +47,7 @@ const VersionSchema = z.object({
     version: z.number().min(1),
     timestamp: z.string(),
     summary: z.string().optional(),
-    files: z.record(z.string(), z.string()), // filename -> content
+    files: z.record(safeFilenameKey, z.string()), // filename -> content
     git: GitInfoSchema,
 });
 // Plan answers schema
@@ -46,7 +73,7 @@ export const PmptFileSchema = z.object({
     guide: z.string().optional(),
     meta: MetaSchema,
     plan: PlanSchema,
-    docs: z.record(z.string(), z.string()).optional(), // current docs
+    docs: z.record(safeFilenameKey, z.string()).optional(), // current docs
     history: z.array(VersionSchema),
 });
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmpt-cli",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Record and share your AI-driven product development journey",
   "type": "module",
   "bin": {