terminalhire 0.40.5 → 0.40.7

package/dist/bin/jpi-statusline.js

@@ -59,7 +59,7 @@ function localVersion() {
   for (const p of [join(here, "..", "..", "package.json"), join(here, "..", "package.json")]) {
     try {
       const pkg = JSON.parse(readFileSync(p, "utf8"));
-      if (pkg.version) return pkg.version;
+      if (pkg.name === "terminalhire" && pkg.version) return pkg.version;
     } catch {
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminalhire",
-  "version": "0.40.5",
+  "version": "0.40.7",
   "description": "Local-first job matching for developers — ambient job matches in the Claude Code spinner. Your profile never leaves your machine.",
   "repository": {
     "type": "git",

package/statusline-install.js

@@ -305,10 +305,32 @@ async function install({ ask: injectedAsk } = {}) {
       asker.close();
       return 0;
     }
-  } else if (/^n(o)?$/i.test(String(answer ?? '').trim())) {
-    console.log('\nAborted — nothing was changed.');
-    asker.close();
-    return 0;
+  } else {
+    // ALLOWLIST, not a denylist. The first version of this asked "is it n or no?"
+    // and installed on everything else — which meant `null` installed, and `ask`
+    // resolves null on EOF, on Ctrl-D, and whenever the shared readline closes
+    // because the human bailed out of `init` mid-flow. `String(null ?? '')` is the
+    // empty string, indistinguishable from pressing Enter. So did "nope", "cancel",
+    // and an `n` still wrapped in bracketed-paste bytes. Under the old literal-"yes"
+    // bar every one of those aborted; a denylist silently turned each into consent
+    // to write another program's config file.
+    //
+    // The `th://` prompt eight steps below in the same flow (jpi-init.js) already
+    // allowlists `'' | y | yes`. Two consecutive consent prompts disagreeing about
+    // which way an unrecognised answer falls is how a regression gets waved through.
+    // Narrow by TYPE, not by listing the non-strings that must not consent. Excluding
+    // `null` by value left `undefined` consenting — `String(undefined ?? '')` is also
+    // the empty string — so the guard only closed the hole it had already been shown.
+    // Both real askers resolve `string | null` today, which is exactly why this must
+    // not depend on that: a third `ask` is one refactor away, and it would arrive as
+    // the same EOF bug wearing a different value.
+    const a = typeof answer === 'string' ? answer.trim().toLowerCase() : null;
+    const consented = a === '' || a === 'y' || a === 'yes';
+    if (!consented) {
+      console.log('\nAborted — nothing was changed.');
+      asker.close();
+      return 0;
+    }
   }
 
   const src = resolveLauncherSource();