terminalhire 0.40.6 → 0.40.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminalhire",
-  "version": "0.40.6",
+  "version": "0.40.7",
   "description": "Local-first job matching for developers — ambient job matches in the Claude Code spinner. Your profile never leaves your machine.",
   "repository": {
     "type": "git",

package/statusline-install.js

@@ -318,10 +318,14 @@ async function install({ ask: injectedAsk } = {}) {
     // The `th://` prompt eight steps below in the same flow (jpi-init.js) already
     // allowlists `'' | y | yes`. Two consecutive consent prompts disagreeing about
     // which way an unrecognised answer falls is how a regression gets waved through.
-    const a = String(answer ?? '')
-      .trim()
-      .toLowerCase();
-    const consented = answer !== null && (a === '' || a === 'y' || a === 'yes');
+    // Narrow by TYPE, not by listing the non-strings that must not consent. Excluding
+    // `null` by value left `undefined` consenting — `String(undefined ?? '')` is also
+    // the empty string — so the guard only closed the hole it had already been shown.
+    // Both real askers resolve `string | null` today, which is exactly why this must
+    // not depend on that: a third `ask` is one refactor away, and it would arrive as
+    // the same EOF bug wearing a different value.
+    const a = typeof answer === 'string' ? answer.trim().toLowerCase() : null;
+    const consented = a === '' || a === 'y' || a === 'yes';
     if (!consented) {
       console.log('\nAborted — nothing was changed.');
       asker.close();