@curviate/cli 0.22.0 → 0.23.0

package/CHANGELOG.md

@@ -8,6 +8,71 @@ a new command or flag is a minor; a breaking command/flag/exit-code change is a
 
 ## [Unreleased]
 
+## [0.23.0] - 2026-08-10
+
+A security and correctness release. Upgrade promptly if `--account` is ever
+set from anything other than a literal you typed yourself (an environment
+variable, a config profile, or agent- or model-generated text): every
+published version through 0.22.0 interpolated it into the request path with
+no validation at all, so a value carrying a slash, `..`, a question mark, a
+hash, or a percent sign could redirect a request, including a write, to a
+different endpoint on the API host. This release also lets `--account` take a
+connected account's name, not just its id.
+
+### Fixed
+
+- **`--account` could redirect a request to a different endpoint.**
+  `inbox mark-read` on `--account 'x/../../../v1/accounts'` built
+  `PATCH /v1/accounts/chats/chat_1` instead of touching the account the caller
+  named. `--account 'a?x=1'` injected a query string into the middle of the
+  path. Neither needed a literal `..`: the URL Standard percent-decodes when it
+  decides whether a segment is a double-dot path segment, so `%2e%2e` walked up
+  the path with no slash in the value at all. Every account-scoped command was
+  reachable this way, since all of them build the request URL from `--account`.
+  The value is now checked before any request is built, and a value that could
+  redirect one is refused with `[INVALID_PATH_SEGMENT]` (exit `2`) naming the
+  character it contains, rather than being sent.
+
+- **`group get` / `group members` never actually accepted a group URL,
+  despite documenting it.** The help and this file both claimed the server
+  extracted the numeric id from a full `https://www.linkedin.com/groups/...`
+  URL passed through verbatim; it does not, and cannot: the URL's own slashes
+  split it into several path segments and the request landed on a route that
+  does not exist. The numeric id is now extracted client-side, the same way
+  member, company, chat, and job URLs already are. A bare numeric id is
+  unaffected.
+
+### Added
+
+- **`--account` accepts a connected account's name, not just its id.** A value
+  that is not shaped like an account id is looked up against
+  `accounts.list`: an exact name match wins outright, otherwise a unique
+  prefix match resolves. A name matching more than one connected account
+  exits with `[ACCOUNT_AMBIGUOUS]` (exit `2`) rather than guessing, since
+  acting on the wrong live persona cannot be undone. A name matching none
+  exits with `[ACCOUNT_NAME_NOT_FOUND]` (exit `4`) and lists what is
+  connected. On an API key with more connected accounts than the resolver
+  reads (250 per page, 10 pages), a name lookup exits with
+  `[ACCOUNT_LIST_TRUNCATED]` (exit `2`) instead of matching against a list
+  that might be missing the very account the name would have matched; pass
+  the id instead, which needs no lookup. An id-shaped value still costs no
+  extra request. `--preview` never issues the lookup, consistent with it
+  never calling the API.
+
+### Changed
+
+- **`@curviate/sdk` dependency bumped to `^0.20.1`.** ^0.20.0 still resolves
+  the vulnerable 0.20.0 build on a fresh install or an old lockfile; 0.20.1 is
+  a hard floor at the fix. Percent-encoding of every other command's path
+  parameters (chat, job, group, company and member ids, and so on) is the
+  SDK's job as of 0.20.0, not this CLI's: a previous CLI-side guard that
+  inspected each call's leading string argument has been removed, because it
+  could not know which argument actually became a path segment and was wrong
+  in both directions, missing a path parameter passed inside an object and
+  rejecting a body field that never reached a path (`post save <share URL>`
+  was one such false rejection). `--account` is guarded separately, above,
+  because it is the one value this CLI genuinely understands the meaning of.
+
 ## [0.22.0] - 2026-08-07
 
 Two correctness fixes for the same underlying failure: a command that answers

package/dist/chunk-3BO6GVS2.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+import {
+  assertNoStdinPlaceholder
+} from "./chunk-ZYURL5VK.js";
+import {
+  getExitCode
+} from "./chunk-PMRQXBCP.js";
+
+// src/lib/path-safety.ts
+var UNSAFE_CHARS = /[\u0000-\u0020\u007F/\\?#%]/;
+var UNICODE_WHITESPACE = /[\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF]/;
+function describeChar(value, index) {
+  const ch = value[index] ?? "";
+  const named = {
+    "/": "a slash",
+    "\\": "a backslash",
+    "?": "a question mark",
+    "#": "a hash",
+    "%": "a percent sign",
+    " ": "a space",
+    "	": "a tab",
+    "\n": "a newline",
+    "\r": "a carriage return"
+  };
+  return named[ch] ?? `the character U+${ch.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`;
+}
+function firstRedirectingIndex(value) {
+  for (let i = 0; i < value.length; i++) {
+    const ch = value[i];
+    if (ch === " ") continue;
+    if (UNSAFE_CHARS.test(ch) || UNICODE_WHITESPACE.test(ch)) return i;
+  }
+  return -1;
+}
+function redirectingViolation(value) {
+  if (value.length === 0) return "it is empty";
+  const i = firstRedirectingIndex(value);
+  if (i >= 0) return `it contains ${describeChar(value, i)}`;
+  if (value.includes("..")) return 'it contains ".."';
+  if (value === ".") return 'it is "."';
+  return null;
+}
+function pathSegmentViolation(value) {
+  const redirecting = redirectingViolation(value);
+  if (redirecting !== null) return redirecting;
+  if (value.includes(" ")) return "it contains a space";
+  return null;
+}
+function pathSegmentErrorMessage(label, value, reason) {
+  return `error: [INVALID_PATH_SEGMENT] ${label}: ${reason}, so it cannot be part of a request path. A value carrying a slash, backslash, question mark, hash, percent sign, whitespace, or ".." would redirect the request to a different endpoint. Received: ${JSON.stringify(value)}.
+`;
+}
+
+// src/lib/account-arg.ts
+var ACCOUNT_ID_RE = /^acc_[A-Za-z0-9_-]+$/;
+var listCache = /* @__PURE__ */ new WeakMap();
+var MAX_LOOKUP_PAGES = 10;
+function toConnectedAccount(item) {
+  if (item === null || typeof item !== "object") return null;
+  const row = item;
+  const accountId = row["account_id"];
+  if (typeof accountId !== "string" || accountId.length === 0) return null;
+  const fullName = row["full_name"];
+  return {
+    accountId,
+    fullName: typeof fullName === "string" && fullName.length > 0 ? fullName : null
+  };
+}
+function listConnectedAccounts(client) {
+  const cached = listCache.get(client);
+  if (cached) return cached;
+  const pending = (async () => {
+    const accounts = [];
+    let cursor;
+    for (let page = 0; page < MAX_LOOKUP_PAGES; page++) {
+      const params = { limit: 250 };
+      if (cursor) params["cursor"] = cursor;
+      const result = await client.accounts.list(
+        params
+      );
+      for (const item of result.items ?? []) {
+        const account = toConnectedAccount(item);
+        if (account) accounts.push(account);
+      }
+      if (!result.cursor) return { accounts, complete: true };
+      cursor = result.cursor;
+    }
+    return { accounts, complete: false };
+  })();
+  listCache.set(client, pending);
+  return pending;
+}
+function describeAccount(account) {
+  return account.fullName === null ? account.accountId : `"${account.fullName}" (${account.accountId})`;
+}
+function describeAll(accounts) {
+  return accounts.map(describeAccount).join(", ");
+}
+function matchAccounts(accounts, selector) {
+  const needle = selector.toLowerCase();
+  const byId = accounts.filter((a) => a.accountId === selector);
+  if (byId.length > 0) return byId;
+  const exactName = accounts.filter((a) => a.fullName?.toLowerCase() === needle);
+  if (exactName.length > 0) return exactName;
+  return accounts.filter((a) => a.fullName?.toLowerCase().startsWith(needle));
+}
+async function requireAccount(client, flags, out) {
+  const account = flags.account;
+  if (!account) {
+    out.stderr.write(
+      "error: --account is required for this command. Set it via --account, CURVIATE_ACCOUNT, or `curviate config set-account`.\n"
+    );
+    process.exit(2);
+  }
+  const selector = account.trim();
+  assertNoStdinPlaceholder("the --account value", [selector]);
+  const redirecting = redirectingViolation(selector);
+  if (redirecting !== null) {
+    out.stderr.write(pathSegmentErrorMessage("--account", selector, redirecting));
+    process.exit(2);
+  }
+  if (ACCOUNT_ID_RE.test(selector)) return selector;
+  if (flags.preview === true) {
+    out.stderr.write(
+      `note: --preview does not call the API, so --account "${selector}" is shown as you typed it. A real run resolves it to an account id first, and fails if it matches no connected account or more than one.
+`
+    );
+    return selector;
+  }
+  let listed;
+  try {
+    listed = await listConnectedAccounts(client);
+  } catch (err) {
+    const { CurviateError } = await import("@curviate/sdk");
+    if (err instanceof CurviateError) {
+      const e = err;
+      out.stderr.write(
+        `error: [${e.code}] could not look up connected accounts to resolve --account "${selector}": ${e.message}
+`
+      );
+      process.exit(getExitCode(e.code));
+    }
+    throw err;
+  }
+  if (!listed.complete) {
+    out.stderr.write(
+      `error: [ACCOUNT_LIST_TRUNCATED] --account "${selector}" cannot be resolved by name: this API key has more connected accounts than the resolver reads (it stops after ${MAX_LOOKUP_PAGES} pages of 250), so the name would be matched against an incomplete list and a single match would not prove there is only one. Pass the account id instead; an id is used as given and needs no lookup.
+`
+    );
+    process.exit(2);
+  }
+  const accounts = listed.accounts;
+  const matches = matchAccounts(accounts, selector);
+  if (matches.length === 1) {
+    const resolved = matches[0].accountId;
+    const bad = pathSegmentViolation(resolved);
+    if (bad !== null) {
+      out.stderr.write(
+        pathSegmentErrorMessage(`the account id resolved from "${selector}"`, resolved, bad)
+      );
+      process.exit(2);
+    }
+    return resolved;
+  }
+  if (matches.length > 1) {
+    out.stderr.write(
+      `error: [ACCOUNT_AMBIGUOUS] --account "${selector}" matches ${matches.length} connected accounts: ${describeAll(matches)}. Pass the account id of the one you mean; this is not resolved by guessing, because acting as the wrong account cannot be undone.
+`
+    );
+    process.exit(2);
+  }
+  const known = accounts.length === 0 ? "No accounts are connected on this API key." : `Connected accounts: ${describeAll(accounts)}.`;
+  out.stderr.write(
+    `error: [ACCOUNT_NAME_NOT_FOUND] --account "${selector}" matched no connected account. ${known}
+`
+  );
+  process.exit(4);
+}
+
+export {
+  requireAccount
+};

package/dist/{chunk-T5LPGAGJ.js → chunk-MBO4LBLY.js}

@@ -15,7 +15,10 @@ import {
 import {
   normalizeChatId,
   resolveIdentifier
-} from "./chunk-DMQZEPQE.js";
+} from "./chunk-UEAX6KUB.js";
+import {
+  requireAccount
+} from "./chunk-3BO6GVS2.js";
 import {
   buildPreviewOutput
 } from "./chunk-R3VLWLVV.js";
@@ -42,13 +45,6 @@ function buildOutputStreams() {
     stderr: { write: (s) => process.stderr.write(s) }
   };
 }
-function requireAccount(account, out) {
-  if (!account) {
-    out.stderr.write("error: --account is required for this command. Set it via --account, CURVIATE_ACCOUNT, or `curviate config set-account`.\n");
-    process.exit(2);
-  }
-  return account;
-}
 function rejectPreviewOnRead(preview, out) {
   if (preview) {
     out.stderr.write("error: --preview is only valid on write commands (mutations). Reads just run.\n");
@@ -95,7 +91,7 @@ function willSendAsNotice(chatId) {
   return chatId.startsWith("COMPANY_") ? "Will send as a company page\n" : null;
 }
 async function runMessageNew(client, flags, out, _readStdin) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const rawTo = flags.to ?? "";
   const rawText = flags.text ?? "";
   const attachPaths = normalizeAttachPaths(flags.attach);
@@ -154,7 +150,7 @@ async function runMessageNew(client, flags, out, _readStdin) {
   }
 }
 async function runMessageSend(client, flags, out, _readStdin) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const chatId = normalizeChatId(flags.chatId ?? "");
   const rawText = flags.text ?? "";
   const attachPaths = normalizeAttachPaths(flags.attach);
@@ -205,7 +201,7 @@ async function runMessageSend(client, flags, out, _readStdin) {
 async function runMessageGet(client, flags, out) {
   rejectPreviewOnRead(flags.preview, out);
   rejectAllOnNonPaginated(flags.all, out);
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const chatId = normalizeChatId(flags.chatId ?? "");
   const messageId = flags.messageId ?? "";
   const ns = client.account(accountId);
@@ -218,7 +214,7 @@ async function runMessageGet(client, flags, out) {
   }
 }
 async function runMessageEdit(client, flags, out, _readStdin) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const chatId = normalizeChatId(flags.chatId ?? "");
   const messageId = flags.messageId ?? "";
   const rawText = flags.text ?? "";
@@ -243,7 +239,7 @@ async function runMessageEdit(client, flags, out, _readStdin) {
   }
 }
 async function runMessageDelete(client, flags, out) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const chatId = normalizeChatId(flags.chatId ?? "");
   const messageId = flags.messageId ?? "";
   if (flags.preview) {
@@ -266,7 +262,7 @@ async function runMessageDelete(client, flags, out) {
   }
 }
 async function runMessageReact(client, flags, out) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const chatId = normalizeChatId(flags.chatId ?? "");
   const messageId = flags.messageId ?? "";
   const reaction = flags.emoji ?? flags.emojiAlias ?? "";
@@ -296,7 +292,7 @@ async function runMessageReact(client, flags, out) {
 }
 async function runMessageAttachment(client, flags, out, isTTY) {
   rejectPreviewOnRead(flags.preview, out);
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const chatId = normalizeChatId(flags.chatId ?? "");
   const messageId = flags.messageId ?? "";
   const attachmentId = flags.attachmentId ?? "";
@@ -319,7 +315,7 @@ async function runMessageAttachment(client, flags, out, isTTY) {
   }
 }
 async function runMessageInMail(client, flags, out, _readStdin) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const rawTo = flags.to ?? "";
   if (!rawTo) {
     out.stderr.write(
@@ -373,7 +369,7 @@ async function runMessageInMail(client, flags, out, _readStdin) {
 async function runMessageInMailBalance(client, flags, out) {
   rejectPreviewOnRead(flags.preview, out);
   rejectAllOnNonPaginated(flags.all, out);
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const ns = client.account(accountId);
   const outOpts = resolveOutputOpts(flags);
   try {

package/dist/{chunk-QJZ3LWOX.js → chunk-RJTG5YWE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   resolveIdentifier
-} from "./chunk-DMQZEPQE.js";
+} from "./chunk-UEAX6KUB.js";
 
 // src/lib/member-id.ts
 var MEMBER_PROVIDER_ID_RE = /^A[CDE][A-Za-z0-9_-]{4,}$/;

package/dist/{chunk-DMQZEPQE.js → chunk-UEAX6KUB.js}

@@ -33,6 +33,15 @@ function normalizeChatId(raw) {
   if (match?.[1]) return match[1];
   return raw;
 }
+var GROUP_URL_RE = /^https?:\/\/(?:[a-z0-9-]+\.)?linkedin\.com\/groups\/([^/?#]+)/i;
+var GROUP_PATH_RE = /^\/groups\/([^/?#]+)\/?$/;
+function normalizeGroupId(raw) {
+  const urlMatch = GROUP_URL_RE.exec(raw);
+  if (urlMatch?.[1]) return urlMatch[1];
+  const pathMatch = GROUP_PATH_RE.exec(raw);
+  if (pathMatch?.[1]) return pathMatch[1];
+  return raw;
+}
 var JOB_URL_RE = /\/jobs\/view\/(\d+)/;
 function resolveJobIdentifier(raw) {
   const match = JOB_URL_RE.exec(raw);
@@ -43,5 +52,6 @@ function resolveJobIdentifier(raw) {
 export {
   resolveIdentifier,
   normalizeChatId,
+  normalizeGroupId,
   resolveJobIdentifier
 };

package/dist/cli.js

@@ -299,23 +299,23 @@ var main = defineCommand({
     // ---------------------------------------------------------------------------
     // Noun groups, lazy-loaded on first invocation.
     // ---------------------------------------------------------------------------
-    profile: () => import("./profile-TJS2YAZD.js").then((m) => m.profileCommand),
-    company: () => import("./company-WDDLWP7E.js").then((m) => m.companyCommand),
-    job: () => import("./job-75ML7R7I.js").then((m) => m.jobCommand),
-    connect: () => import("./connect-5OROSY5C.js").then((m) => m.connectCommand),
-    search: () => import("./search-TDSLK2MB.js").then((m) => m.searchCommand),
-    inbox: () => import("./inbox-L6JBGZIB.js").then((m) => m.inboxCommand),
-    inboxes: () => import("./inboxes-UIO74C5Q.js").then((m) => m.inboxesCommand),
-    message: () => import("./message-DAQHRBSJ.js").then((m) => m.messageCommand),
-    post: () => import("./post-RGDOCGC4.js").then((m) => m.postCommand),
-    comment: () => import("./comment-MCGXFMN4.js").then((m) => m.commentCommand),
-    account: () => import("./account-QRGWUQXF.js").then((m) => m.accountCommand),
+    profile: () => import("./profile-SUKHRWQP.js").then((m) => m.profileCommand),
+    company: () => import("./company-LHYDAO2C.js").then((m) => m.companyCommand),
+    job: () => import("./job-JQG34ATV.js").then((m) => m.jobCommand),
+    connect: () => import("./connect-5S4TFQAF.js").then((m) => m.connectCommand),
+    search: () => import("./search-MZQJDJTX.js").then((m) => m.searchCommand),
+    inbox: () => import("./inbox-3IQPPQMH.js").then((m) => m.inboxCommand),
+    inboxes: () => import("./inboxes-JK36F6SK.js").then((m) => m.inboxesCommand),
+    message: () => import("./message-2WIZESSM.js").then((m) => m.messageCommand),
+    post: () => import("./post-JRJMGV2I.js").then((m) => m.postCommand),
+    comment: () => import("./comment-TUXC7K72.js").then((m) => m.commentCommand),
+    account: () => import("./account-MIPWTAG5.js").then((m) => m.accountCommand),
     webhook: () => import("./webhook-7ESDSIRU.js").then((m) => m.webhookCommand),
-    "sales-nav": () => import("./sales-nav-5O7FR57S.js").then((m) => m.salesNavCommand),
-    recruiter: () => import("./recruiter-NSM33IEK.js").then((m) => m.recruiterCommand),
-    group: () => import("./group-HSZY2IJU.js").then((m) => m.groupCommand),
-    feed: () => import("./feed-SFVYEAYP.js").then((m) => m.feedCommand),
-    notification: () => import("./notification-DYJN4ZHN.js").then((m) => m.notificationCommand)
+    "sales-nav": () => import("./sales-nav-4MFL2JSE.js").then((m) => m.salesNavCommand),
+    recruiter: () => import("./recruiter-NIKKDGMR.js").then((m) => m.recruiterCommand),
+    group: () => import("./group-PHGUOOJE.js").then((m) => m.groupCommand),
+    feed: () => import("./feed-ISNH4NXB.js").then((m) => m.feedCommand),
+    notification: () => import("./notification-ORSZY2IJ.js").then((m) => m.notificationCommand)
   },
   async run() {
     const { runMain } = await import("citty");

package/dist/{comment-MCGXFMN4.js → comment-TUXC7K72.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   resolveMemberOrMeProviderId
-} from "./chunk-QJZ3LWOX.js";
+} from "./chunk-RJTG5YWE.js";
 import {
   AttachError,
   describeAttachment,
@@ -12,7 +12,10 @@ import {
   pageDelayFromFlags,
   streamAll
 } from "./chunk-H6XD3F66.js";
-import "./chunk-DMQZEPQE.js";
+import "./chunk-UEAX6KUB.js";
+import {
+  requireAccount
+} from "./chunk-3BO6GVS2.js";
 import {
   buildPreviewOutput
 } from "./chunk-R3VLWLVV.js";
@@ -30,6 +33,7 @@ import {
 import {
   resolveTextOrStdin
 } from "./chunk-ZYURL5VK.js";
+import "./chunk-PMRQXBCP.js";
 
 // src/commands/comment.ts
 import { defineCommand } from "citty";
@@ -40,13 +44,6 @@ function buildOutputStreams() {
     stderr: { write: (s) => process.stderr.write(s) }
   };
 }
-function requireAccount(account, out) {
-  if (!account) {
-    out.stderr.write("error: --account is required for this command. Set it via --account, CURVIATE_ACCOUNT, or `curviate config set-account`.\n");
-    process.exit(2);
-  }
-  return account;
-}
 function rejectPreviewOnRead(preview, out) {
   if (preview) {
     out.stderr.write("error: --preview is only valid on write commands (mutations). Reads just run.\n");
@@ -92,7 +89,7 @@ function assertReaction(reaction, out) {
 }
 async function runCommentList(client, flags, out) {
   rejectPreviewOnRead(flags.preview, out);
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const ns = client.account(accountId);
   const outOpts = resolveOutputOpts(flags);
@@ -119,7 +116,7 @@ async function runCommentList(client, flags, out) {
 }
 async function runCommentReplies(client, flags, out) {
   rejectPreviewOnRead(flags.preview, out);
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const commentId = flags.commentId ?? "";
   const ns = client.account(accountId);
@@ -147,7 +144,7 @@ async function runCommentReplies(client, flags, out) {
 }
 async function runCommentReactions(client, flags, out) {
   rejectPreviewOnRead(flags.preview, out);
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const commentId = flags.commentId ?? "";
   const ns = client.account(accountId);
@@ -175,7 +172,7 @@ async function runCommentReactions(client, flags, out) {
 }
 async function runCommentUser(client, flags, out) {
   rejectPreviewOnRead(flags.preview, out);
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const ns = client.account(accountId);
   const outOpts = resolveOutputOpts(flags);
   let userId;
@@ -207,7 +204,7 @@ async function runCommentUser(client, flags, out) {
   }
 }
 async function runCommentAdd(client, flags, out, readStdin) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const attachPaths = normalizeAttachPaths(flags.attach);
   let attachBuffers = [];
@@ -248,7 +245,7 @@ async function runCommentAdd(client, flags, out, readStdin) {
   }
 }
 async function runCommentReply(client, flags, out, readStdin) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const commentId = flags.commentId ?? "";
   const attachPaths = normalizeAttachPaths(flags.attach);
@@ -290,7 +287,7 @@ async function runCommentReply(client, flags, out, readStdin) {
   }
 }
 async function runCommentEdit(client, flags, out, readStdin) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const commentId = flags.commentId ?? "";
   const text = await resolveTextOrStdin(flags.text ?? "", out, readStdin);
@@ -315,7 +312,7 @@ async function runCommentEdit(client, flags, out, readStdin) {
   }
 }
 async function runCommentDelete(client, flags, out) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const commentId = flags.commentId ?? "";
   if (flags.preview) {
@@ -338,7 +335,7 @@ async function runCommentDelete(client, flags, out) {
   }
 }
 async function runCommentReact(client, flags, out) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const commentId = flags.commentId ?? "";
   const reaction = flags.reaction ?? "";
@@ -364,7 +361,7 @@ async function runCommentReact(client, flags, out) {
   }
 }
 async function runCommentUnreact(client, flags, out) {
-  const accountId = requireAccount(flags.account, out);
+  const accountId = await requireAccount(client, flags, out);
   const postId = flags.postId ?? "";
   const commentId = flags.commentId ?? "";
   const reaction = flags.reaction ?? "";