@hasna/accounts 0.1.11 → 0.1.13

package/dist/index.js

@@ -3999,6 +3999,7 @@ var toolDefSchema = exports_external.object({
   loginArgs: exports_external.array(exports_external.string()).optional(),
   loginHint: exports_external.string().optional(),
   resumeArgs: exports_external.array(exports_external.string()).optional(),
+  permissionArgs: exports_external.record(exports_external.array(exports_external.string())).optional(),
   accountFile: exports_external.string().optional(),
   emailPath: exports_external.array(exports_external.string()).optional()
 });
@@ -4174,6 +4175,15 @@ var BUILTIN_TOOLS = [
     bin: "claude",
     loginHint: "run /login inside Claude, then /exit when done",
     resumeArgs: ["--continue"],
+    permissionArgs: {
+      dangerous: ["--dangerously-skip-permissions"],
+      "allow-dangerous": ["--allow-dangerously-skip-permissions"],
+      bypass: ["--permission-mode", "bypassPermissions"],
+      auto: ["--permission-mode", "auto"],
+      "accept-edits": ["--permission-mode", "acceptEdits"],
+      "dont-ask": ["--permission-mode", "dontAsk"],
+      plan: ["--permission-mode", "plan"]
+    },
     accountFile: ".claude.json",
     emailPath: ["oauthAccount", "emailAddress"]
   },
@@ -4185,7 +4195,10 @@ var BUILTIN_TOOLS = [
     bin: "codex",
     loginArgs: ["login"],
     loginHint: "complete the Codex login flow for this CODEX_HOME",
-    resumeArgs: ["resume", "--last"]
+    resumeArgs: ["resume", "--last"],
+    permissionArgs: {
+      dangerous: ["--dangerously-bypass-approvals-and-sandbox"]
+    }
   },
   {
     id: "takumi",
@@ -4195,6 +4208,15 @@ var BUILTIN_TOOLS = [
     bin: "takumi",
     loginHint: "complete Takumi auth in this TAKUMI_CONFIG_DIR",
     resumeArgs: ["--continue"],
+    permissionArgs: {
+      dangerous: ["--dangerously-skip-permissions"],
+      "allow-dangerous": ["--allow-dangerously-skip-permissions"],
+      bypass: ["--permission-mode", "bypassPermissions"],
+      auto: ["--permission-mode", "auto"],
+      "accept-edits": ["--permission-mode", "acceptEdits"],
+      "dont-ask": ["--permission-mode", "dontAsk"],
+      plan: ["--permission-mode", "plan"]
+    },
     accountFile: ".claude.json",
     emailPath: ["oauthAccount", "emailAddress"]
   },
@@ -4204,7 +4226,13 @@ var BUILTIN_TOOLS = [
     envVar: "GEMINI_CONFIG_DIR",
     defaultDir: join2(homedir2(), ".gemini"),
     bin: "gemini",
-    loginHint: "complete Gemini auth in this GEMINI_CONFIG_DIR"
+    loginHint: "complete Gemini auth in this GEMINI_CONFIG_DIR",
+    permissionArgs: {
+      dangerous: ["--yolo"],
+      yolo: ["--yolo"],
+      "auto-edit": ["--approval-mode", "auto_edit"],
+      plan: ["--approval-mode", "plan"]
+    }
   },
   {
     id: "opencode",
@@ -4243,7 +4271,11 @@ var BUILTIN_TOOLS = [
     envVar: "HERMES_HOME",
     defaultDir: join2(homedir2(), ".hermes"),
     bin: "hermes",
-    loginHint: "complete Hermes auth in this HERMES_HOME"
+    loginHint: "complete Hermes auth in this HERMES_HOME",
+    permissionArgs: {
+      dangerous: ["--yolo"],
+      yolo: ["--yolo"]
+    }
   },
   {
     id: "kimi",
@@ -4252,7 +4284,13 @@ var BUILTIN_TOOLS = [
     defaultDir: join2(homedir2(), ".kimi-code"),
     bin: "kimi",
     loginArgs: ["login"],
-    loginHint: "complete kimi login for this KIMI_CODE_HOME"
+    loginHint: "complete kimi login for this KIMI_CODE_HOME",
+    permissionArgs: {
+      dangerous: ["--yolo"],
+      yolo: ["--yolo"],
+      auto: ["--auto"],
+      plan: ["--plan"]
+    }
   },
   {
     id: "grok",
@@ -4265,6 +4303,43 @@ var BUILTIN_TOOLS = [
   }
 ];
 var DEFAULT_TOOL = "claude";
+var PERMISSION_ALIASES = new Map([
+  ["danger", "dangerous"],
+  ["dangerously-skip-permissions", "dangerous"],
+  ["skip-permissions", "dangerous"],
+  ["skip", "dangerous"],
+  ["bypasspermissions", "bypass"],
+  ["bypass-permissions", "bypass"],
+  ["acceptedits", "accept-edits"],
+  ["accept-edit", "accept-edits"],
+  ["autoedit", "auto-edit"],
+  ["auto-edits", "auto-edit"],
+  ["auto_edit", "auto-edit"],
+  ["dontask", "dont-ask"],
+  ["dont-ask-permissions", "dont-ask"]
+]);
+function normalizePermissionPreset(value) {
+  const normalized = value.trim().replace(/^--/, "").replaceAll("_", "-").toLowerCase();
+  return PERMISSION_ALIASES.get(normalized) ?? normalized;
+}
+function permissionArgsFor(tool, permissions) {
+  if (!permissions)
+    return [];
+  const preset = normalizePermissionPreset(permissions);
+  if (preset === "default" || preset === "none" || preset === "off")
+    return [];
+  const args = tool.permissionArgs?.[preset];
+  if (!args) {
+    const supported = Object.keys(tool.permissionArgs ?? {}).sort();
+    const suffix = supported.length > 0 ? ` Supported permissions: ${supported.join(", ")}.` : " No permission presets are configured.";
+    throw new AccountsError(`tool "${tool.id}" does not support permissions "${permissions}".${suffix}`);
+  }
+  return args;
+}
+function mergeToolArgs(tool, args, opts = {}) {
+  const permissionArgs = permissionArgsFor(tool, opts.permissions).filter((arg) => !args.includes(arg));
+  return [...permissionArgs, ...args];
+}
 var BUILTIN_IDS = new Set(BUILTIN_TOOLS.map((t) => t.id));
 function isBuiltinTool(id) {
   return BUILTIN_IDS.has(id);
@@ -4317,256 +4392,13 @@ function removeCustomTool(id) {
   store.tools.splice(idx, 1);
   saveStore(store);
 }
-// src/lib/env.ts
-function renderTemplate(value, profile) {
-  return value.replaceAll("{profileDir}", profile.dir).replaceAll("{profileName}", profile.name).replaceAll("{toolId}", profile.tool);
-}
-function profileEnv(profile, tool) {
-  const env = {
-    [tool.envVar]: profile.dir
-  };
-  for (const [name, value] of Object.entries(tool.extraEnv ?? {})) {
-    env[name] = renderTemplate(value, profile);
-  }
-  return env;
-}
-function formatEnvAssignments(env) {
-  return Object.entries(env).map(([name, value]) => `${name}=${JSON.stringify(value)}`).join(" ");
-}
-function formatExportLines(env) {
-  return Object.entries(env).map(([name, value]) => `export ${name}=${JSON.stringify(value)}`).join(`
-`);
-}
-// src/lib/detect.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join3 } from "node:path";
-function detectEmail(dir, tool) {
-  if (!tool.accountFile || !tool.emailPath)
-    return;
-  const candidates = [join3(dir, tool.accountFile)];
-  if (dir === tool.defaultDir)
-    candidates.push(join3(dirname2(dir), tool.accountFile));
-  for (const file of candidates) {
-    const email = readEmail(file, tool.emailPath);
-    if (email)
-      return email;
-  }
-  return;
-}
-function readEmail(file, path) {
-  if (!existsSync3(file))
-    return;
-  let cursor;
-  try {
-    cursor = JSON.parse(readFileSync2(file, "utf8"));
-  } catch {
-    return;
-  }
-  for (const key of path) {
-    if (cursor && typeof cursor === "object" && key in cursor) {
-      cursor = cursor[key];
-    } else {
-      return;
-    }
-  }
-  return typeof cursor === "string" && cursor.includes("@") ? cursor : undefined;
-}
-// src/lib/profiles.ts
-import { homedir as homedir3 } from "node:os";
-import { isAbsolute, join as join4, resolve as resolve2 } from "node:path";
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, rmSync } from "node:fs";
-function nowIso() {
-  return new Date().toISOString();
-}
-function expandPath(p) {
-  let out = p;
-  if (out === "~")
-    out = homedir3();
-  else if (out.startsWith("~/"))
-    out = join4(homedir3(), out.slice(2));
-  return isAbsolute(out) ? out : resolve2(process.cwd(), out);
-}
-function listProfiles(toolId) {
-  const profiles = loadStore().profiles;
-  const filtered = toolId ? profiles.filter((p) => p.tool === toolId) : profiles;
-  return filtered.slice().sort((a, b) => a.tool.localeCompare(b.tool) || a.name.localeCompare(b.name));
-}
-function profileMatches(name, toolId) {
-  return loadStore().profiles.filter((p) => p.name === name && (!toolId || p.tool === toolId));
-}
-function findProfile(name, toolId) {
-  const matches = profileMatches(name, toolId);
-  return matches.length === 1 ? matches[0] : undefined;
-}
-function getProfile(name, toolId) {
-  const matches = profileMatches(name, toolId);
-  if (matches.length === 0) {
-    const suffix = toolId ? ` for tool "${toolId}"` : "";
-    throw new AccountsError(`no profile named "${name}"${suffix}. Run \`accounts list\` to see profiles.`);
-  }
-  if (matches.length > 1) {
-    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
-  }
-  const profile = matches[0];
-  return profile;
-}
-function addProfile(opts) {
-  const name = opts.name;
-  const nameCheck = profileNameSchema.safeParse(name);
-  if (!nameCheck.success)
-    throw new AccountsError(nameCheck.error.issues[0]?.message ?? "invalid profile name");
-  const toolId = opts.tool ?? DEFAULT_TOOL;
-  const tool = getTool(toolId);
-  const store = loadStore();
-  if (store.profiles.some((p) => p.name === name && p.tool === toolId)) {
-    throw new AccountsError(`a ${toolId} profile named "${name}" already exists`);
-  }
-  const dir = opts.dir ? expandPath(opts.dir) : join4(profilesDir(), toolId, name);
-  if (store.profiles.some((p) => p.dir === dir)) {
-    throw new AccountsError(`a profile already uses config dir ${dir}`);
-  }
-  mkdirSync3(dir, { recursive: true });
-  const email = opts.email ?? detectEmail(dir, tool);
-  const profile = {
-    name,
-    tool: toolId,
-    ...email ? { email } : {},
-    dir,
-    ...opts.description ? { description: opts.description } : {},
-    createdAt: nowIso()
-  };
-  store.profiles.push(profile);
-  saveStore(store);
-  return profile;
-}
-function removeProfile(name, opts = {}) {
-  const options = typeof opts === "boolean" ? { purge: opts } : opts;
-  const store = loadStore();
-  const matches = store.profiles.map((profile2, idx2) => ({ profile: profile2, idx: idx2 })).filter(({ profile: profile2 }) => profile2.name === name && (!options.tool || profile2.tool === options.tool));
-  if (matches.length === 0) {
-    const suffix = options.tool ? ` for tool "${options.tool}"` : "";
-    throw new AccountsError(`no profile named "${name}"${suffix}`);
-  }
-  if (matches.length > 1) {
-    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map(({ profile: profile2 }) => profile2.tool).join(", ")}); pass --tool`);
-  }
-  const idx = matches[0].idx;
-  const profile = store.profiles[idx];
-  store.profiles.splice(idx, 1);
-  if (store.current[profile.tool] === name)
-    delete store.current[profile.tool];
-  if (store.applied[profile.tool] === name)
-    delete store.applied[profile.tool];
-  saveStore(store);
-  let purged = false;
-  let purgeNote;
-  if (options.purge) {
-    const managed = profile.dir.startsWith(profilesDir());
-    const isDefault = profile.dir === getTool(profile.tool).defaultDir;
-    if (managed && !isDefault && existsSync4(profile.dir)) {
-      rmSync(profile.dir, { recursive: true, force: true });
-      purged = true;
-    } else {
-      purgeNote = `refused to delete ${profile.dir} (not a managed profile dir); remove it manually if intended`;
-    }
-  }
-  return { profile, purged, purgeNote };
-}
-function renameProfile(oldName, newName, toolId) {
-  const nameCheck = profileNameSchema.safeParse(newName);
-  if (!nameCheck.success)
-    throw new AccountsError(nameCheck.error.issues[0]?.message ?? "invalid profile name");
-  const store = loadStore();
-  const matches = store.profiles.filter((p) => p.name === oldName && (!toolId || p.tool === toolId));
-  if (matches.length === 0) {
-    const suffix = toolId ? ` for tool "${toolId}"` : "";
-    throw new AccountsError(`no profile named "${oldName}"${suffix}`);
-  }
-  if (matches.length > 1) {
-    throw new AccountsError(`profile "${oldName}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
-  }
-  const profile = matches[0];
-  if (store.profiles.some((p) => p.name === newName && p.tool === profile.tool)) {
-    throw new AccountsError(`a ${profile.tool} profile named "${newName}" already exists`);
-  }
-  if (store.current[profile.tool] === oldName)
-    store.current[profile.tool] = newName;
-  if (store.applied[profile.tool] === oldName)
-    store.applied[profile.tool] = newName;
-  profile.name = newName;
-  saveStore(store);
-  return profile;
-}
-function updateProfile(name, opts) {
-  const store = loadStore();
-  const matches = store.profiles.filter((p) => p.name === name && (!opts.tool || p.tool === opts.tool));
-  if (matches.length === 0) {
-    const suffix = opts.tool ? ` for tool "${opts.tool}"` : "";
-    throw new AccountsError(`no profile named "${name}"${suffix}`);
-  }
-  if (matches.length > 1) {
-    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
-  }
-  const profile = matches[0];
-  if (opts.email !== undefined)
-    profile.email = opts.email;
-  if (opts.description !== undefined)
-    profile.description = opts.description;
-  if (opts.dir !== undefined) {
-    const dir = expandPath(opts.dir);
-    mkdirSync3(dir, { recursive: true });
-    profile.dir = dir;
-  }
-  saveStore(store);
-  return profile;
-}
-function redetectEmail(name, toolId) {
-  const store = loadStore();
-  const matches = store.profiles.filter((p) => p.name === name && (!toolId || p.tool === toolId));
-  if (matches.length === 0) {
-    const suffix = toolId ? ` for tool "${toolId}"` : "";
-    throw new AccountsError(`no profile named "${name}"${suffix}`);
-  }
-  if (matches.length > 1) {
-    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
-  }
-  const profile = matches[0];
-  const email = detectEmail(profile.dir, getTool(profile.tool));
-  if (email)
-    profile.email = email;
-  saveStore(store);
-  return profile;
-}
-function useProfile(name, toolId) {
-  const store = loadStore();
-  const matches = store.profiles.filter((p) => p.name === name && (!toolId || p.tool === toolId));
-  if (matches.length === 0) {
-    const suffix = toolId ? ` for tool "${toolId}"` : "";
-    throw new AccountsError(`no profile named "${name}"${suffix}`);
-  }
-  if (matches.length > 1) {
-    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
-  }
-  const profile = matches[0];
-  store.current[profile.tool] = name;
-  profile.lastUsedAt = nowIso();
-  saveStore(store);
-  return { profile, toolId: profile.tool };
-}
-function currentProfile(toolId) {
-  const store = loadStore();
-  const name = store.current[toolId];
-  if (!name)
-    return;
-  return store.profiles.find((p) => p.name === name);
-}
 // src/lib/claude-auth.ts
-import { copyFileSync, existsSync as existsSync5, lstatSync as lstatSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync3, statSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { copyFileSync, existsSync as existsSync3, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, statSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname3, join as join4 } from "node:path";
 
 // src/lib/claude-layout.ts
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname3, join as join5 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { dirname as dirname2, join as join3 } from "node:path";
 var CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
 var ACCOUNTS_AUTH_DIR = ".accounts-auth";
 var OAUTH_SNAPSHOT = "oauth-account.json";
@@ -4574,36 +4406,36 @@ var CREDENTIALS_SNAPSHOT = "credentials.json";
 var KEYCHAIN_SNAPSHOT = "keychain.json";
 function liveClaudeBase() {
   const testBase = process.env.ACCOUNTS_TEST_LIVE_DIR;
-  return testBase && testBase.trim() ? testBase : homedir4();
+  return testBase && testBase.trim() ? testBase : homedir3();
 }
 function liveClaudePaths() {
   const base = liveClaudeBase();
-  const configDir = join5(base, ".claude");
+  const configDir = join3(base, ".claude");
   return {
     configDir,
-    homeJson: join5(base, ".claude.json"),
-    credentialsFile: join5(configDir, ".credentials.json")
+    homeJson: join3(base, ".claude.json"),
+    credentialsFile: join3(configDir, ".credentials.json")
   };
 }
 function profileAccountJsonPaths(profileDir, tool) {
   if (!tool.accountFile)
     return [];
-  const paths = [join5(profileDir, tool.accountFile)];
+  const paths = [join3(profileDir, tool.accountFile)];
   if (profileDir === tool.defaultDir)
-    paths.push(join5(dirname3(profileDir), tool.accountFile));
+    paths.push(join3(dirname2(profileDir), tool.accountFile));
   return paths;
 }
 function profileAuthDir(profileDir) {
-  return join5(profileDir, ACCOUNTS_AUTH_DIR);
+  return join3(profileDir, ACCOUNTS_AUTH_DIR);
 }
 function profileOAuthSnapshot(profileDir) {
-  return join5(profileAuthDir(profileDir), OAUTH_SNAPSHOT);
+  return join3(profileAuthDir(profileDir), OAUTH_SNAPSHOT);
 }
 function profileCredentialsSnapshot(profileDir) {
-  return join5(profileAuthDir(profileDir), CREDENTIALS_SNAPSHOT);
+  return join3(profileAuthDir(profileDir), CREDENTIALS_SNAPSHOT);
 }
 function profileKeychainSnapshot(profileDir) {
-  return join5(profileAuthDir(profileDir), KEYCHAIN_SNAPSHOT);
+  return join3(profileAuthDir(profileDir), KEYCHAIN_SNAPSHOT);
 }
 
 // src/lib/keychain.ts
@@ -4667,24 +4499,38 @@ function writeClaudeKeychain(cred) {
 }
 
 // src/lib/claude-auth.ts
+var CLAUDE_API_AUTH_ENV_KEYS = [
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_BASE_URL",
+  "CLAUDE_CODE_API_KEY_HELPER",
+  "CLAUDE_CODE_API_KEY_HELPER_TTL_MS",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_VERTEX"
+];
 function readJsonFile(path) {
-  if (!existsSync5(path))
+  if (!existsSync3(path))
     return;
   try {
-    return JSON.parse(readFileSync3(path, "utf8"));
+    return JSON.parse(readFileSync2(path, "utf8"));
   } catch {
     return;
   }
 }
 function writeJsonFile(path, data, stayUnder) {
   assertSafeWritePath(path, stayUnder ? { mustStayUnder: stayUnder } : undefined);
-  mkdirSync4(dirname4(path), { recursive: true });
+  mkdirSync3(dirname3(path), { recursive: true });
   writeFileSync2(path, JSON.stringify(data, null, 2) + `
 `, { mode: 384 });
 }
 function readOAuthFromPaths(paths) {
   return findOAuthSource(paths)?.oauth;
 }
+function readOAuthSnapshot(profileDir) {
+  const snap = readJsonFile(profileOAuthSnapshot(profileDir));
+  const oauth = snap?.oauthAccount;
+  return oauth && typeof oauth === "object" ? oauth : undefined;
+}
 function findOAuthSource(paths) {
   for (const p of paths) {
     const data = readJsonFile(p);
@@ -4695,7 +4541,7 @@ function findOAuthSource(paths) {
   return;
 }
 function snapshotIsStale(sourcePath, snapshotPath) {
-  if (!existsSync5(snapshotPath))
+  if (!existsSync3(snapshotPath))
     return true;
   try {
     return statSync(sourcePath).mtimeMs > statSync(snapshotPath).mtimeMs;
@@ -4726,6 +4572,46 @@ function mergeOAuthInto(paths, oauth, allowDelete, stayUnder) {
     }
   }
 }
+function sanitizeSettingsFile(configDir, stayUnder) {
+  const settingsPath = join4(configDir, "settings.json");
+  const settings = readJsonFile(settingsPath);
+  if (!settings)
+    return false;
+  let changed = false;
+  if ("apiKeyHelper" in settings) {
+    delete settings.apiKeyHelper;
+    changed = true;
+  }
+  const env = settings.env;
+  if (env && typeof env === "object" && !Array.isArray(env)) {
+    const envRecord = env;
+    for (const key of CLAUDE_API_AUTH_ENV_KEYS) {
+      if (key in envRecord) {
+        delete envRecord[key];
+        changed = true;
+      }
+    }
+  }
+  if (changed)
+    writeJsonFile(settingsPath, settings, stayUnder);
+  return changed;
+}
+function sanitizeClaudeProfileApiSettings(profileDir, tool) {
+  if (tool.id !== "claude")
+    return false;
+  return sanitizeSettingsFile(profileDir, profileDir);
+}
+function sanitizeClaudeOAuthProfileSettings(profileDir, tool) {
+  if (tool.id !== "claude")
+    return false;
+  if (!readOAuthSnapshot(profileDir) && !readOAuthFromPaths(profileAccountJsonPaths(profileDir, tool))) {
+    return false;
+  }
+  return sanitizeClaudeProfileApiSettings(profileDir, tool);
+}
+function sanitizeLiveClaudeOAuthSettings() {
+  return sanitizeSettingsFile(liveClaudePaths().configDir, liveClaudeBase());
+}
 function liveOAuthEmail() {
   const live = liveClaudePaths();
   const oauth = readOAuthFromPaths([live.homeJson]);
@@ -4734,13 +4620,13 @@ function liveOAuthEmail() {
 }
 function snapshotLiveAuthToProfile(profileDir, _tool) {
   const authDir = profileAuthDir(profileDir);
-  assertSafeWritePath(join6(authDir, OAUTH_SNAPSHOT), { mustStayUnder: profileDir });
-  mkdirSync4(authDir, { recursive: true });
+  assertSafeWritePath(join4(authDir, OAUTH_SNAPSHOT), { mustStayUnder: profileDir });
+  mkdirSync3(authDir, { recursive: true });
   const live = liveClaudePaths();
   const oauth = readOAuthFromPaths([live.homeJson]);
   if (oauth)
     writeJsonFile(profileOAuthSnapshot(profileDir), { oauthAccount: oauth }, profileDir);
-  if (existsSync5(live.credentialsFile)) {
+  if (existsSync3(live.credentialsFile)) {
     const dest = profileCredentialsSnapshot(profileDir);
     assertSafeWritePath(dest, { mustStayUnder: profileDir });
     copyFileSync(live.credentialsFile, dest);
@@ -4756,19 +4642,20 @@ function snapshotClaudeAuthToProfile(profileDir, tool) {
 }
 function ensureProfileAuthSnapshot(profileDir, tool, opts = {}) {
   const authDir = profileAuthDir(profileDir);
-  assertSafeWritePath(join6(authDir, OAUTH_SNAPSHOT), { mustStayUnder: profileDir });
-  mkdirSync4(authDir, { recursive: true });
+  assertSafeWritePath(join4(authDir, OAUTH_SNAPSHOT), { mustStayUnder: profileDir });
+  mkdirSync3(authDir, { recursive: true });
   const oauthSource = findOAuthSource(profileAccountJsonPaths(profileDir, tool));
   const oauthSnap = profileOAuthSnapshot(profileDir);
   if (oauthSource && (opts.overwrite || snapshotIsStale(oauthSource.path, oauthSnap))) {
     writeJsonFile(oauthSnap, { oauthAccount: oauthSource.oauth }, profileDir);
   }
-  const credFile = join6(profileDir, ".credentials.json");
+  const credFile = join4(profileDir, ".credentials.json");
   const credSnap = profileCredentialsSnapshot(profileDir);
-  if (existsSync5(credFile) && (opts.overwrite || snapshotIsStale(credFile, credSnap))) {
+  if (existsSync3(credFile) && (opts.overwrite || snapshotIsStale(credFile, credSnap))) {
     assertSafeWritePath(credSnap, { mustStayUnder: profileDir });
     copyFileSync(credFile, credSnap);
   }
+  sanitizeClaudeOAuthProfileSettings(profileDir, tool);
 }
 function profileHasAuth(profileDir, tool) {
   return hasAuthSnapshot(profileDir) || !!readOAuthFromPaths(profileAccountJsonPaths(profileDir, tool));
@@ -4781,21 +4668,23 @@ function restoreClaudeAuthFromProfile(profileDir, tool, profileName) {
   ensureProfileAuthSnapshot(profileDir, tool);
   const live = liveClaudePaths();
   const liveRoot = liveClaudeBase();
-  mkdirSync4(live.configDir, { recursive: true });
+  mkdirSync3(live.configDir, { recursive: true });
   const oauthSnap = readJsonFile(profileOAuthSnapshot(profileDir));
   const oauth = oauthSnap?.oauthAccount && typeof oauthSnap.oauthAccount === "object" ? oauthSnap.oauthAccount : readOAuthFromPaths(profileAccountJsonPaths(profileDir, tool));
   if (!oauth) {
     throw new AccountsError("profile has no OAuth account data to apply");
   }
+  sanitizeClaudeOAuthProfileSettings(profileDir, tool);
+  sanitizeLiveClaudeOAuthSettings();
   assertSafeWritePath(live.homeJson, { mustStayUnder: liveRoot });
   mergeOAuthInto([live.homeJson], oauth, false, liveRoot);
   const credSnap = profileCredentialsSnapshot(profileDir);
-  if (existsSync5(credSnap)) {
+  if (existsSync3(credSnap)) {
     assertSafeWritePath(live.credentialsFile, { mustStayUnder: liveRoot });
     assertSafeWritePath(credSnap, { mustStayUnder: profileDir });
     copyFileSync(credSnap, live.credentialsFile);
-    writeFileSync2(live.credentialsFile, readFileSync3(live.credentialsFile), { mode: 384 });
-  } else if (existsSync5(live.credentialsFile)) {
+    writeFileSync2(live.credentialsFile, readFileSync2(live.credentialsFile), { mode: 384 });
+  } else if (existsSync3(live.credentialsFile)) {
     if (!lstatSync2(live.credentialsFile).isSymbolicLink())
       unlinkSync(live.credentialsFile);
   }
@@ -4817,9 +4706,257 @@ function restoreClaudeAuthFromProfile(profileDir, tool, profileName) {
   }
 }
 function hasAuthSnapshot(profileDir) {
-  return existsSync5(profileOAuthSnapshot(profileDir)) || existsSync5(profileCredentialsSnapshot(profileDir)) || existsSync5(profileKeychainSnapshot(profileDir));
+  return existsSync3(profileOAuthSnapshot(profileDir)) || existsSync3(profileCredentialsSnapshot(profileDir)) || existsSync3(profileKeychainSnapshot(profileDir));
 }
 
+// src/lib/env.ts
+function renderTemplate(value, profile) {
+  return value.replaceAll("{profileDir}", profile.dir).replaceAll("{profileName}", profile.name).replaceAll("{toolId}", profile.tool);
+}
+function profileEnv(profile, tool) {
+  const env = {
+    [tool.envVar]: profile.dir
+  };
+  for (const [name, value] of Object.entries(tool.extraEnv ?? {})) {
+    env[name] = renderTemplate(value, profile);
+  }
+  if (tool.id === "claude") {
+    sanitizeClaudeProfileApiSettings(profile.dir, tool);
+    for (const key of CLAUDE_API_AUTH_ENV_KEYS)
+      env[key] = "";
+  }
+  return env;
+}
+function formatEnvAssignments(env) {
+  return Object.entries(env).map(([name, value]) => `${name}=${JSON.stringify(value)}`).join(" ");
+}
+function formatExportLines(env) {
+  return Object.entries(env).map(([name, value]) => `export ${name}=${JSON.stringify(value)}`).join(`
+`);
+}
+// src/lib/detect.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join5 } from "node:path";
+function detectEmail(dir, tool) {
+  if (!tool.accountFile || !tool.emailPath)
+    return;
+  const candidates = [join5(dir, tool.accountFile)];
+  if (dir === tool.defaultDir)
+    candidates.push(join5(dirname4(dir), tool.accountFile));
+  for (const file of candidates) {
+    const email = readEmail(file, tool.emailPath);
+    if (email)
+      return email;
+  }
+  return;
+}
+function readEmail(file, path) {
+  if (!existsSync4(file))
+    return;
+  let cursor;
+  try {
+    cursor = JSON.parse(readFileSync3(file, "utf8"));
+  } catch {
+    return;
+  }
+  for (const key of path) {
+    if (cursor && typeof cursor === "object" && key in cursor) {
+      cursor = cursor[key];
+    } else {
+      return;
+    }
+  }
+  return typeof cursor === "string" && cursor.includes("@") ? cursor : undefined;
+}
+// src/lib/profiles.ts
+import { homedir as homedir4 } from "node:os";
+import { isAbsolute, join as join6, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, rmSync } from "node:fs";
+function nowIso() {
+  return new Date().toISOString();
+}
+function expandPath(p) {
+  let out = p;
+  if (out === "~")
+    out = homedir4();
+  else if (out.startsWith("~/"))
+    out = join6(homedir4(), out.slice(2));
+  return isAbsolute(out) ? out : resolve2(process.cwd(), out);
+}
+function listProfiles(toolId) {
+  const profiles = loadStore().profiles;
+  const filtered = toolId ? profiles.filter((p) => p.tool === toolId) : profiles;
+  return filtered.slice().sort((a, b) => a.tool.localeCompare(b.tool) || a.name.localeCompare(b.name));
+}
+function profileMatches(name, toolId) {
+  return loadStore().profiles.filter((p) => p.name === name && (!toolId || p.tool === toolId));
+}
+function findProfile(name, toolId) {
+  const matches = profileMatches(name, toolId);
+  return matches.length === 1 ? matches[0] : undefined;
+}
+function getProfile(name, toolId) {
+  const matches = profileMatches(name, toolId);
+  if (matches.length === 0) {
+    const suffix = toolId ? ` for tool "${toolId}"` : "";
+    throw new AccountsError(`no profile named "${name}"${suffix}. Run \`accounts list\` to see profiles.`);
+  }
+  if (matches.length > 1) {
+    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
+  }
+  const profile = matches[0];
+  return profile;
+}
+function addProfile(opts) {
+  const name = opts.name;
+  const nameCheck = profileNameSchema.safeParse(name);
+  if (!nameCheck.success)
+    throw new AccountsError(nameCheck.error.issues[0]?.message ?? "invalid profile name");
+  const toolId = opts.tool ?? DEFAULT_TOOL;
+  const tool = getTool(toolId);
+  const store = loadStore();
+  if (store.profiles.some((p) => p.name === name && p.tool === toolId)) {
+    throw new AccountsError(`a ${toolId} profile named "${name}" already exists`);
+  }
+  const dir = opts.dir ? expandPath(opts.dir) : join6(profilesDir(), toolId, name);
+  if (store.profiles.some((p) => p.dir === dir)) {
+    throw new AccountsError(`a profile already uses config dir ${dir}`);
+  }
+  mkdirSync4(dir, { recursive: true });
+  const email = opts.email ?? detectEmail(dir, tool);
+  const profile = {
+    name,
+    tool: toolId,
+    ...email ? { email } : {},
+    dir,
+    ...opts.description ? { description: opts.description } : {},
+    createdAt: nowIso()
+  };
+  store.profiles.push(profile);
+  saveStore(store);
+  return profile;
+}
+function removeProfile(name, opts = {}) {
+  const options = typeof opts === "boolean" ? { purge: opts } : opts;
+  const store = loadStore();
+  const matches = store.profiles.map((profile2, idx2) => ({ profile: profile2, idx: idx2 })).filter(({ profile: profile2 }) => profile2.name === name && (!options.tool || profile2.tool === options.tool));
+  if (matches.length === 0) {
+    const suffix = options.tool ? ` for tool "${options.tool}"` : "";
+    throw new AccountsError(`no profile named "${name}"${suffix}`);
+  }
+  if (matches.length > 1) {
+    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map(({ profile: profile2 }) => profile2.tool).join(", ")}); pass --tool`);
+  }
+  const idx = matches[0].idx;
+  const profile = store.profiles[idx];
+  store.profiles.splice(idx, 1);
+  if (store.current[profile.tool] === name)
+    delete store.current[profile.tool];
+  if (store.applied[profile.tool] === name)
+    delete store.applied[profile.tool];
+  saveStore(store);
+  let purged = false;
+  let purgeNote;
+  if (options.purge) {
+    const managed = profile.dir.startsWith(profilesDir());
+    const isDefault = profile.dir === getTool(profile.tool).defaultDir;
+    if (managed && !isDefault && existsSync5(profile.dir)) {
+      rmSync(profile.dir, { recursive: true, force: true });
+      purged = true;
+    } else {
+      purgeNote = `refused to delete ${profile.dir} (not a managed profile dir); remove it manually if intended`;
+    }
+  }
+  return { profile, purged, purgeNote };
+}
+function renameProfile(oldName, newName, toolId) {
+  const nameCheck = profileNameSchema.safeParse(newName);
+  if (!nameCheck.success)
+    throw new AccountsError(nameCheck.error.issues[0]?.message ?? "invalid profile name");
+  const store = loadStore();
+  const matches = store.profiles.filter((p) => p.name === oldName && (!toolId || p.tool === toolId));
+  if (matches.length === 0) {
+    const suffix = toolId ? ` for tool "${toolId}"` : "";
+    throw new AccountsError(`no profile named "${oldName}"${suffix}`);
+  }
+  if (matches.length > 1) {
+    throw new AccountsError(`profile "${oldName}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
+  }
+  const profile = matches[0];
+  if (store.profiles.some((p) => p.name === newName && p.tool === profile.tool)) {
+    throw new AccountsError(`a ${profile.tool} profile named "${newName}" already exists`);
+  }
+  if (store.current[profile.tool] === oldName)
+    store.current[profile.tool] = newName;
+  if (store.applied[profile.tool] === oldName)
+    store.applied[profile.tool] = newName;
+  profile.name = newName;
+  saveStore(store);
+  return profile;
+}
+function updateProfile(name, opts) {
+  const store = loadStore();
+  const matches = store.profiles.filter((p) => p.name === name && (!opts.tool || p.tool === opts.tool));
+  if (matches.length === 0) {
+    const suffix = opts.tool ? ` for tool "${opts.tool}"` : "";
+    throw new AccountsError(`no profile named "${name}"${suffix}`);
+  }
+  if (matches.length > 1) {
+    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
+  }
+  const profile = matches[0];
+  if (opts.email !== undefined)
+    profile.email = opts.email;
+  if (opts.description !== undefined)
+    profile.description = opts.description;
+  if (opts.dir !== undefined) {
+    const dir = expandPath(opts.dir);
+    mkdirSync4(dir, { recursive: true });
+    profile.dir = dir;
+  }
+  saveStore(store);
+  return profile;
+}
+function redetectEmail(name, toolId) {
+  const store = loadStore();
+  const matches = store.profiles.filter((p) => p.name === name && (!toolId || p.tool === toolId));
+  if (matches.length === 0) {
+    const suffix = toolId ? ` for tool "${toolId}"` : "";
+    throw new AccountsError(`no profile named "${name}"${suffix}`);
+  }
+  if (matches.length > 1) {
+    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
+  }
+  const profile = matches[0];
+  const email = detectEmail(profile.dir, getTool(profile.tool));
+  if (email)
+    profile.email = email;
+  saveStore(store);
+  return profile;
+}
+function useProfile(name, toolId) {
+  const store = loadStore();
+  const matches = store.profiles.filter((p) => p.name === name && (!toolId || p.tool === toolId));
+  if (matches.length === 0) {
+    const suffix = toolId ? ` for tool "${toolId}"` : "";
+    throw new AccountsError(`no profile named "${name}"${suffix}`);
+  }
+  if (matches.length > 1) {
+    throw new AccountsError(`profile "${name}" exists for multiple tools (${matches.map((p) => p.tool).join(", ")}); pass --tool`);
+  }
+  const profile = matches[0];
+  store.current[profile.tool] = name;
+  profile.lastUsedAt = nowIso();
+  saveStore(store);
+  return { profile, toolId: profile.tool };
+}
+function currentProfile(toolId) {
+  const store = loadStore();
+  const name = store.current[toolId];
+  if (!name)
+    return;
+  return store.profiles.find((p) => p.name === name);
+}
 // src/lib/apply-lock.ts
 import { closeSync, existsSync as existsSync6, mkdirSync as mkdirSync5, openSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { join as join7 } from "node:path";
@@ -4970,7 +5107,8 @@ function commandLine(env, command) {
   return `${formatEnvAssignments(env)} ${command.map(shellQuote).join(" ")}`.trim();
 }
 function commandFor(tool, opts) {
-  return [tool.bin, ...opts.resume ? tool.resumeArgs ?? [] : [], ...opts.args ?? []];
+  const args = [...opts.resume ? tool.resumeArgs ?? [] : [], ...opts.args ?? []];
+  return [tool.bin, ...mergeToolArgs(tool, args, { permissions: opts.permissions })];
 }
 function switchProfile(name, opts = {}) {
   const profile = getProfile(name, opts.tool);
@@ -4999,6 +5137,7 @@ function switchProfile(name, opts = {}) {
     exports: formatExportLines(env),
     command,
     commandLine: commandLine(env, command),
+    ...opts.permissions ? { permissions: normalizePermissionPreset(opts.permissions) } : {},
     restartRequired,
     message
   };
@@ -5323,7 +5462,8 @@ async function runSupervisedTool(initialProfile, tool, initialArgs = [], opts =
         tool: tool.id,
         mode: request.mode ?? "auto",
         resume: request.resume ?? true,
-        args: request.args ?? []
+        args: request.args ?? [],
+        permissions: request.permissions
       });
       log(`accounts supervisor: switching ${tool.id} to ${result.profile.name}`);
       setTimeout(() => void restartWith(result), 0);
@@ -5473,6 +5613,9 @@ export {
   shellSnippet,
   sendSupervisorRequest,
   saveStore,
+  sanitizeLiveClaudeOAuthSettings,
+  sanitizeClaudeProfileApiSettings,
+  sanitizeClaudeOAuthProfileSettings,
   runSupervisedTool,
   restoreClaudeAuthFromProfile,
   resolveSupervisorLaunch,
@@ -5488,6 +5631,9 @@ export {
   profileHasAuth,
   profileEnv,
   pickProfile,
+  permissionArgsFor,
+  normalizePermissionPreset,
+  mergeToolArgs,
   loadStore,
   listTools,
   listSupervisorStates,
@@ -5517,6 +5663,7 @@ export {
   addCustomTool,
   accountsHome,
   DEFAULT_TOOL,
+  CLAUDE_API_AUTH_ENV_KEYS,
   BUILTIN_TOOLS,
   AccountsError
 };