@hasna/accounts 0.1.18 → 0.1.20

package/dist/index.js

@@ -4029,57 +4029,126 @@ class AccountsError extends Error {
 }
 // src/storage.ts
 import { homedir } from "node:os";
-import { join } from "node:path";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { chmodSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "node:fs";
 
 // src/lib/safe-path.ts
 import { existsSync, lstatSync, mkdirSync, realpathSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+function lstatIfExists(path) {
+  try {
+    return lstatSync(path);
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+    return;
+  }
+}
 function throwIfSymlink(path, label) {
-  if (existsSync(path) && lstatSync(path).isSymbolicLink()) {
+  if (lstatIfExists(path)?.isSymbolicLink()) {
     throw new AccountsError(`${label}: ${path}`);
   }
 }
-function assertDirChainSafe(targetFile, mustStayUnder) {
-  const absFile = resolve(targetFile);
-  const parent = dirname(absFile);
-  const base = mustStayUnder ? resolve(mustStayUnder) : undefined;
-  if (base) {
-    const rel = absFile.startsWith(base + "/") ? absFile.slice(base.length + 1) : "";
-    if (!rel && absFile !== base) {
-      throw new AccountsError(`refusing to write outside profile directory: ${targetFile}`);
-    }
-    const segments = rel.split("/").filter(Boolean);
-    if (segments.some((s) => s === "..")) {
-      throw new AccountsError(`refusing path traversal: ${targetFile}`);
-    }
-    let cursor = base;
-    for (let i = 0;i < segments.length - 1; i++) {
-      cursor = resolve(cursor, segments[i]);
-      throwIfSymlink(cursor, "refusing to write under symlink directory");
-    }
-  } else {
-    let cursor = parent;
-    for (;; ) {
-      throwIfSymlink(cursor, "refusing to write under symlink directory");
-      const next = dirname(cursor);
-      if (next === cursor)
-        break;
-      cursor = next;
+function isAllowedSystemDirectorySymlink(path) {
+  if (path !== "/var" && path !== "/tmp")
+    return false;
+  try {
+    return realpathSync(path) === `/private${path}`;
+  } catch {
+    return false;
+  }
+}
+function assertDirectory(path, label, opts) {
+  const stat = lstatIfExists(path);
+  if (!stat) {
+    throw new AccountsError(`refusing to write under missing directory: ${path}`);
+  }
+  if (stat.isSymbolicLink()) {
+    if (opts?.allowSystemSymlink && isAllowedSystemDirectorySymlink(path))
+      return;
+    throw new AccountsError(`${label}: ${path}`);
+  }
+  if (!stat.isDirectory()) {
+    throw new AccountsError(`refusing to write under non-directory path: ${path}`);
+  }
+}
+function assertInsideBase(absPath, base, originalPath) {
+  const rel = relative(base, absPath);
+  if (rel === "")
+    return rel;
+  if (rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel)) {
+    throw new AccountsError(`refusing to write outside profile directory: ${originalPath}`);
+  }
+  return rel;
+}
+function assertExistingDirectoryComponentsSafe(path, label) {
+  const root = parse(path).root;
+  const rel = relative(root, path);
+  const segments = rel ? rel.split(sep).filter(Boolean) : [];
+  let cursor = root;
+  assertDirectory(cursor, label, { allowSystemSymlink: true });
+  for (const segment of segments) {
+    cursor = join(cursor, segment);
+    if (!lstatIfExists(cursor))
+      return;
+    assertDirectory(cursor, label, { allowSystemSymlink: true });
+  }
+}
+function ensureBoundaryRootSafe(base) {
+  const missing = [];
+  let cursor = base;
+  while (!lstatIfExists(cursor)) {
+    missing.unshift(cursor);
+    const parent = dirname(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  assertDirectory(cursor, "refusing to use symlink base directory");
+  for (const dir of missing) {
+    if (lstatIfExists(dir)) {
+      assertDirectory(dir, "refusing to use symlink base directory");
+    } else {
+      mkdirSync(dir);
+      assertDirectory(dir, "refusing to use symlink base directory");
+    }
+  }
+  assertDirectory(base, "refusing to use symlink base directory");
+}
+function ensureDirectoryChainSafe(parent, startAt) {
+  const root = startAt ?? parse(parent).root;
+  const rel = relative(root, parent);
+  const segments = rel ? rel.split(sep).filter(Boolean) : [];
+  let cursor = root;
+  if (startAt)
+    assertDirectory(startAt, "refusing to write under symlink directory");
+  for (const segment of segments) {
+    cursor = join(cursor, segment);
+    if (lstatIfExists(cursor)) {
+      assertDirectory(cursor, "refusing to write under symlink directory");
+    } else {
+      mkdirSync(cursor);
+      assertDirectory(cursor, "refusing to write under symlink directory");
     }
   }
 }
 function assertSafeWritePath(filePath, opts) {
   const absFile = resolve(filePath);
   const parent = dirname(absFile);
-  if (!existsSync(parent))
-    mkdirSync(parent, { recursive: true });
+  const base = opts?.mustStayUnder ? resolve(opts.mustStayUnder) : undefined;
+  if (base) {
+    assertInsideBase(absFile, base, filePath);
+    assertExistingDirectoryComponentsSafe(base, "refusing to use symlink base directory");
+    ensureBoundaryRootSafe(base);
+    ensureDirectoryChainSafe(parent, base);
+  } else {
+    ensureDirectoryChainSafe(parent);
+  }
   throwIfSymlink(absFile, "refusing to write through symlink");
-  assertDirChainSafe(absFile, opts?.mustStayUnder);
   const resolved = realpathSync(existsSync(absFile) ? absFile : parent);
-  if (opts?.mustStayUnder) {
-    const base = realpathSync(resolve(opts.mustStayUnder));
-    if (resolved !== base && !resolved.startsWith(base + "/")) {
+  if (base) {
+    const realBase = realpathSync(base);
+    if (resolved !== realBase && !resolved.startsWith(realBase + sep)) {
       throw new AccountsError(`refusing to write outside profile directory: ${filePath}`);
     }
   }
@@ -4108,16 +4177,16 @@ function accountsHome() {
   const override = process.env.ACCOUNTS_HOME;
   if (override && override.trim())
     return validateEnvPath(override, "ACCOUNTS_HOME");
-  return join(homedir(), ".hasna", "accounts");
+  return join2(homedir(), ".hasna", "accounts");
 }
 function storePath() {
   const override = process.env.ACCOUNTS_STORE_PATH;
   if (override && override.trim())
     return validateEnvPath(override, "ACCOUNTS_STORE_PATH");
-  return join(accountsHome(), "accounts.json");
+  return join2(accountsHome(), "accounts.json");
 }
 function profilesDir() {
-  return join(accountsHome(), "profiles");
+  return join2(accountsHome(), "profiles");
 }
 var EMPTY_STORE = { version: 1, current: {}, applied: {}, profiles: [], tools: [] };
 function loadStore() {
@@ -4160,13 +4229,16 @@ function loadStore() {
 function saveStore(store) {
   const path = storePath();
   assertSafeWritePath(path, { mustStayUnder: accountsHome() });
-  mkdirSync2(join(path, ".."), { recursive: true });
+  mkdirSync2(join2(path, ".."), { recursive: true });
+  if (existsSync2(path))
+    chmodSync(path, 384);
   writeFileSync(path, JSON.stringify(store, null, 2) + `
 `, { mode: 384 });
+  chmodSync(path, 384);
 }
 // src/lib/tools.ts
 import { homedir as homedir2 } from "node:os";
-import { join as join2 } from "node:path";
+import { join as join3 } from "node:path";
 var BUILTIN_TOOLS = [
   {
     id: "claude",
@@ -4175,7 +4247,7 @@ var BUILTIN_TOOLS = [
     extraEnv: {
       TELEGRAM_STATE_DIR: "{profileDir}/channels/telegram"
     },
-    defaultDir: join2(homedir2(), ".claude"),
+    defaultDir: join3(homedir2(), ".claude"),
     bin: "claude",
     loginHint: "run /login inside Claude, then /exit when done",
     resumeArgs: ["--continue"],
@@ -4195,7 +4267,7 @@ var BUILTIN_TOOLS = [
     id: "codex-app",
     label: "Codex App",
     envVar: "CODEX_HOME",
-    defaultDir: join2(homedir2(), ".codex"),
+    defaultDir: join3(homedir2(), ".codex"),
     bin: "/Applications/Codex.app/Contents/MacOS/Codex",
     loginHint: "sign in inside Codex.app, then quit the app when the profile is ready",
     launchArgs: ["--user-data-dir={profileDir}/electron-user-data"],
@@ -4205,7 +4277,7 @@ var BUILTIN_TOOLS = [
     id: "codex",
     label: "Codex CLI",
     envVar: "CODEX_HOME",
-    defaultDir: join2(homedir2(), ".codex"),
+    defaultDir: join3(homedir2(), ".codex"),
     bin: "codex",
     loginArgs: ["login"],
     loginHint: "complete the Codex login flow for this CODEX_HOME",
@@ -4218,7 +4290,7 @@ var BUILTIN_TOOLS = [
     id: "takumi",
     label: "Takumi",
     envVar: "TAKUMI_CONFIG_DIR",
-    defaultDir: join2(homedir2(), ".takumi"),
+    defaultDir: join3(homedir2(), ".takumi"),
     bin: "takumi",
     loginHint: "complete Takumi auth in this TAKUMI_CONFIG_DIR",
     resumeArgs: ["--continue"],
@@ -4238,7 +4310,7 @@ var BUILTIN_TOOLS = [
     id: "gemini",
     label: "Gemini CLI",
     envVar: "GEMINI_CONFIG_DIR",
-    defaultDir: join2(homedir2(), ".gemini"),
+    defaultDir: join3(homedir2(), ".gemini"),
     bin: "gemini",
     loginHint: "complete Gemini auth in this GEMINI_CONFIG_DIR",
     permissionArgs: {
@@ -4256,7 +4328,7 @@ var BUILTIN_TOOLS = [
       XDG_CONFIG_HOME: "{profileDir}/xdg-config",
       XDG_DATA_HOME: "{profileDir}/xdg-data"
     },
-    defaultDir: join2(homedir2(), ".config", "opencode"),
+    defaultDir: join3(homedir2(), ".config", "opencode"),
     bin: "opencode",
     loginArgs: ["auth", "login"],
     loginHint: "complete opencode auth login for this isolated config/data root",
@@ -4266,7 +4338,7 @@ var BUILTIN_TOOLS = [
     id: "cursor",
     label: "Cursor Agent",
     envVar: "CURSOR_CONFIG_DIR",
-    defaultDir: join2(homedir2(), ".cursor"),
+    defaultDir: join3(homedir2(), ".cursor"),
     bin: "cursor-agent",
     loginArgs: ["login"],
     loginHint: "complete cursor-agent login for this CURSOR_CONFIG_DIR"
@@ -4275,7 +4347,7 @@ var BUILTIN_TOOLS = [
     id: "pi",
     label: "Pi Coding Agent",
     envVar: "PI_CODING_AGENT_HOME",
-    defaultDir: join2(homedir2(), ".pi"),
+    defaultDir: join3(homedir2(), ".pi"),
     bin: "pi",
     loginHint: "complete Pi coding agent auth in this PI_CODING_AGENT_HOME"
   },
@@ -4283,7 +4355,7 @@ var BUILTIN_TOOLS = [
     id: "hermes",
     label: "Hermes",
     envVar: "HERMES_HOME",
-    defaultDir: join2(homedir2(), ".hermes"),
+    defaultDir: join3(homedir2(), ".hermes"),
     bin: "hermes",
     loginHint: "complete Hermes auth in this HERMES_HOME",
     permissionArgs: {
@@ -4295,7 +4367,7 @@ var BUILTIN_TOOLS = [
     id: "kimi",
     label: "Kimi Code",
     envVar: "KIMI_CODE_HOME",
-    defaultDir: join2(homedir2(), ".kimi-code"),
+    defaultDir: join3(homedir2(), ".kimi-code"),
     bin: "kimi",
     loginArgs: ["login"],
     loginHint: "complete kimi login for this KIMI_CODE_HOME",
@@ -4310,7 +4382,7 @@ var BUILTIN_TOOLS = [
     id: "grok",
     label: "Grok Build",
     envVar: "HOME",
-    defaultDir: join2(homedir2(), ".grok"),
+    defaultDir: join3(homedir2(), ".grok"),
     bin: "grok",
     loginArgs: ["login"],
     loginHint: "complete grok login in this process-scoped HOME; prefer launch/shell over exporting HOME globally"
@@ -4416,11 +4488,11 @@ function removeCustomTool(id) {
 }
 // src/lib/claude-auth.ts
 import { copyFileSync, existsSync as existsSync3, lstatSync as lstatSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync2, statSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname3, join as join4 } from "node:path";
+import { dirname as dirname3, join as join5 } from "node:path";
 
 // src/lib/claude-layout.ts
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname2, join as join3 } from "node:path";
+import { dirname as dirname2, join as join4 } from "node:path";
 var CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
 var ACCOUNTS_AUTH_DIR = ".accounts-auth";
 var OAUTH_SNAPSHOT = "oauth-account.json";
@@ -4432,32 +4504,32 @@ function liveClaudeBase() {
 }
 function liveClaudePaths() {
   const base = liveClaudeBase();
-  const configDir = join3(base, ".claude");
+  const configDir = join4(base, ".claude");
   return {
     configDir,
-    homeJson: join3(base, ".claude.json"),
-    credentialsFile: join3(configDir, ".credentials.json")
+    homeJson: join4(base, ".claude.json"),
+    credentialsFile: join4(configDir, ".credentials.json")
   };
 }
 function profileAccountJsonPaths(profileDir, tool) {
   if (!tool.accountFile)
     return [];
-  const paths = [join3(profileDir, tool.accountFile)];
+  const paths = [join4(profileDir, tool.accountFile)];
   if (profileDir === tool.defaultDir)
-    paths.push(join3(dirname2(profileDir), tool.accountFile));
+    paths.push(join4(dirname2(profileDir), tool.accountFile));
   return paths;
 }
 function profileAuthDir(profileDir) {
-  return join3(profileDir, ACCOUNTS_AUTH_DIR);
+  return join4(profileDir, ACCOUNTS_AUTH_DIR);
 }
 function profileOAuthSnapshot(profileDir) {
-  return join3(profileAuthDir(profileDir), OAUTH_SNAPSHOT);
+  return join4(profileAuthDir(profileDir), OAUTH_SNAPSHOT);
 }
 function profileCredentialsSnapshot(profileDir) {
-  return join3(profileAuthDir(profileDir), CREDENTIALS_SNAPSHOT);
+  return join4(profileAuthDir(profileDir), CREDENTIALS_SNAPSHOT);
 }
 function profileKeychainSnapshot(profileDir) {
-  return join3(profileAuthDir(profileDir), KEYCHAIN_SNAPSHOT);
+  return join4(profileAuthDir(profileDir), KEYCHAIN_SNAPSHOT);
 }
 
 // src/lib/keychain.ts
@@ -4611,7 +4683,7 @@ function mergeOAuthInto(paths, oauth, allowDelete, stayUnder) {
   }
 }
 function sanitizeSettingsFile(configDir, stayUnder) {
-  const settingsPath = join4(configDir, "settings.json");
+  const settingsPath = join5(configDir, "settings.json");
   const settings = readJsonFile(settingsPath);
   if (!settings)
     return false;
@@ -4658,7 +4730,7 @@ function liveOAuthEmail() {
 }
 function snapshotLiveAuthToProfile(profileDir, _tool) {
   const authDir = profileAuthDir(profileDir);
-  assertSafeWritePath(join4(authDir, OAUTH_SNAPSHOT), { mustStayUnder: profileDir });
+  assertSafeWritePath(join5(authDir, OAUTH_SNAPSHOT), { mustStayUnder: profileDir });
   mkdirSync3(authDir, { recursive: true });
   const live = liveClaudePaths();
   const oauth = readOAuthFromPaths([live.homeJson]);
@@ -4680,14 +4752,14 @@ function snapshotClaudeAuthToProfile(profileDir, tool) {
 }
 function ensureProfileAuthSnapshot(profileDir, tool, opts = {}) {
   const authDir = profileAuthDir(profileDir);
-  assertSafeWritePath(join4(authDir, OAUTH_SNAPSHOT), { mustStayUnder: profileDir });
+  assertSafeWritePath(join5(authDir, OAUTH_SNAPSHOT), { mustStayUnder: profileDir });
   mkdirSync3(authDir, { recursive: true });
   const oauthSource = findOAuthSource(profileAccountJsonPaths(profileDir, tool));
   const oauthSnap = profileOAuthSnapshot(profileDir);
   if (oauthSource && (opts.overwrite || snapshotIsStale(oauthSource.path, oauthSnap))) {
     writeJsonFile(oauthSnap, { oauthAccount: oauthSource.oauth }, profileDir);
   }
-  const credFile = join4(profileDir, ".credentials.json");
+  const credFile = join5(profileDir, ".credentials.json");
   const credSnap = profileCredentialsSnapshot(profileDir);
   if (existsSync3(credFile) && (opts.overwrite || snapshotIsStale(credFile, credSnap))) {
     assertSafeWritePath(credSnap, { mustStayUnder: profileDir });
@@ -4749,7 +4821,7 @@ function hasAuthSnapshot(profileDir) {
 
 // src/lib/codex-app.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var FILE_CREDENTIALS_LINE = 'cli_auth_credentials_store = "file"';
 function insertRootConfigLine(config, line) {
   if (config.trim() === "")
@@ -4776,7 +4848,7 @@ ${after}${after.endsWith(`
 }
 function ensureCodexAppProfileConfig(profileDir) {
   mkdirSync4(profileDir, { recursive: true });
-  const configPath = join5(profileDir, "config.toml");
+  const configPath = join6(profileDir, "config.toml");
   const current = existsSync4(configPath) ? readFileSync3(configPath, "utf8") : "";
   if (/^\s*cli_auth_credentials_store\s*=/.test(current))
     return;
@@ -4812,13 +4884,13 @@ function formatExportLines(env) {
 }
 // src/lib/detect.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-import { dirname as dirname4, join as join6 } from "node:path";
+import { dirname as dirname4, join as join7 } from "node:path";
 function detectEmail(dir, tool) {
   if (!tool.accountFile || !tool.emailPath)
     return;
-  const candidates = [join6(dir, tool.accountFile)];
+  const candidates = [join7(dir, tool.accountFile)];
   if (dir === tool.defaultDir)
-    candidates.push(join6(dirname4(dir), tool.accountFile));
+    candidates.push(join7(dirname4(dir), tool.accountFile));
   for (const file of candidates) {
     const email = readEmail(file, tool.emailPath);
     if (email)
@@ -4846,7 +4918,7 @@ function readEmail(file, path) {
 }
 // src/lib/profiles.ts
 import { homedir as homedir4 } from "node:os";
-import { isAbsolute, join as join7, relative, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join8, relative as relative2, resolve as resolve2 } from "node:path";
 import { existsSync as existsSync6, mkdirSync as mkdirSync5, rmSync } from "node:fs";
 function nowIso() {
   return new Date().toISOString();
@@ -4856,8 +4928,8 @@ function expandPath(p) {
   if (out === "~")
     out = homedir4();
   else if (out.startsWith("~/"))
-    out = join7(homedir4(), out.slice(2));
-  return isAbsolute(out) ? out : resolve2(process.cwd(), out);
+    out = join8(homedir4(), out.slice(2));
+  return isAbsolute2(out) ? out : resolve2(process.cwd(), out);
 }
 function listProfiles(toolId) {
   const profiles = loadStore().profiles;
@@ -4868,8 +4940,8 @@ function profileMatches(name, toolId) {
   return loadStore().profiles.filter((p) => p.name === name && (!toolId || p.tool === toolId));
 }
 function isManagedProfileDir(dir) {
-  const rel = relative(resolve2(profilesDir()), resolve2(dir));
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+  const rel = relative2(resolve2(profilesDir()), resolve2(dir));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function findProfile(name, toolId) {
   const matches = profileMatches(name, toolId);
@@ -4898,7 +4970,7 @@ function addProfile(opts) {
   if (store.profiles.some((p) => p.name === name && p.tool === toolId)) {
     throw new AccountsError(`a ${toolId} profile named "${name}" already exists`);
   }
-  const dir = opts.dir ? expandPath(opts.dir) : join7(profilesDir(), toolId, name);
+  const dir = opts.dir ? expandPath(opts.dir) : join8(profilesDir(), toolId, name);
   if (store.profiles.some((p) => p.dir === dir)) {
     throw new AccountsError(`a profile already uses config dir ${dir}`);
   }
@@ -5039,9 +5111,9 @@ function currentProfile(toolId) {
 }
 // src/lib/apply-lock.ts
 import { closeSync, existsSync as existsSync7, mkdirSync as mkdirSync6, openSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function lockPath() {
-  return join8(accountsHome(), ".apply.lock");
+  return join9(accountsHome(), ".apply.lock");
 }
 function withApplyLock(fn) {
   const home = accountsHome();
@@ -5111,7 +5183,7 @@ function applyProfileUnlocked(name, toolId) {
 }
 // src/lib/import-profile.ts
 import { cpSync, existsSync as existsSync8 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function importProfile(opts) {
   const toolId = opts.tool ?? DEFAULT_TOOL;
   const tool = getTool(toolId);
@@ -5121,7 +5193,7 @@ function importProfile(opts) {
     throw new AccountsError(`config dir does not exist: ${sourceDir}`);
   }
   if (opts.copy) {
-    const targetDir = join9(profilesDir(), toolId, name);
+    const targetDir = join10(profilesDir(), toolId, name);
     if (existsSync8(targetDir)) {
       throw new AccountsError(`managed copy target already exists: ${targetDir}`);
     }
@@ -5227,20 +5299,20 @@ import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync5, readdirSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "node:fs";
 import { createConnection, createServer } from "node:net";
-import { basename, join as join10 } from "node:path";
+import { basename, join as join11 } from "node:path";
 var STATE_SUFFIX = ".json";
 function supervisorDir() {
-  return join10(accountsHome(), "supervisors");
+  return join11(accountsHome(), "supervisors");
 }
 function supervisorStatePath(toolId) {
-  return join10(supervisorDir(), `${toolId}${STATE_SUFFIX}`);
+  return join11(supervisorDir(), `${toolId}${STATE_SUFFIX}`);
 }
 function supervisorSocketPath(toolId) {
   if (process.platform === "win32") {
     const hash = createHash("sha1").update(accountsHome()).digest("hex").slice(0, 12);
     return `\\\\.\\pipe\\hasna-accounts-${hash}-${toolId}`;
   }
-  return join10(supervisorDir(), `${toolId}.sock`);
+  return join11(supervisorDir(), `${toolId}.sock`);
 }
 function nowIso2() {
   return new Date().toISOString();
@@ -5617,7 +5689,7 @@ async function pickProfile(opts = {}) {
 }
 // src/lib/hook.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync6, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "node:fs";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 var HOOK_FILE = "claude-hook.sh";
 var MARKER = "# accounts-claude-hook";
 var NAME_PATTERN = "^[a-z0-9][a-z0-9-]*$";
@@ -5625,7 +5697,7 @@ function shellQuotePath(path) {
   return `'${path.replace(/'/g, `'\\''`)}'`;
 }
 function hookPath() {
-  return join11(accountsHome(), HOOK_FILE);
+  return join12(accountsHome(), HOOK_FILE);
 }
 function hookScript() {
   const quotedHook = shellQuotePath(hookPath());

package/dist/lib/safe-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safe-path.d.ts","sourceRoot":"","sources":["../../src/lib/safe-path.ts"],"names":[],"mappings":"AAyCA,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAiB/F"}
+{"version":3,"file":"safe-path.d.ts","sourceRoot":"","sources":["../../src/lib/safe-path.ts"],"names":[],"mappings":"AA2GA,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAuB/F"}