@hasna/instructions 0.6.1 → 0.7.0

package/dist/chunks/index-8rb7ng2y.js

@@ -0,0 +1,148 @@
+// @bun
+// src/storage/s3-config.ts
+var INSTRUCTIONS_S3_ENV = {
+  bucket: "HASNA_INSTRUCTIONS_S3_BUCKET",
+  prefix: "HASNA_INSTRUCTIONS_S3_PREFIX",
+  region: "HASNA_INSTRUCTIONS_AWS_REGION",
+  endpoint: "HASNA_INSTRUCTIONS_S3_ENDPOINT",
+  forcePathStyle: "HASNA_INSTRUCTIONS_S3_FORCE_PATH_STYLE",
+  accessKeyId: "HASNA_INSTRUCTIONS_S3_ACCESS_KEY_ID",
+  secretAccessKey: "HASNA_INSTRUCTIONS_S3_SECRET_ACCESS_KEY",
+  sessionToken: "HASNA_INSTRUCTIONS_S3_SESSION_TOKEN"
+};
+var INSTRUCTIONS_S3_ALIAS_ENV = {
+  bucket: "INSTRUCTIONS_S3_BUCKET",
+  prefix: "INSTRUCTIONS_S3_PREFIX",
+  region: "INSTRUCTIONS_AWS_REGION",
+  endpoint: "INSTRUCTIONS_S3_ENDPOINT",
+  forcePathStyle: "INSTRUCTIONS_S3_FORCE_PATH_STYLE",
+  accessKeyId: "INSTRUCTIONS_S3_ACCESS_KEY_ID",
+  secretAccessKey: "INSTRUCTIONS_S3_SECRET_ACCESS_KEY",
+  sessionToken: "INSTRUCTIONS_S3_SESSION_TOKEN"
+};
+var BUCKET_PATTERN = /^(?!xn--)[a-z0-9](?:[a-z0-9.-]{1,61}[a-z0-9])?$/;
+var REGION_PATTERN = /^[a-z]{2}(?:-gov)?-[a-z0-9-]+-\d$/;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+function loadInstructionsS3Config(env = process.env) {
+  const bucket = readEnv(env, "bucket");
+  const configuredWithoutBucket = Object.keys(INSTRUCTIONS_S3_ENV).filter((key) => key !== "bucket").some((key) => readEnv(env, key) !== undefined);
+  if (!bucket) {
+    if (configuredWithoutBucket) {
+      throw new Error(`${INSTRUCTIONS_S3_ENV.bucket} is required when any Instructions S3 setting is configured`);
+    }
+    return;
+  }
+  validateBucket(bucket);
+  const prefix = normalizeInstructionsS3Prefix(readEnv(env, "prefix") ?? "instructions/");
+  const region = readEnv(env, "region") ?? "us-east-1";
+  validateRegion(region);
+  const endpoint = normalizeEndpoint(readEnv(env, "endpoint"));
+  const forcePathStyle = parseBoolean(readEnv(env, "forcePathStyle"), false);
+  const accessKeyId = readEnv(env, "accessKeyId");
+  const secretAccessKey = readEnv(env, "secretAccessKey");
+  const sessionToken = readEnv(env, "sessionToken");
+  if (Boolean(accessKeyId) !== Boolean(secretAccessKey)) {
+    throw new Error(`${INSTRUCTIONS_S3_ENV.accessKeyId} and ${INSTRUCTIONS_S3_ENV.secretAccessKey} must be configured together`);
+  }
+  if (sessionToken && (!accessKeyId || !secretAccessKey)) {
+    throw new Error(`${INSTRUCTIONS_S3_ENV.sessionToken} requires a complete static credential pair`);
+  }
+  return {
+    provider: "s3",
+    bucket,
+    prefix,
+    region,
+    ...endpoint ? { endpoint } : {},
+    forcePathStyle,
+    ...accessKeyId && secretAccessKey ? {
+      credentials: {
+        accessKeyId,
+        secretAccessKey,
+        ...sessionToken ? { sessionToken } : {}
+      }
+    } : {}
+  };
+}
+function normalizeInstructionsS3Prefix(value) {
+  const trimmed = value.trim();
+  if (!trimmed || CONTROL_CHARACTERS.test(trimmed) || trimmed.includes("\\")) {
+    throw new Error("Instructions S3 prefix is invalid");
+  }
+  const withoutEdges = trimmed.replace(/^\/+|\/+$/g, "");
+  if (!withoutEdges || withoutEdges.includes("//")) {
+    throw new Error("Instructions S3 prefix is invalid");
+  }
+  const segments = withoutEdges.split("/");
+  for (const segment of segments) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      throw new Error("Instructions S3 prefix contains invalid percent encoding");
+    }
+    if (!decoded || decoded === "." || decoded === ".." || decoded.includes("/") || decoded.includes("\\") || CONTROL_CHARACTERS.test(decoded)) {
+      throw new Error("Instructions S3 prefix contains an unsafe path segment");
+    }
+  }
+  return `${segments.join("/")}/`;
+}
+function readEnv(env, key) {
+  const canonical = INSTRUCTIONS_S3_ENV[key];
+  if (Object.prototype.hasOwnProperty.call(env, canonical))
+    return clean(env[canonical]);
+  return clean(env[INSTRUCTIONS_S3_ALIAS_ENV[key]]);
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function parseBoolean(value, fallback) {
+  if (!value)
+    return fallback;
+  switch (value.toLowerCase()) {
+    case "1":
+    case "true":
+    case "yes":
+    case "on":
+      return true;
+    case "0":
+    case "false":
+    case "no":
+    case "off":
+      return false;
+    default:
+      throw new Error("Instructions S3 boolean setting is invalid");
+  }
+}
+function validateBucket(bucket) {
+  if (bucket.length < 3 || bucket.length > 63 || !BUCKET_PATTERN.test(bucket) || bucket.includes("..") || bucket.includes(".-") || bucket.includes("-.") || /^\d{1,3}(?:\.\d{1,3}){3}$/.test(bucket)) {
+    throw new Error("Instructions S3 bucket is invalid");
+  }
+}
+function validateRegion(region) {
+  if (!REGION_PATTERN.test(region))
+    throw new Error("Instructions AWS region is invalid");
+}
+function normalizeEndpoint(value) {
+  if (!value)
+    return;
+  let endpoint;
+  try {
+    endpoint = new URL(value);
+  } catch {
+    throw new Error("Instructions S3 endpoint is invalid");
+  }
+  if (endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+    throw new Error("Instructions S3 endpoint must not contain credentials, query parameters, or fragments");
+  }
+  if (endpoint.pathname !== "/") {
+    throw new Error("Instructions S3 endpoint must be an origin without a path");
+  }
+  const localHttp = endpoint.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(endpoint.hostname);
+  if (endpoint.protocol !== "https:" && !localHttp) {
+    throw new Error("Instructions S3 endpoint must use HTTPS (HTTP is allowed only for loopback development)");
+  }
+  return endpoint.origin;
+}
+
+export { INSTRUCTIONS_S3_ENV, INSTRUCTIONS_S3_ALIAS_ENV, loadInstructionsS3Config, normalizeInstructionsS3Prefix };

package/dist/chunks/index-arrrx0ed.js

@@ -0,0 +1,344 @@
+// @bun
+// src/storage/s3-object-store.ts
+import { createHash, createHmac } from "crypto";
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/;
+var VERSION_ID_PATTERN = /^[^\u0000-\u001f\u007f]{1,1024}$/;
+var CONDITIONAL_CREATE_ATTEMPTS = 3;
+var DEFAULT_EXISTS_DEADLINE_MS = 5000;
+var DEFAULT_BYTES_DEADLINE_MS = 15000;
+var DEFAULT_STAT_DEADLINE_MS = 5000;
+var DEFAULT_VERSIONED_READ_DEADLINE_MS = 15000;
+var DEFAULT_CONDITIONAL_CREATE_ATTEMPT_DEADLINE_MS = 15000;
+var DEFAULT_EXISTENCE_RECONCILIATION_DEADLINE_MS = 5000;
+var MAX_OPERATION_DEADLINE_MS = 60000;
+var EMPTY_SHA256 = createHash("sha256").update("").digest("hex");
+function resolveOperationDeadlineMs(value, fallback, label) {
+  const resolved = value ?? fallback;
+  if (!Number.isSafeInteger(resolved) || resolved <= 0 || resolved > MAX_OPERATION_DEADLINE_MS) {
+    throw new Error(`${label} must be an integer between 1 and ${MAX_OPERATION_DEADLINE_MS} milliseconds`);
+  }
+  return resolved;
+}
+async function runWithDeadline(operation, deadlineMs, onDeadline) {
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      try {
+        onDeadline?.();
+      } finally {
+        reject(new Error("Instructions S3 operation deadline exceeded"));
+      }
+    }, deadlineMs);
+  });
+  try {
+    return await Promise.race([Promise.resolve().then(operation), deadline]);
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+  }
+}
+function assertSafeInstructionsObjectKey(key) {
+  if (!key || key.length > 1024 || key.startsWith("/") || key.endsWith("/") || key.includes("\\") || CONTROL_CHARACTERS.test(key)) {
+    throw new Error("Instructions S3 object key is invalid");
+  }
+  for (const segment of key.split("/")) {
+    if (!segment || segment === "." || segment === "..") {
+      throw new Error("Instructions S3 object key contains an unsafe path segment");
+    }
+  }
+}
+function assertSafeInstructionsObjectVersionId(versionId) {
+  if (!VERSION_ID_PATTERN.test(versionId) || versionId.trim() !== versionId) {
+    throw new Error("Instructions S3 object version id is invalid");
+  }
+}
+function createInstructionsS3ObjectStore(config, createClient = (options) => new Bun.S3Client(options), requestFetch = fetch, deadlines = {}) {
+  const existsDeadlineMs = resolveOperationDeadlineMs(deadlines.existsDeadlineMs, DEFAULT_EXISTS_DEADLINE_MS, "Instructions S3 exists deadline");
+  const bytesDeadlineMs = resolveOperationDeadlineMs(deadlines.bytesDeadlineMs, DEFAULT_BYTES_DEADLINE_MS, "Instructions S3 bytes deadline");
+  const statDeadlineMs = resolveOperationDeadlineMs(deadlines.statDeadlineMs, DEFAULT_STAT_DEADLINE_MS, "Instructions S3 stat deadline");
+  const versionedReadDeadlineMs = resolveOperationDeadlineMs(deadlines.versionedReadDeadlineMs, DEFAULT_VERSIONED_READ_DEADLINE_MS, "Instructions S3 versioned read deadline");
+  const conditionalCreateAttemptDeadlineMs = resolveOperationDeadlineMs(deadlines.conditionalCreateAttemptDeadlineMs, DEFAULT_CONDITIONAL_CREATE_ATTEMPT_DEADLINE_MS, "Instructions S3 conditional create attempt deadline");
+  const existenceReconciliationDeadlineMs = resolveOperationDeadlineMs(deadlines.existenceReconciliationDeadlineMs, DEFAULT_EXISTENCE_RECONCILIATION_DEADLINE_MS, "Instructions S3 existence reconciliation deadline");
+  const client = createClient({
+    bucket: config.bucket,
+    region: config.region,
+    ...config.endpoint ? { endpoint: config.endpoint } : {},
+    ...config.credentials ? {
+      accessKeyId: config.credentials.accessKeyId,
+      secretAccessKey: config.credentials.secretAccessKey,
+      ...config.credentials.sessionToken ? { sessionToken: config.credentials.sessionToken } : {}
+    } : {},
+    ...config.forcePathStyle ? { virtualHostedStyle: false } : {}
+  });
+  return {
+    async putIfAbsent(key, bytes, options) {
+      assertSafeInstructionsObjectKey(key);
+      for (let attempt = 1;attempt <= CONDITIONAL_CREATE_ATTEMPTS; attempt += 1) {
+        let response;
+        const controller = new AbortController;
+        try {
+          const url = client.presign(key, { method: "PUT", expiresIn: 60 });
+          response = await runWithDeadline(() => requestFetch(url, {
+            method: "PUT",
+            headers: {
+              "content-type": options.contentType,
+              "content-md5": createHash("md5").update(bytes).digest("base64"),
+              "if-none-match": "*"
+            },
+            body: Uint8Array.from(bytes),
+            redirect: "error",
+            signal: controller.signal
+          }), conditionalCreateAttemptDeadlineMs, () => controller.abort());
+        } catch {
+          let exists = false;
+          try {
+            exists = await runWithDeadline(() => client.file(key).exists(), existenceReconciliationDeadlineMs);
+          } catch {}
+          if (exists)
+            return { status: "existing" };
+          if (attempt < CONDITIONAL_CREATE_ATTEMPTS)
+            continue;
+          throw new Error("Instructions S3 conditional object creation failed");
+        }
+        if (response.ok) {
+          const versionId = cleanResponseVersionId(response.headers.get("x-amz-version-id"));
+          response.body?.cancel().catch(() => {
+            return;
+          });
+          return { status: "created", ...versionId ? { versionId } : {} };
+        }
+        response.body?.cancel().catch(() => {
+          return;
+        });
+        if (response.status === 412)
+          return { status: "existing" };
+        if (response.status === 409 && attempt < CONDITIONAL_CREATE_ATTEMPTS)
+          continue;
+        if (response.status === 409) {
+          throw new Error("Instructions S3 conditional object creation remained conflicted");
+        }
+        throw new Error(`Instructions S3 conditional object creation failed with status ${response.status}`);
+      }
+      throw new Error("Instructions S3 conditional object creation failed");
+    },
+    async get(key, options = {}) {
+      assertSafeInstructionsObjectKey(key);
+      if (options.versionId) {
+        return readExactVersion(config, key, options.versionId, "GET", requestFetch, versionedReadDeadlineMs).then((result) => result?.bytes);
+      }
+      try {
+        const file = client.file(key);
+        const exists = await runWithDeadline(() => file.exists(), existsDeadlineMs);
+        if (!exists)
+          return;
+        return Uint8Array.from(await runWithDeadline(() => file.bytes(), bytesDeadlineMs));
+      } catch {
+        throw new Error("Instructions S3 get operation failed");
+      }
+    },
+    async head(key, options = {}) {
+      assertSafeInstructionsObjectKey(key);
+      if (options.versionId) {
+        return readExactVersion(config, key, options.versionId, "HEAD", requestFetch, versionedReadDeadlineMs).then((result) => result?.metadata);
+      }
+      try {
+        const file = client.file(key);
+        const exists = await runWithDeadline(() => file.exists(), existsDeadlineMs);
+        if (!exists)
+          return;
+        const stat = await runWithDeadline(() => file.stat(), statDeadlineMs);
+        return {
+          size: stat.size,
+          ...stat.etag ? { etag: stat.etag } : {},
+          ...stat.type ? { contentType: stat.type } : {},
+          ...stat.lastModified ? { lastModified: stat.lastModified } : {}
+        };
+      } catch {
+        throw new Error("Instructions S3 head operation failed");
+      }
+    }
+  };
+}
+async function readExactVersion(config, key, versionId, method, requestFetch, deadlineMs) {
+  assertSafeInstructionsObjectVersionId(versionId);
+  const credentials = resolveRequestCredentials(config);
+  const controller = new AbortController;
+  try {
+    const signed = signVersionedRequest(config, key, versionId, method, credentials, new Date);
+    const response = await runWithDeadline(() => requestFetch(signed.url, {
+      method,
+      headers: signed.headers,
+      redirect: "error",
+      signal: controller.signal
+    }), deadlineMs, () => controller.abort());
+    if (response.status === 404) {
+      response.body?.cancel().catch(() => {
+        return;
+      });
+      return;
+    }
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {
+        return;
+      });
+      throw new Error("versioned S3 request failed");
+    }
+    const observedVersionId = cleanResponseVersionId(response.headers.get("x-amz-version-id"));
+    if (observedVersionId !== versionId) {
+      response.body?.cancel().catch(() => {
+        return;
+      });
+      throw new Error("versioned S3 response authority mismatch");
+    }
+    const bytes = method === "GET" ? new Uint8Array(await response.arrayBuffer()) : new Uint8Array;
+    const contentLength = response.headers.get("content-length");
+    const parsedSize = contentLength === null ? bytes.byteLength : Number(contentLength);
+    if (!Number.isSafeInteger(parsedSize) || parsedSize < 0)
+      throw new Error("invalid S3 content length");
+    const lastModifiedValue = response.headers.get("last-modified");
+    const lastModified = lastModifiedValue ? new Date(lastModifiedValue) : undefined;
+    if (lastModified && !Number.isFinite(lastModified.getTime()))
+      throw new Error("invalid S3 last modified timestamp");
+    return {
+      bytes,
+      metadata: {
+        size: parsedSize,
+        versionId: observedVersionId,
+        ...response.headers.get("etag") ? { etag: response.headers.get("etag") } : {},
+        ...response.headers.get("content-type") ? { contentType: response.headers.get("content-type") } : {},
+        ...lastModified ? { lastModified } : {}
+      }
+    };
+  } catch {
+    throw new Error(`Instructions S3 ${method === "GET" ? "get" : "head"} operation failed`);
+  }
+}
+function resolveRequestCredentials(config) {
+  if (config.credentials)
+    return config.credentials;
+  const accessKeyId = process.env.AWS_ACCESS_KEY_ID?.trim();
+  const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY?.trim();
+  const sessionToken = process.env.AWS_SESSION_TOKEN?.trim();
+  if (!accessKeyId || !secretAccessKey) {
+    throw new Error("Instructions S3 exact-version reads require explicit or AWS environment credentials");
+  }
+  return { accessKeyId, secretAccessKey, ...sessionToken ? { sessionToken } : {} };
+}
+function signVersionedRequest(config, key, versionId, method, credentials, now) {
+  const url = buildObjectUrl(config, key);
+  url.searchParams.set("versionId", versionId);
+  const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "");
+  const shortDate = amzDate.slice(0, 8);
+  const headers = new Headers({
+    host: url.host,
+    "x-amz-content-sha256": EMPTY_SHA256,
+    "x-amz-date": amzDate,
+    ...credentials.sessionToken ? { "x-amz-security-token": credentials.sessionToken } : {}
+  });
+  const signedHeaderNames = [
+    "host",
+    "x-amz-content-sha256",
+    "x-amz-date",
+    ...credentials.sessionToken ? ["x-amz-security-token"] : []
+  ].sort();
+  const canonicalHeaders = signedHeaderNames.map((name) => `${name}:${headers.get(name).trim()}
+`).join("");
+  const canonicalQuery = `versionId=${awsEncode(versionId)}`;
+  const canonicalRequest = [
+    method,
+    url.pathname,
+    canonicalQuery,
+    canonicalHeaders,
+    signedHeaderNames.join(";"),
+    EMPTY_SHA256
+  ].join(`
+`);
+  const scope = `${shortDate}/${config.region}/s3/aws4_request`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    scope,
+    createHash("sha256").update(canonicalRequest).digest("hex")
+  ].join(`
+`);
+  const dateKey = hmac(`AWS4${credentials.secretAccessKey}`, shortDate);
+  const regionKey = hmac(dateKey, config.region);
+  const serviceKey = hmac(regionKey, "s3");
+  const signingKey = hmac(serviceKey, "aws4_request");
+  const signature = createHmac("sha256", signingKey).update(stringToSign).digest("hex");
+  headers.set("authorization", `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaderNames.join(";")}, Signature=${signature}`);
+  return { url: url.toString(), headers };
+}
+function buildObjectUrl(config, key) {
+  const encodedKey = key.split("/").map(awsEncode).join("/");
+  if (config.endpoint) {
+    const endpoint = new URL(config.endpoint);
+    if (config.forcePathStyle)
+      endpoint.pathname = `/${awsEncode(config.bucket)}/${encodedKey}`;
+    else {
+      endpoint.hostname = `${config.bucket}.${endpoint.hostname}`;
+      endpoint.pathname = `/${encodedKey}`;
+    }
+    return endpoint;
+  }
+  return config.forcePathStyle ? new URL(`https://s3.${config.region}.amazonaws.com/${awsEncode(config.bucket)}/${encodedKey}`) : new URL(`https://${config.bucket}.s3.${config.region}.amazonaws.com/${encodedKey}`);
+}
+function awsEncode(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function hmac(key, value) {
+  return createHmac("sha256", key).update(value).digest();
+}
+function cleanResponseVersionId(value) {
+  const versionId = value?.trim();
+  if (!versionId || versionId === "null")
+    return;
+  assertSafeInstructionsObjectVersionId(versionId);
+  return versionId;
+}
+function memoryInstructionsObjectStore() {
+  const objects = new Map;
+  let nextVersion = 1;
+  return {
+    async putIfAbsent(key, bytes, options) {
+      assertSafeInstructionsObjectKey(key);
+      const existing = objects.get(key);
+      if (existing)
+        return { status: "existing", versionId: existing.versionId };
+      const versionId = `memory-v${nextVersion++}`;
+      objects.set(key, {
+        bytes: Uint8Array.from(bytes),
+        contentType: options.contentType,
+        lastModified: new Date,
+        versionId
+      });
+      return { status: "created", versionId };
+    },
+    async get(key, options = {}) {
+      assertSafeInstructionsObjectKey(key);
+      if (options.versionId)
+        assertSafeInstructionsObjectVersionId(options.versionId);
+      const object = objects.get(key);
+      if (!object || options.versionId && options.versionId !== object.versionId)
+        return;
+      return Uint8Array.from(object.bytes);
+    },
+    async head(key, options = {}) {
+      assertSafeInstructionsObjectKey(key);
+      if (options.versionId)
+        assertSafeInstructionsObjectVersionId(options.versionId);
+      const object = objects.get(key);
+      return object && (!options.versionId || options.versionId === object.versionId) ? {
+        size: object.bytes.byteLength,
+        contentType: object.contentType,
+        lastModified: new Date(object.lastModified),
+        versionId: object.versionId
+      } : undefined;
+    },
+    keys() {
+      return [...objects.keys()].sort();
+    }
+  };
+}
+
+export { assertSafeInstructionsObjectKey, assertSafeInstructionsObjectVersionId, createInstructionsS3ObjectStore, memoryInstructionsObjectStore };

package/dist/chunks/{index-9p9gn7gh.js → index-bzyxvwcd.js}

@@ -1,10 +1,11 @@
 // @bun
 import {
   applyConfigsWithReport,
+  compactPathForConfigHome,
   expandPath,
   getConfigHome,
   normalizeTargetPath
-} from "./index-axhwg61p.js";
+} from "./index-fwbs6tma.js";
 import {
   applyTransform,
   detectMachineContext,
@@ -12,7 +13,7 @@ import {
   resolveConfigStore,
   retiredOrUnsupportedAgentReason,
   templateizeMachineContent
-} from "./index-v7dkb384.js";
+} from "./index-4pfq42t5.js";
 import {
   isSecretVarName,
   redactContent,
@@ -26,7 +27,6 @@ import { basename, extname, join as join2 } from "path";
 // src/lib/sync-dir.ts
 import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { join, relative } from "path";
-import { homedir } from "os";
 var SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
 function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
@@ -38,7 +38,6 @@ async function syncFromDir(dir, opts = {}) {
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
   const files = opts.recursive !== false ? walkDir(absDir) : readdirSync(absDir).map((f) => join(absDir, f)).filter((f) => statSync(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
-  const home = homedir();
   const allConfigs = await store.listConfigs();
   for (const file of files) {
     if (shouldSkip(file)) {
@@ -51,7 +50,7 @@ async function syncFromDir(dir, opts = {}) {
         result.skipped.push(file + " (too large)");
         continue;
       }
-      const targetPath = file.replace(home, "~");
+      const targetPath = compactPathForConfigHome(file);
       const redacted = redactContent(content, redactFormatForTarget(targetPath, detectFormat(file)));
       const existing = allConfigs.find((c) => c.target_path === targetPath);
       if (!existing) {
@@ -73,9 +72,8 @@ async function syncFromDir(dir, opts = {}) {
 }
 async function syncToDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
-  const home = homedir();
   const absDir = expandPath(dir);
-  const normalized = dir.startsWith("~/") ? dir : absDir.replace(home, "~");
+  const normalized = dir.startsWith("~/") ? dir : compactPathForConfigHome(absDir);
   const configs = (await store.listConfigs()).filter((c) => c.target_path && (c.target_path.startsWith(normalized) || c.target_path.startsWith(absDir)));
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   for (const config of configs) {