@holdyourvoice/hyv 2.8.9 → 2.8.10

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable CLI changes. Also mirrored to [holdyourvoice.com/changelog](https://holdyourvoice.com/changelog) for user-facing releases.
 
+## [2.8.10] — 2026-06-12
+
+### Fixed
+- `hyv init` browser login opens Google OAuth again (`assertSafeOAuthUrl` allows `accounts.google.com`)
+
 ## [2.8.9] — 2026-06-12
 
 ### Improved

package/dist/index.js

@@ -4647,6 +4647,27 @@ function assertSafeOpenUrl(url) {
   }
   return url;
 }
+function assertSafeOAuthUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error("Invalid URL");
+  }
+  if (parsed.protocol !== "https:") {
+    throw new Error("Only https:// URLs can be opened");
+  }
+  if (ALLOWED_API_HOSTS.has(parsed.hostname)) {
+    return url;
+  }
+  if (ALLOWED_OAUTH_HOSTS.has(parsed.hostname)) {
+    if (parsed.hostname === "accounts.google.com" && !parsed.pathname.startsWith("/o/oauth2/")) {
+      throw new Error(`Unexpected OAuth path: ${parsed.pathname}`);
+    }
+    return url;
+  }
+  throw new Error(`URL host not allowed: ${parsed.hostname}`);
+}
 function assertSafeProfileName(name) {
   const normalized = String(name || "").trim();
   if (!normalized)
@@ -4804,7 +4825,7 @@ function readLastEditSession() {
     return null;
   }
 }
-var fs, path, os, HYV_DIR, AUTH_FILE, CONFIG_FILE, PROFILES_DIR, CACHE_DIR, QUEUE_DIR, LAST_SESSION_FILE, ALLOWED_API_HOSTS, API_BASE, PROFILE_NAME_RE;
+var fs, path, os, HYV_DIR, AUTH_FILE, CONFIG_FILE, PROFILES_DIR, CACHE_DIR, QUEUE_DIR, LAST_SESSION_FILE, ALLOWED_API_HOSTS, ALLOWED_OAUTH_HOSTS, API_BASE, PROFILE_NAME_RE;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
@@ -4825,6 +4846,7 @@ var init_config = __esm({
       "localhost",
       "127.0.0.1"
     ]);
+    ALLOWED_OAUTH_HOSTS = /* @__PURE__ */ new Set(["accounts.google.com"]);
     API_BASE = validateApiBase(process.env.HYV_API_URL || "https://holdyourvoice.com");
     PROFILE_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,62}$/i;
   }
@@ -5392,7 +5414,7 @@ async function authenticateWithBrowser() {
     throw new Error("Authentication server did not return OAuth state");
   }
   console.log(import_chalk.default.cyan("\nOpening browser for authentication..."));
-  await (0, import_open.default)(assertSafeOpenUrl(auth_url));
+  await (0, import_open.default)(assertSafeOAuthUrl(auth_url));
   const authData = await new Promise((resolve14, reject) => {
     const timeout = setTimeout(() => {
       server.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holdyourvoice/hyv",
-  "version": "2.8.9",
+  "version": "2.8.10",
   "description": "Free local AI writing scan for cursor & claude. MCP server, 220+ pattern detection, voice profiles. npx @holdyourvoice/hyv welcome",
   "main": "dist/index.js",
   "bin": {