@mnemonik/shared 7.140.1 → 7.140.2

package/src/hookTrace.ts

@@ -0,0 +1,588 @@
+/**
+ * Hook flight recorder: a bounded, local, append-only record of every hook
+ * invocation on this machine, so an agent or support can see what a real
+ * editor sent to the hooks and what they answered.
+ *
+ * One JSON Lines file per host under the Mnemonik state folder
+ * (`<state>/hook-trace/<host>.jsonl`, directory 0700, file 0600), rotated to a
+ * single `.1` file past {@link HOOK_TRACE_MAX_BYTES}. Each invocation writes
+ * up to three lines sharing one run `id`: `start` as soon as the recorder
+ * starts (before stdin is read, so a run the editor kills while it is still
+ * sending the event leaves a trace), `input` once the event is known, and
+ * `end` when the process exits. A run with no `end` is one the editor killed
+ * (a signal ends the process without Node's `exit` event); one with only
+ * `start` was killed before its event arrived.
+ *
+ * The record holds identifiers, field names and sizes only. It never holds
+ * prompt text, tool input or output bodies, file contents, transcript
+ * contents, credentials or the environment: payload values are reduced to
+ * their byte size, and the one free-text field (an error message) passes
+ * through `scrubSecrets`.
+ *
+ * Every write is synchronous and short (one line), and every failure is
+ * swallowed: the recorder can never throw into a hook or change its output.
+ * Being synchronous, a write to a hung network home directory would block the
+ * hook. `MNEMONIK_HOOK_TRACE=off` disables it.
+ */
+import { randomBytes } from 'node:crypto';
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  statSync,
+  unlinkSync,
+  writeSync,
+} from 'node:fs';
+import { dirname, join } from 'node:path';
+import { mnemonikStateDirectory } from './protectedPaths.js';
+import { ensureWindowsPrivateDirectorySync } from './runtimeSigners.js';
+import { scrubSecrets } from './secretPatterns.js';
+
+export type HookTraceHost = 'cursor' | 'claude-code' | 'codex' | 'copilot';
+
+/** Past this size the file is renamed to `<host>.jsonl.1` (replacing any older one). */
+export const HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+export const HOOK_TRACE_ENV = 'MNEMONIK_HOOK_TRACE';
+
+const MAX_FIELDS = 64;
+const MAX_CALLS = 64;
+const MAX_ERROR_CHARS = 80;
+const SAFE_ID = /^[A-Za-z0-9@._+:-]{1,128}$/;
+const SAFE_NAME = /^[A-Za-z0-9@._+:/-]{1,120}$/;
+const SAFE_ENUM = /^[A-Za-z_]{1,24}$/;
+
+export interface HookTraceCall {
+  /** URL path only; id-like segments become `:id`, never a query string. */
+  path: string;
+  status?: number;
+  /** `timeout`, `aborted`, a system code such as `ECONNREFUSED`, or an error name. */
+  error?: string;
+  /** Still waiting for an answer when the process exited. */
+  pending?: true;
+  ms: number;
+}
+
+export interface HookTraceOutput {
+  bytes: number;
+  /** Byte size of each output field set; nested host fields as `hookSpecificOutput.<name>`. */
+  sizes: Record<string, number>;
+  permission?: string;
+  decision?: string;
+  continue?: boolean;
+}
+
+/** Written as the recorder starts, before stdin is read. */
+export interface HookTraceStart {
+  v: 1;
+  phase: 'start';
+  ts: string;
+  host: HookTraceHost;
+  hookVersion?: string;
+  pid: number;
+  id: string;
+  /** From process start, including Node start-up and module load. */
+  processMs: number;
+}
+
+/** Written once stdin is read and the event is known. */
+export interface HookTraceInput {
+  v: 1;
+  phase: 'input';
+  ts: string;
+  host: HookTraceHost;
+  pid: number;
+  id: string;
+  event: string | null;
+  hostVersion?: string;
+  sessionId?: string;
+  conversationId?: string;
+  generationId?: string;
+  agentId?: string;
+  turnId?: string;
+  tool?: string;
+  cwd?: string;
+  inputBytes: number;
+  /** Byte size of each top-level input field's JSON value. Values are never recorded. */
+  fields: Record<string, number>;
+  /** Time from the recorder starting to the event being known (mostly the stdin read). */
+  readMs: number;
+}
+
+export interface HookTraceEnd {
+  v: 1;
+  phase: 'end';
+  ts: string;
+  host: HookTraceHost;
+  pid: number;
+  id: string;
+  event: string | null;
+  projectId?: string;
+  output: HookTraceOutput | null;
+  calls: HookTraceCall[];
+  /** From the recorder starting (after module load) to exit. */
+  durationMs: number;
+  /** From process start, including Node start-up and module load. */
+  processMs: number;
+  exitCode: number;
+  /** Name or system code of the error the hook failed open on. */
+  errorKind?: string;
+  /** Its message, scrubbed and cut to 80 characters. */
+  error?: string;
+}
+
+export type HookTraceRecord = HookTraceStart | HookTraceInput | HookTraceEnd;
+
+export function hookTraceEnabled(env: NodeJS.ProcessEnv = process.env): boolean {
+  const value = env[HOOK_TRACE_ENV]?.trim().toLowerCase();
+  return !value || !['off', '0', 'false', 'no', 'disabled'].includes(value);
+}
+
+export function hookTraceDirectory(stateDir: string = mnemonikStateDirectory()): string {
+  return join(stateDir, 'hook-trace');
+}
+
+export function hookTraceFile(host: HookTraceHost, stateDir?: string): string {
+  return join(hookTraceDirectory(stateDir), `${host}.jsonl`);
+}
+
+const preparedDirectories = new Set<string>();
+
+function ensurePrivateDirectory(directory: string): void {
+  if (preparedDirectories.has(directory)) return;
+  if (process.platform === 'win32') ensureWindowsPrivateDirectorySync(directory);
+  else {
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const stat = lstatSync(directory);
+    if (
+      !stat.isDirectory() ||
+      stat.isSymbolicLink() ||
+      (process.getuid && stat.uid !== process.getuid()) ||
+      stat.mode & 0o077
+    )
+      throw new Error('hook trace directory is not private');
+  }
+  preparedDirectories.add(directory);
+}
+
+function openTrace(file: string): number {
+  return openSync(
+    file,
+    constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0),
+    0o600
+  );
+}
+
+/** Whether `file` still names the file `fd` has open: no other writer rotated it away. */
+function sameFile(file: string, fd: number): boolean {
+  try {
+    const opened = fstatSync(fd, { bigint: true });
+    const named = statSync(file, { bigint: true });
+    return opened.ino === named.ino && opened.dev === named.dev;
+  } catch {
+    return false;
+  }
+}
+
+/** A rotation lock older than this was left by a killed writer. */
+const STALE_LOCK_MS = 10_000;
+
+function takeLock(lock: string): boolean {
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      closeSync(openSync(lock, 'wx', 0o600));
+      return true;
+    } catch {
+      try {
+        if (attempt > 0 || Date.now() - lstatSync(lock).mtimeMs < STALE_LOCK_MS) return false;
+        unlinkSync(lock);
+      } catch {
+        /* Gone already: try once more. */
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Rotate the full file `fd` has open to `.1`. Hooks run concurrently, so
+ * rotation is serialised by an exclusive lock file and, while holding it,
+ * happens only when the path still names the file `fd` has open: a writer
+ * that finds another already rotated (or rotating) appends to the fresh file
+ * instead of rotating again and replacing the full file in `.1`.
+ */
+function rotate(file: string, fd: number): void {
+  const lock = `${file}.lock`;
+  if (!takeLock(lock)) return;
+  try {
+    if (sameFile(file, fd)) renameSync(file, `${file}.1`);
+  } finally {
+    try {
+      unlinkSync(lock);
+    } catch {
+      /* Already removed as stale: nothing to release. */
+    }
+  }
+}
+
+/** Append one line, rotating first when the file is full. Throws; callers swallow. */
+export function appendHookTraceLine(file: string, record: HookTraceRecord): void {
+  ensurePrivateDirectory(dirname(file));
+  const line = `${JSON.stringify(record)}\n`;
+  let fd = openTrace(file);
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || (process.getuid && stat.uid !== process.getuid()))
+      throw new Error('hook trace file is not ours');
+    if (stat.size > 0 && stat.size + Buffer.byteLength(line) > HOOK_TRACE_MAX_BYTES) {
+      try {
+        rotate(file, fd);
+      } finally {
+        closeSync(fd);
+        fd = -1;
+      }
+      fd = openTrace(file);
+    }
+    writeSync(fd, line);
+  } finally {
+    if (fd >= 0) closeSync(fd);
+  }
+}
+
+function byteSize(value: unknown): number {
+  if (typeof value === 'string') return Buffer.byteLength(value);
+  try {
+    return Buffer.byteLength(JSON.stringify(value) ?? '');
+  } catch {
+    return 0;
+  }
+}
+
+function safe(value: unknown, pattern: RegExp): string | undefined {
+  return typeof value === 'string' && pattern.test(value) ? value : undefined;
+}
+
+function sizesOf(object: Record<string, unknown>, prefix = ''): Record<string, number> {
+  const sizes: Record<string, number> = {};
+  for (const key of Object.keys(object).slice(0, MAX_FIELDS))
+    if (SAFE_NAME.test(key)) sizes[prefix + key] = byteSize(object[key]);
+  return sizes;
+}
+
+const isObject = (value: unknown): value is Record<string, unknown> =>
+  !!value && typeof value === 'object' && !Array.isArray(value);
+
+/** Field names and sizes, the decision fields' short enum values, never text. */
+export function summarizeHookOutput(text: string): HookTraceOutput {
+  const output: HookTraceOutput = { bytes: Buffer.byteLength(text), sizes: {} };
+  let value: unknown;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return output;
+  }
+  if (!isObject(value)) return output;
+  const nested = isObject(value.hookSpecificOutput) ? value.hookSpecificOutput : undefined;
+  const { hookSpecificOutput: _nested, ...top } = value;
+  output.sizes = { ...sizesOf(top), ...(nested ? sizesOf(nested, 'hookSpecificOutput.') : {}) };
+  const permission = safe(value.permission ?? nested?.permissionDecision, SAFE_ENUM);
+  const decision = safe(value.decision, SAFE_ENUM);
+  if (permission) output.permission = permission;
+  if (decision) output.decision = decision;
+  if (typeof value.continue === 'boolean') output.continue = value.continue;
+  return output;
+}
+
+function routeOf(input: unknown): string {
+  try {
+    const href =
+      typeof input === 'string'
+        ? input
+        : input instanceof URL
+          ? input.href
+          : (input as { url?: string }).url;
+    return new URL(String(href)).pathname
+      .split('/')
+      .map((segment) =>
+        (segment.length >= 16 && /\d/.test(segment)) || /[%@]/.test(segment) ? ':id' : segment
+      )
+      .join('/')
+      .slice(0, 200);
+  } catch {
+    return 'unknown';
+  }
+}
+
+export function errorKind(error: unknown): string {
+  const failure = error as { name?: unknown; code?: unknown; cause?: { code?: unknown } } | null;
+  if (failure?.name === 'TimeoutError') return 'timeout';
+  if (failure?.name === 'AbortError') return 'aborted';
+  const code = failure?.cause?.code ?? failure?.code;
+  if (typeof code === 'string' && /^[A-Z0-9_]{2,40}$/.test(code)) return code;
+  return safe(failure?.name, /^\w{1,40}$/) ?? 'error';
+}
+
+/** The message, whitespace folded, secrets scrubbed, cut to 80 characters. */
+export function scrubHookTraceMessage(error: unknown): string {
+  const text = error instanceof Error ? error.message : String(error);
+  return scrubSecrets(text.replace(/\s+/g, ' ').trim()).slice(0, MAX_ERROR_CHARS);
+}
+
+export interface HookTraceCallToken {
+  input: unknown;
+  startedAt: number;
+}
+
+export interface HookTraceOptions {
+  host: HookTraceHost;
+  hookVersion?: string;
+  env?: NodeJS.ProcessEnv;
+  stateDir?: string;
+}
+
+export class HookTrace {
+  private readonly id = randomBytes(8).toString('hex');
+  private readonly startedAt = performance.now();
+  private opened = false;
+  private started = false;
+  private ended = false;
+  private event: string | null = null;
+  private outputSummary: HookTraceOutput | null = null;
+  private error?: string;
+  private errorKind?: string;
+  private projectId?: string;
+  private readonly calls: HookTraceCall[] = [];
+  private readonly inFlight = new Set<HookTraceCallToken>();
+
+  constructor(
+    private readonly host: HookTraceHost,
+    private readonly file: string | undefined,
+    private readonly hookVersion?: string
+  ) {}
+
+  get enabled(): boolean {
+    return this.file !== undefined;
+  }
+
+  private write(record: HookTraceRecord): void {
+    if (!this.file) return;
+    try {
+      appendHookTraceLine(this.file, record);
+    } catch {
+      /* A diagnostic record never costs the hook anything. */
+    }
+  }
+
+  /**
+   * Write the `start` line: pid, run id and time since process start, nothing
+   * from the editor. Runs before stdin is read, so a run killed while the
+   * editor is still sending its event leaves this line.
+   */
+  open(): void {
+    if (!this.file || this.opened) return;
+    this.opened = true;
+    this.write({
+      v: 1,
+      phase: 'start',
+      ts: new Date().toISOString(),
+      host: this.host,
+      ...(this.hookVersion ? { hookVersion: this.hookVersion } : {}),
+      pid: process.pid,
+      id: this.id,
+      processMs: Math.round(process.uptime() * 1000),
+    });
+  }
+
+  /** Write the `input` line. `input` is the parsed payload, or null when none parsed. */
+  begin(input: unknown, event?: string | null): void {
+    if (!this.file || this.started) return;
+    this.open();
+    this.started = true;
+    try {
+      const payload = isObject(input) ? input : {};
+      this.event =
+        safe(event, SAFE_NAME) ??
+        safe(payload.hook_event_name, SAFE_NAME) ??
+        safe(payload.hookEventName, SAFE_NAME) ??
+        null;
+      const roots = Array.isArray(payload.workspace_roots) ? payload.workspace_roots : [];
+      const cwd =
+        typeof payload.cwd === 'string' && payload.cwd
+          ? payload.cwd
+          : typeof roots[0] === 'string'
+            ? roots[0]
+            : process.cwd();
+      const record: HookTraceInput = {
+        v: 1,
+        phase: 'input',
+        ts: new Date().toISOString(),
+        host: this.host,
+        pid: process.pid,
+        id: this.id,
+        event: this.event,
+        inputBytes: isObject(input) ? byteSize(input) : 0,
+        fields: sizesOf(payload),
+        readMs: Math.round(performance.now() - this.startedAt),
+      };
+      const hostVersion = safe(payload.cursor_version ?? payload.version, /^[\w.+-]{1,40}$/);
+      if (hostVersion) record.hostVersion = hostVersion;
+      const ids: Array<[keyof HookTraceInput, string]> = [
+        ['sessionId', 'session_id'],
+        ['conversationId', 'conversation_id'],
+        ['generationId', 'generation_id'],
+        ['agentId', 'agent_id'],
+        ['agentId', 'subagent_id'],
+        ['turnId', 'turn_id'],
+      ];
+      for (const [name, key] of ids) {
+        const id = safe(payload[key], SAFE_ID);
+        if (id && record[name] === undefined)
+          (record as unknown as Record<string, string>)[name] = id;
+      }
+      const tool = safe(payload.tool_name, SAFE_NAME);
+      if (tool) record.tool = tool;
+      if (cwd.length <= 1024) record.cwd = cwd;
+      this.write(record);
+    } catch {
+      /* Never into the hook. */
+    }
+  }
+
+  /** The exact text the hook wrote to stdout (or nothing). */
+  output(text: string | null | undefined): void {
+    if (!this.file || text === null || text === undefined) return;
+    try {
+      this.outputSummary = summarizeHookOutput(text);
+    } catch {
+      /* Never into the hook. */
+    }
+  }
+
+  /** The error the hook failed open on. */
+  fail(error: unknown): void {
+    if (!this.file) return;
+    try {
+      this.errorKind = errorKind(error);
+      this.error = scrubHookTraceMessage(error);
+    } catch {
+      this.errorKind = 'error';
+    }
+  }
+
+  project(projectId: string | undefined): void {
+    if (projectId && !this.projectId && SAFE_ID.test(projectId)) this.projectId = projectId;
+  }
+
+  /** A call has gone out; {@link settle} records it, {@link finish} records it as pending. */
+  callStarted(input: unknown): HookTraceCallToken {
+    const token = { input, startedAt: performance.now() };
+    if (this.file) this.inFlight.add(token);
+    return token;
+  }
+
+  settle(token: HookTraceCallToken, status?: number, error?: unknown): void {
+    this.inFlight.delete(token);
+    this.call(token.input, token.startedAt, status, error);
+  }
+
+  call(input: unknown, startedAt: number, status?: number, error?: unknown): void {
+    if (!this.file || this.calls.length >= MAX_CALLS) return;
+    try {
+      this.calls.push({
+        path: routeOf(input),
+        ...(status !== undefined ? { status } : { error: errorKind(error) }),
+        ms: Math.round(performance.now() - startedAt),
+      });
+    } catch {
+      /* Never into the hook. */
+    }
+  }
+
+  /** Write the `end` line once. Runs from the process `exit` event. */
+  finish(exitCode = 0): void {
+    if (!this.file || this.ended) return;
+    this.open();
+    this.ended = true;
+    for (const { input, startedAt } of this.inFlight) {
+      if (this.calls.length >= MAX_CALLS) break;
+      try {
+        this.calls.push({
+          path: routeOf(input),
+          pending: true,
+          ms: Math.round(performance.now() - startedAt),
+        });
+      } catch {
+        /* Never into the hook. */
+      }
+    }
+    this.inFlight.clear();
+    this.write({
+      v: 1,
+      phase: 'end',
+      ts: new Date().toISOString(),
+      host: this.host,
+      pid: process.pid,
+      id: this.id,
+      event: this.event,
+      ...(this.projectId ? { projectId: this.projectId } : {}),
+      output: this.outputSummary,
+      calls: this.calls,
+      durationMs: Math.round(performance.now() - this.startedAt),
+      processMs: Math.round(process.uptime() * 1000),
+      exitCode,
+      ...(this.errorKind ? { errorKind: this.errorKind } : {}),
+      ...(this.error ? { error: this.error } : {}),
+    });
+  }
+}
+
+let active: HookTrace | undefined;
+
+/** Resolved project ids reach the trace from the shared identity cache. */
+export function noteHookTraceProject(projectId: string | undefined): void {
+  active?.project(projectId);
+}
+
+/**
+ * Start this process's recorder: one per hook process. Writes the `start`
+ * line at once (so call it before reading stdin), times every `fetch` the
+ * process makes (path, status or error kind, duration; `pending` when still
+ * waiting at exit) and writes the `end` line from the process `exit` event,
+ * so every exit path is covered.
+ */
+export function startHookTrace(options: HookTraceOptions): HookTrace {
+  if (active) return active;
+  let file: string | undefined;
+  try {
+    if (hookTraceEnabled(options.env))
+      file = hookTraceFile(
+        options.host,
+        options.stateDir ?? mnemonikStateDirectory(process.platform, options.env ?? process.env)
+      );
+  } catch {
+    file = undefined;
+  }
+  const trace = new HookTrace(options.host, file, options.hookVersion);
+  active = trace;
+  if (!file) return trace;
+  const original = globalThis.fetch;
+  if (typeof original === 'function') {
+    globalThis.fetch = async (input, init) => {
+      const token = trace.callStarted(input);
+      try {
+        const response = await original.call(globalThis, input, init);
+        trace.settle(token, response.status);
+        return response;
+      } catch (error) {
+        trace.settle(token, undefined, error);
+        throw error;
+      }
+    };
+  }
+  process.once('exit', (code) => trace.finish(typeof code === 'number' ? code : 0));
+  trace.open();
+  return trace;
+}

package/src/index.ts

@@ -18,6 +18,10 @@ export {
   languageForExtension,
   makeIgnoreMatcher,
   isGitBoundary,
+  isProjectBoundary,
+  rootProjectId,
+  SCANNER_MAX_DEPTH,
+  isLinkedWorktreeCheckout,
   FIXTURE_PATH_RE,
   isFixturePath,
   isSecretFile,

package/src/projectIdentityFile.ts

@@ -86,9 +86,35 @@ export function parseIdentityFile(text: string): Exclude<IdentityFileResult, { k
   };
 }
 
+/**
+ * A `.mnemonik.json` that holds configuration but no identity: a JSON object
+ * with no `projectId` that names schema 1 or no schema. Invalid identities,
+ * and any file naming another schema (which may carry its identity under other
+ * keys), are not.
+ */
+export function isConfigurationOnly(text: string): boolean {
+  try {
+    const value: unknown = JSON.parse(text);
+    return (
+      !!value &&
+      typeof value === 'object' &&
+      !Array.isArray(value) &&
+      !('projectId' in value) &&
+      (!('schemaVersion' in value) || value.schemaVersion === 1)
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Read a folder's identity file. With `configurationOnlyAbsent` (and with
+ * `selectedRoot`, folders ticked during install), a configuration-only file is
+ * no identity: the folder is not a project of its own.
+ */
 export async function readIdentityFile(
   dir: string,
-  options: { selectedRoot?: boolean } = {}
+  options: { selectedRoot?: boolean; configurationOnlyAbsent?: boolean } = {}
 ): Promise<IdentityFileResult> {
   const path = join(dir, '.mnemonik.json');
   try {
@@ -96,25 +122,13 @@ export async function readIdentityFile(
     if (stat.isSymbolicLink()) return { kind: 'malformed', detail: 'symlink' };
     if (!stat.isFile()) return { kind: 'malformed', detail: 'identity path is not a regular file' };
     const text = await readFile(path, 'utf8');
-    if (options.selectedRoot) {
-      // A ticked folder with configuration but no identity is a new project.
-      // Keep invalid identities, non-regular files and any file that names a
-      // schema other than 1 on the strict refusal path: a later schema may carry
-      // its identity under other keys, and setup must not replace it.
-      try {
-        const value: unknown = JSON.parse(text);
-        if (
-          value &&
-          typeof value === 'object' &&
-          !Array.isArray(value) &&
-          !('projectId' in value) &&
-          (!('schemaVersion' in value) || value.schemaVersion === 1)
-        )
-          return { kind: 'absent' };
-      } catch {
-        /* The strict parser supplies the diagnostic. */
-      }
-    }
+    // A ticked folder with configuration but no identity is a new project, and
+    // a configuration-only file met walking up is not a project boundary. Keep
+    // invalid identities, non-regular files and any file that names a schema
+    // other than 1 on the strict refusal path: a later schema may carry its
+    // identity under other keys, and setup must not replace it.
+    if ((options.selectedRoot || options.configurationOnlyAbsent) && isConfigurationOnly(text))
+      return { kind: 'absent' };
     return parseIdentityFile(text);
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { kind: 'absent' };

package/src/protectedPaths.ts

@@ -7,6 +7,23 @@ function pathsFor(platform: Platform): PlatformPath {
   return platform === 'win32' ? win32 : posix;
 }
 
+/**
+ * Mnemonik's local state folder: the same answer as `stateDirectory` in
+ * @mnemonik/local-setup, which depends on this package and so cannot be
+ * imported here.
+ */
+export function mnemonikStateDirectory(
+  platform: Platform = process.platform,
+  env: NodeJS.ProcessEnv = process.env,
+  home: string = homedir()
+): string {
+  if (env.MNEMONIK_STATE_DIR) return env.MNEMONIK_STATE_DIR;
+  if (platform === 'win32')
+    return win32.join(env.LOCALAPPDATA || win32.join(home, 'AppData', 'Local'), 'Mnemonik');
+  if (platform === 'darwin') return posix.join(home, 'Library', 'Application Support', 'Mnemonik');
+  return posix.join(env.XDG_STATE_HOME || posix.join(home, '.local', 'state'), 'mnemonik');
+}
+
 /** Local state and credential locations that Mnemonik must never scan. */
 export function protectedLocalPaths(
   platform: Platform = process.platform,
@@ -16,13 +33,7 @@ export function protectedLocalPaths(
   const path = pathsFor(platform);
   const localAppData = env.LOCALAPPDATA || win32.join(home, 'AppData', 'Local');
   const appData = env.APPDATA || win32.join(home, 'AppData', 'Roaming');
-  const state =
-    env.MNEMONIK_STATE_DIR ||
-    (platform === 'win32'
-      ? win32.join(localAppData, 'Mnemonik')
-      : platform === 'darwin'
-        ? posix.join(home, 'Library', 'Application Support', 'Mnemonik')
-        : posix.join(env.XDG_STATE_HOME || posix.join(home, '.local', 'state'), 'mnemonik'));
+  const state = mnemonikStateDirectory(platform, env, home);
   const common = [
     state,
     path.join(home, '.mnemonik'),