terminalhire 0.42.2 → 0.42.3

package/dist/bin/jpi-dispatch.js

@@ -294,10 +294,12 @@ __export(protocol_exports, {
   handleUrl: () => handleUrl,
   healStaleHandler: () => healStaleHandler,
   parseClaimUrl: () => parseClaimUrl,
+  preferredTerminalApp: () => preferredTerminalApp,
   printClaimCommand: () => printClaimCommand,
   registerScheme: () => registerScheme,
   schemeStatus: () => schemeStatus,
-  unregisterScheme: () => unregisterScheme
+  unregisterScheme: () => unregisterScheme,
+  writeClaimLauncher: () => writeClaimLauncher
 });
 import { spawn, spawnSync } from "child_process";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3, renameSync } from "fs";
@@ -329,8 +331,11 @@ function defaultProtocolDeps() {
     ensureStateDir: (path6) => {
       ensureStateDir(path6);
     },
-    writeFileSync: (path6, contents) => {
-      writeFileSync3(path6, contents, "utf8");
+    ensureStateDirForSecret: (path6) => {
+      ensureStateDirForSecret(path6);
+    },
+    writeFileSync: (path6, contents, mode) => {
+      writeFileSync3(path6, contents, mode === void 0 ? "utf8" : { encoding: "utf8", mode });
     },
     readFileSync: (path6) => readFileSync3(path6, "utf8"),
     rmSync: (path6) => {
@@ -370,30 +375,52 @@ function appleScriptStringLiteral(s) {
 function shellQuoteSingle(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-function buildAppleScriptHandler(execPath, dispatchPath) {
+function preferredTerminalApp(env) {
+  const raw = typeof env.TERM_PROGRAM === "string" ? env.TERM_PROGRAM.trim() : "";
+  if (!raw) return null;
+  const known = {
+    apple_terminal: "Terminal",
+    "iterm.app": "iTerm"
+  };
+  return known[raw.toLowerCase()] ?? null;
+}
+function buildAppleScriptHandler(execPath, dispatchPath, terminalApp) {
   const execLit = appleScriptStringLiteral(execPath);
   const dispatchLit = appleScriptStringLiteral(dispatchPath);
+  const fallback = (indent) => [
+    `${indent}display notification "Couldn't open your terminal. Run: " & launcher with title "Terminalhire"`,
+    `${indent}try`,
+    `${indent}	do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " handle-url " & quoted form of theURL & " > /dev/null 2>&1 &"`,
+    `${indent}end try`
+  ];
+  const launch = terminalApp ? [
+    "	try",
+    `		do shell script "open -a " & quoted form of ${appleScriptStringLiteral(terminalApp)} & " " & quoted form of launcher`,
+    "	on error",
+    "		try",
+    '			do shell script "open " & quoted form of launcher',
+    "		on error",
+    ...fallback("			"),
+    "		end try",
+    "	end try"
+  ] : [
+    "	try",
+    '		do shell script "open " & quoted form of launcher',
+    "	on error",
+    ...fallback("		"),
+    "	end try"
+  ];
   return [
     "on open location theURL",
-    '	set claimCmd to ""',
+    '	set launcher to ""',
     "	try",
-    `		set claimCmd to do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " print-claim-command " & quoted form of theURL`,
+    `		set launcher to do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " write-claim-launcher " & quoted form of theURL`,
     "	end try",
-    '	if claimCmd is "" then',
+    '	if launcher is "" then',
     `		display notification "That isn't a valid Terminalhire claim link." with title "Terminalhire"`,
     "		return",
     "	end if",
-    "	try",
-    '		tell application "Terminal"',
-    "			activate",
-    "			do script claimCmd",
-    "		end tell",
-    "	on error",
-    `		display notification "Couldn't open Terminal automatically. Run: " & claimCmd with title "Terminalhire"`,
-    "		try",
-    `			do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " handle-url " & quoted form of theURL & " > /dev/null 2>&1 &"`,
-    "		end try",
-    "	end try",
+    ...launch,
     "end open location",
     ""
   ].join("\n");
@@ -404,7 +431,12 @@ function buildPreviewShellCommand(token, deps) {
     shellQuoteSingle(deps.dispatchPath),
     "claim",
     "preview",
-    token
+    // Quoted like the paths beside it, though parseClaimUrl's `[A-Za-z0-9_-]{8}` already
+    // forbids every shell metacharacter. Leaving the ONE value that came from a URL bare
+    // while quoting the two that never did is backwards: it makes the safety depend on a
+    // regex two files away rather than on this line, and a future loosening of that regex
+    // would open an injection here silently.
+    shellQuoteSingle(token)
   ].join(" ");
 }
 function printClaimCommand(raw, deps = defaultProtocolDeps()) {
@@ -416,6 +448,28 @@ function printClaimCommand(raw, deps = defaultProtocolDeps()) {
   deps.log(buildPreviewShellCommand(parsed.token, deps));
   deps.exit(0);
 }
+function launcherPath(token, deps) {
+  return join3(stateDir(deps), `claim-${token}.command`);
+}
+function buildLauncherScript(token, deps) {
+  return ["#!/bin/sh", `exec ${buildPreviewShellCommand(token, deps)}`, ""].join("\n");
+}
+function writeLauncherFile(token, deps) {
+  deps.ensureStateDirForSecret(stateDir(deps));
+  const path6 = launcherPath(token, deps);
+  deps.rmSync(path6);
+  deps.writeFileSync(path6, buildLauncherScript(token, deps), 448);
+  return path6;
+}
+function writeClaimLauncher(raw, deps = defaultProtocolDeps()) {
+  const parsed = parseClaimUrl(raw);
+  if (!parsed) {
+    deps.exit(1);
+    return;
+  }
+  deps.log(writeLauncherFile(parsed.token, deps));
+  deps.exit(0);
+}
 function darwinAppPaths(deps) {
   const appDir = join3(deps.homedir(), "Applications");
   const appPath = join3(appDir, "Terminalhire Handler.app");
@@ -428,7 +482,16 @@ function darwinRegister(deps) {
   const { appDir, appPath, plistPath } = darwinAppPaths(deps);
   deps.mkdirSync(appDir);
   const scriptPath = join3(dir, "handler.applescript");
-  deps.writeFileSync(scriptPath, buildAppleScriptHandler(deps.execPath, deps.dispatchPath));
+  deps.writeFileSync(
+    scriptPath,
+    buildAppleScriptHandler(
+      deps.execPath,
+      deps.dispatchPath,
+      // Resolved at REGISTER time, from the shell the user ran `protocol register` in.
+      // `open location` runs with no TERM_PROGRAM at all, so this cannot be deferred.
+      preferredTerminalApp(deps.env)
+    )
+  );
   deps.rmSync(appPath);
   const compile = deps.spawnSync("osacompile", ["-o", appPath, scriptPath]);
   if (compile.status !== 0) {
@@ -496,14 +559,10 @@ function darwinStatus(deps) {
   return { registered: exists && registered, appExists: exists };
 }
 function darwinOpenPreviewTerminal(token, deps) {
-  const doScript = `do script ${appleScriptStringLiteral(buildPreviewShellCommand(token, deps))}`;
-  const res = deps.spawnSync("osascript", [
-    "-e",
-    'tell application "Terminal" to activate',
-    "-e",
-    doScript
-  ]);
-  return res.status === 0;
+  const path6 = writeLauncherFile(token, deps);
+  const app = preferredTerminalApp(deps.env);
+  if (app && deps.spawnSync("open", ["-a", app, path6]).status === 0) return true;
+  return deps.spawnSync("open", [path6]).status === 0;
 }
 function win32Register(deps) {
   for (const scheme of WIN32_SCHEMES) {
@@ -792,7 +851,7 @@ var init_protocol = __esm({
       ["konsole", ["-e"]],
       ["xterm", ["-e"]]
     ];
-    HANDLER_TEMPLATE_VERSION = 2;
+    HANDLER_TEMPLATE_VERSION = 3;
     PENDING_CLAIMS_CAP = 20;
     PENDING_TOKEN_RE = /^[A-Za-z0-9_-]{8}$/;
   }
@@ -67272,6 +67331,10 @@ if (firstArg === "print-claim-command") {
   const { printClaimCommand: printClaimCommand2 } = await Promise.resolve().then(() => (init_protocol(), protocol_exports));
   printClaimCommand2(process.argv[3]);
 }
+if (firstArg === "write-claim-launcher") {
+  const { writeClaimLauncher: writeClaimLauncher2 } = await Promise.resolve().then(() => (init_protocol(), protocol_exports));
+  writeClaimLauncher2(process.argv[3]);
+}
 if (firstArg === "profile") {
   const mod2 = await Promise.resolve().then(() => (init_jpi_profile(), jpi_profile_exports));
   await mod2.run();

package/dist/bin/jpi-protocol.js

@@ -51,7 +51,31 @@ function ensureStateDir(dir) {
     }
   }
 }
-var STATE_DIR_MODE, STATE_DIR_OK, STATE_DIR_SYMLINK, STATE_DIR_UNVERIFIED, warnedDirs;
+function applyStateDirSecretPolicy(dir, status) {
+  if (status === STATE_DIR_SYMLINK) {
+    throw new Error(
+      `terminalhire: refusing to write key material into ${dir} \u2014 it is a symlink, not a directory.
+A write through it would FOLLOW THE LINK and place key/token material wherever the symlink points, outside our control and outside the "owner-only" (0700) guarantee this directory is supposed to carry.
+Fix: remove the symlink so terminalhire can recreate it as a real directory \u2014
+  rm ${dir}
+then re-run the command. If the symlink is intentional, point TERMINALHIRE_DIR at a real directory instead of routing it through this one.`
+    );
+  }
+  if (status === STATE_DIR_UNVERIFIED && !warnedUnverifiedSecretWriteThisProcess) {
+    warnedUnverifiedSecretWriteThisProcess = true;
+    try {
+      process.stderr.write(
+        `terminalhire: could not verify ${dir}'s permissions (expected on Windows \u2014 POSIX mode bits do not apply there) \u2014 proceeding, but the "owner-only" guarantee on key/token storage is NOT enforced on this platform.
+`
+      );
+    } catch {
+    }
+  }
+}
+function ensureStateDirForSecret(dir) {
+  applyStateDirSecretPolicy(dir, ensureStateDir(dir));
+}
+var STATE_DIR_MODE, STATE_DIR_OK, STATE_DIR_SYMLINK, STATE_DIR_UNVERIFIED, warnedDirs, warnedUnverifiedSecretWriteThisProcess;
 var init_state_dir = __esm({
   "src/state-dir.ts"() {
     "use strict";
@@ -60,6 +84,7 @@ var init_state_dir = __esm({
     STATE_DIR_SYMLINK = "symlink";
     STATE_DIR_UNVERIFIED = "unverified";
     warnedDirs = /* @__PURE__ */ new Set();
+    warnedUnverifiedSecretWriteThisProcess = false;
   }
 });
 
@@ -72,10 +97,12 @@ __export(protocol_exports, {
   handleUrl: () => handleUrl,
   healStaleHandler: () => healStaleHandler,
   parseClaimUrl: () => parseClaimUrl,
+  preferredTerminalApp: () => preferredTerminalApp,
   printClaimCommand: () => printClaimCommand,
   registerScheme: () => registerScheme,
   schemeStatus: () => schemeStatus,
-  unregisterScheme: () => unregisterScheme
+  unregisterScheme: () => unregisterScheme,
+  writeClaimLauncher: () => writeClaimLauncher
 });
 import { spawn, spawnSync } from "child_process";
 import { existsSync, mkdirSync as mkdirSync2, readFileSync, rmSync, writeFileSync, renameSync } from "fs";
@@ -107,8 +134,11 @@ function defaultProtocolDeps() {
     ensureStateDir: (path) => {
       ensureStateDir(path);
     },
-    writeFileSync: (path, contents) => {
-      writeFileSync(path, contents, "utf8");
+    ensureStateDirForSecret: (path) => {
+      ensureStateDirForSecret(path);
+    },
+    writeFileSync: (path, contents, mode) => {
+      writeFileSync(path, contents, mode === void 0 ? "utf8" : { encoding: "utf8", mode });
     },
     readFileSync: (path) => readFileSync(path, "utf8"),
     rmSync: (path) => {
@@ -148,30 +178,52 @@ function appleScriptStringLiteral(s) {
 function shellQuoteSingle(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-function buildAppleScriptHandler(execPath, dispatchPath) {
+function preferredTerminalApp(env) {
+  const raw = typeof env.TERM_PROGRAM === "string" ? env.TERM_PROGRAM.trim() : "";
+  if (!raw) return null;
+  const known = {
+    apple_terminal: "Terminal",
+    "iterm.app": "iTerm"
+  };
+  return known[raw.toLowerCase()] ?? null;
+}
+function buildAppleScriptHandler(execPath, dispatchPath, terminalApp) {
   const execLit = appleScriptStringLiteral(execPath);
   const dispatchLit = appleScriptStringLiteral(dispatchPath);
+  const fallback = (indent) => [
+    `${indent}display notification "Couldn't open your terminal. Run: " & launcher with title "Terminalhire"`,
+    `${indent}try`,
+    `${indent}	do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " handle-url " & quoted form of theURL & " > /dev/null 2>&1 &"`,
+    `${indent}end try`
+  ];
+  const launch = terminalApp ? [
+    "	try",
+    `		do shell script "open -a " & quoted form of ${appleScriptStringLiteral(terminalApp)} & " " & quoted form of launcher`,
+    "	on error",
+    "		try",
+    '			do shell script "open " & quoted form of launcher',
+    "		on error",
+    ...fallback("			"),
+    "		end try",
+    "	end try"
+  ] : [
+    "	try",
+    '		do shell script "open " & quoted form of launcher',
+    "	on error",
+    ...fallback("		"),
+    "	end try"
+  ];
   return [
     "on open location theURL",
-    '	set claimCmd to ""',
+    '	set launcher to ""',
     "	try",
-    `		set claimCmd to do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " print-claim-command " & quoted form of theURL`,
+    `		set launcher to do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " write-claim-launcher " & quoted form of theURL`,
     "	end try",
-    '	if claimCmd is "" then',
+    '	if launcher is "" then',
     `		display notification "That isn't a valid Terminalhire claim link." with title "Terminalhire"`,
     "		return",
     "	end if",
-    "	try",
-    '		tell application "Terminal"',
-    "			activate",
-    "			do script claimCmd",
-    "		end tell",
-    "	on error",
-    `		display notification "Couldn't open Terminal automatically. Run: " & claimCmd with title "Terminalhire"`,
-    "		try",
-    `			do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " handle-url " & quoted form of theURL & " > /dev/null 2>&1 &"`,
-    "		end try",
-    "	end try",
+    ...launch,
     "end open location",
     ""
   ].join("\n");
@@ -182,7 +234,12 @@ function buildPreviewShellCommand(token, deps) {
     shellQuoteSingle(deps.dispatchPath),
     "claim",
     "preview",
-    token
+    // Quoted like the paths beside it, though parseClaimUrl's `[A-Za-z0-9_-]{8}` already
+    // forbids every shell metacharacter. Leaving the ONE value that came from a URL bare
+    // while quoting the two that never did is backwards: it makes the safety depend on a
+    // regex two files away rather than on this line, and a future loosening of that regex
+    // would open an injection here silently.
+    shellQuoteSingle(token)
   ].join(" ");
 }
 function printClaimCommand(raw, deps = defaultProtocolDeps()) {
@@ -194,6 +251,28 @@ function printClaimCommand(raw, deps = defaultProtocolDeps()) {
   deps.log(buildPreviewShellCommand(parsed.token, deps));
   deps.exit(0);
 }
+function launcherPath(token, deps) {
+  return join(stateDir(deps), `claim-${token}.command`);
+}
+function buildLauncherScript(token, deps) {
+  return ["#!/bin/sh", `exec ${buildPreviewShellCommand(token, deps)}`, ""].join("\n");
+}
+function writeLauncherFile(token, deps) {
+  deps.ensureStateDirForSecret(stateDir(deps));
+  const path = launcherPath(token, deps);
+  deps.rmSync(path);
+  deps.writeFileSync(path, buildLauncherScript(token, deps), 448);
+  return path;
+}
+function writeClaimLauncher(raw, deps = defaultProtocolDeps()) {
+  const parsed = parseClaimUrl(raw);
+  if (!parsed) {
+    deps.exit(1);
+    return;
+  }
+  deps.log(writeLauncherFile(parsed.token, deps));
+  deps.exit(0);
+}
 function darwinAppPaths(deps) {
   const appDir = join(deps.homedir(), "Applications");
   const appPath = join(appDir, "Terminalhire Handler.app");
@@ -206,7 +285,16 @@ function darwinRegister(deps) {
   const { appDir, appPath, plistPath } = darwinAppPaths(deps);
   deps.mkdirSync(appDir);
   const scriptPath = join(dir, "handler.applescript");
-  deps.writeFileSync(scriptPath, buildAppleScriptHandler(deps.execPath, deps.dispatchPath));
+  deps.writeFileSync(
+    scriptPath,
+    buildAppleScriptHandler(
+      deps.execPath,
+      deps.dispatchPath,
+      // Resolved at REGISTER time, from the shell the user ran `protocol register` in.
+      // `open location` runs with no TERM_PROGRAM at all, so this cannot be deferred.
+      preferredTerminalApp(deps.env)
+    )
+  );
   deps.rmSync(appPath);
   const compile = deps.spawnSync("osacompile", ["-o", appPath, scriptPath]);
   if (compile.status !== 0) {
@@ -274,14 +362,10 @@ function darwinStatus(deps) {
   return { registered: exists && registered, appExists: exists };
 }
 function darwinOpenPreviewTerminal(token, deps) {
-  const doScript = `do script ${appleScriptStringLiteral(buildPreviewShellCommand(token, deps))}`;
-  const res = deps.spawnSync("osascript", [
-    "-e",
-    'tell application "Terminal" to activate',
-    "-e",
-    doScript
-  ]);
-  return res.status === 0;
+  const path = writeLauncherFile(token, deps);
+  const app = preferredTerminalApp(deps.env);
+  if (app && deps.spawnSync("open", ["-a", app, path]).status === 0) return true;
+  return deps.spawnSync("open", [path]).status === 0;
 }
 function win32Register(deps) {
   for (const scheme of WIN32_SCHEMES) {
@@ -570,7 +654,7 @@ var init_protocol = __esm({
       ["konsole", ["-e"]],
       ["xterm", ["-e"]]
     ];
-    HANDLER_TEMPLATE_VERSION = 2;
+    HANDLER_TEMPLATE_VERSION = 3;
     PENDING_CLAIMS_CAP = 20;
     PENDING_TOKEN_RE = /^[A-Za-z0-9_-]{8}$/;
   }

package/dist/bin/jpi-update.js

@@ -51,7 +51,31 @@ function ensureStateDir(dir) {
     }
   }
 }
-var STATE_DIR_MODE, STATE_DIR_OK, STATE_DIR_SYMLINK, STATE_DIR_UNVERIFIED, warnedDirs;
+function applyStateDirSecretPolicy(dir, status) {
+  if (status === STATE_DIR_SYMLINK) {
+    throw new Error(
+      `terminalhire: refusing to write key material into ${dir} \u2014 it is a symlink, not a directory.
+A write through it would FOLLOW THE LINK and place key/token material wherever the symlink points, outside our control and outside the "owner-only" (0700) guarantee this directory is supposed to carry.
+Fix: remove the symlink so terminalhire can recreate it as a real directory \u2014
+  rm ${dir}
+then re-run the command. If the symlink is intentional, point TERMINALHIRE_DIR at a real directory instead of routing it through this one.`
+    );
+  }
+  if (status === STATE_DIR_UNVERIFIED && !warnedUnverifiedSecretWriteThisProcess) {
+    warnedUnverifiedSecretWriteThisProcess = true;
+    try {
+      process.stderr.write(
+        `terminalhire: could not verify ${dir}'s permissions (expected on Windows \u2014 POSIX mode bits do not apply there) \u2014 proceeding, but the "owner-only" guarantee on key/token storage is NOT enforced on this platform.
+`
+      );
+    } catch {
+    }
+  }
+}
+function ensureStateDirForSecret(dir) {
+  applyStateDirSecretPolicy(dir, ensureStateDir(dir));
+}
+var STATE_DIR_MODE, STATE_DIR_OK, STATE_DIR_SYMLINK, STATE_DIR_UNVERIFIED, warnedDirs, warnedUnverifiedSecretWriteThisProcess;
 var init_state_dir = __esm({
   "src/state-dir.ts"() {
     "use strict";
@@ -60,6 +84,7 @@ var init_state_dir = __esm({
     STATE_DIR_SYMLINK = "symlink";
     STATE_DIR_UNVERIFIED = "unverified";
     warnedDirs = /* @__PURE__ */ new Set();
+    warnedUnverifiedSecretWriteThisProcess = false;
   }
 });
 
@@ -72,10 +97,12 @@ __export(protocol_exports, {
   handleUrl: () => handleUrl,
   healStaleHandler: () => healStaleHandler,
   parseClaimUrl: () => parseClaimUrl,
+  preferredTerminalApp: () => preferredTerminalApp,
   printClaimCommand: () => printClaimCommand,
   registerScheme: () => registerScheme,
   schemeStatus: () => schemeStatus,
-  unregisterScheme: () => unregisterScheme
+  unregisterScheme: () => unregisterScheme,
+  writeClaimLauncher: () => writeClaimLauncher
 });
 import { spawn, spawnSync } from "child_process";
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2, renameSync } from "fs";
@@ -107,8 +134,11 @@ function defaultProtocolDeps() {
     ensureStateDir: (path2) => {
       ensureStateDir(path2);
     },
-    writeFileSync: (path2, contents) => {
-      writeFileSync2(path2, contents, "utf8");
+    ensureStateDirForSecret: (path2) => {
+      ensureStateDirForSecret(path2);
+    },
+    writeFileSync: (path2, contents, mode) => {
+      writeFileSync2(path2, contents, mode === void 0 ? "utf8" : { encoding: "utf8", mode });
     },
     readFileSync: (path2) => readFileSync2(path2, "utf8"),
     rmSync: (path2) => {
@@ -148,30 +178,52 @@ function appleScriptStringLiteral(s) {
 function shellQuoteSingle(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-function buildAppleScriptHandler(execPath, dispatchPath) {
+function preferredTerminalApp(env) {
+  const raw = typeof env.TERM_PROGRAM === "string" ? env.TERM_PROGRAM.trim() : "";
+  if (!raw) return null;
+  const known = {
+    apple_terminal: "Terminal",
+    "iterm.app": "iTerm"
+  };
+  return known[raw.toLowerCase()] ?? null;
+}
+function buildAppleScriptHandler(execPath, dispatchPath, terminalApp) {
   const execLit = appleScriptStringLiteral(execPath);
   const dispatchLit = appleScriptStringLiteral(dispatchPath);
+  const fallback = (indent) => [
+    `${indent}display notification "Couldn't open your terminal. Run: " & launcher with title "Terminalhire"`,
+    `${indent}try`,
+    `${indent}	do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " handle-url " & quoted form of theURL & " > /dev/null 2>&1 &"`,
+    `${indent}end try`
+  ];
+  const launch = terminalApp ? [
+    "	try",
+    `		do shell script "open -a " & quoted form of ${appleScriptStringLiteral(terminalApp)} & " " & quoted form of launcher`,
+    "	on error",
+    "		try",
+    '			do shell script "open " & quoted form of launcher',
+    "		on error",
+    ...fallback("			"),
+    "		end try",
+    "	end try"
+  ] : [
+    "	try",
+    '		do shell script "open " & quoted form of launcher',
+    "	on error",
+    ...fallback("		"),
+    "	end try"
+  ];
   return [
     "on open location theURL",
-    '	set claimCmd to ""',
+    '	set launcher to ""',
     "	try",
-    `		set claimCmd to do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " print-claim-command " & quoted form of theURL`,
+    `		set launcher to do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " write-claim-launcher " & quoted form of theURL`,
     "	end try",
-    '	if claimCmd is "" then',
+    '	if launcher is "" then',
     `		display notification "That isn't a valid Terminalhire claim link." with title "Terminalhire"`,
     "		return",
     "	end if",
-    "	try",
-    '		tell application "Terminal"',
-    "			activate",
-    "			do script claimCmd",
-    "		end tell",
-    "	on error",
-    `		display notification "Couldn't open Terminal automatically. Run: " & claimCmd with title "Terminalhire"`,
-    "		try",
-    `			do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " handle-url " & quoted form of theURL & " > /dev/null 2>&1 &"`,
-    "		end try",
-    "	end try",
+    ...launch,
     "end open location",
     ""
   ].join("\n");
@@ -182,7 +234,12 @@ function buildPreviewShellCommand(token, deps) {
     shellQuoteSingle(deps.dispatchPath),
     "claim",
     "preview",
-    token
+    // Quoted like the paths beside it, though parseClaimUrl's `[A-Za-z0-9_-]{8}` already
+    // forbids every shell metacharacter. Leaving the ONE value that came from a URL bare
+    // while quoting the two that never did is backwards: it makes the safety depend on a
+    // regex two files away rather than on this line, and a future loosening of that regex
+    // would open an injection here silently.
+    shellQuoteSingle(token)
   ].join(" ");
 }
 function printClaimCommand(raw, deps = defaultProtocolDeps()) {
@@ -194,6 +251,28 @@ function printClaimCommand(raw, deps = defaultProtocolDeps()) {
   deps.log(buildPreviewShellCommand(parsed.token, deps));
   deps.exit(0);
 }
+function launcherPath(token, deps) {
+  return join2(stateDir2(deps), `claim-${token}.command`);
+}
+function buildLauncherScript(token, deps) {
+  return ["#!/bin/sh", `exec ${buildPreviewShellCommand(token, deps)}`, ""].join("\n");
+}
+function writeLauncherFile(token, deps) {
+  deps.ensureStateDirForSecret(stateDir2(deps));
+  const path2 = launcherPath(token, deps);
+  deps.rmSync(path2);
+  deps.writeFileSync(path2, buildLauncherScript(token, deps), 448);
+  return path2;
+}
+function writeClaimLauncher(raw, deps = defaultProtocolDeps()) {
+  const parsed = parseClaimUrl(raw);
+  if (!parsed) {
+    deps.exit(1);
+    return;
+  }
+  deps.log(writeLauncherFile(parsed.token, deps));
+  deps.exit(0);
+}
 function darwinAppPaths(deps) {
   const appDir = join2(deps.homedir(), "Applications");
   const appPath = join2(appDir, "Terminalhire Handler.app");
@@ -206,7 +285,16 @@ function darwinRegister(deps) {
   const { appDir, appPath, plistPath } = darwinAppPaths(deps);
   deps.mkdirSync(appDir);
   const scriptPath = join2(dir, "handler.applescript");
-  deps.writeFileSync(scriptPath, buildAppleScriptHandler(deps.execPath, deps.dispatchPath));
+  deps.writeFileSync(
+    scriptPath,
+    buildAppleScriptHandler(
+      deps.execPath,
+      deps.dispatchPath,
+      // Resolved at REGISTER time, from the shell the user ran `protocol register` in.
+      // `open location` runs with no TERM_PROGRAM at all, so this cannot be deferred.
+      preferredTerminalApp(deps.env)
+    )
+  );
   deps.rmSync(appPath);
   const compile = deps.spawnSync("osacompile", ["-o", appPath, scriptPath]);
   if (compile.status !== 0) {
@@ -274,14 +362,10 @@ function darwinStatus(deps) {
   return { registered: exists && registered, appExists: exists };
 }
 function darwinOpenPreviewTerminal(token, deps) {
-  const doScript = `do script ${appleScriptStringLiteral(buildPreviewShellCommand(token, deps))}`;
-  const res = deps.spawnSync("osascript", [
-    "-e",
-    'tell application "Terminal" to activate',
-    "-e",
-    doScript
-  ]);
-  return res.status === 0;
+  const path2 = writeLauncherFile(token, deps);
+  const app = preferredTerminalApp(deps.env);
+  if (app && deps.spawnSync("open", ["-a", app, path2]).status === 0) return true;
+  return deps.spawnSync("open", [path2]).status === 0;
 }
 function win32Register(deps) {
   for (const scheme of WIN32_SCHEMES) {
@@ -570,7 +654,7 @@ var init_protocol = __esm({
       ["konsole", ["-e"]],
       ["xterm", ["-e"]]
     ];
-    HANDLER_TEMPLATE_VERSION = 2;
+    HANDLER_TEMPLATE_VERSION = 3;
     PENDING_CLAIMS_CAP = 20;
     PENDING_TOKEN_RE = /^[A-Za-z0-9_-]{8}$/;
   }

package/dist/src/protocol.js

@@ -52,6 +52,31 @@ function ensureStateDir(dir) {
     }
   }
 }
+var warnedUnverifiedSecretWriteThisProcess = false;
+function applyStateDirSecretPolicy(dir, status) {
+  if (status === STATE_DIR_SYMLINK) {
+    throw new Error(
+      `terminalhire: refusing to write key material into ${dir} \u2014 it is a symlink, not a directory.
+A write through it would FOLLOW THE LINK and place key/token material wherever the symlink points, outside our control and outside the "owner-only" (0700) guarantee this directory is supposed to carry.
+Fix: remove the symlink so terminalhire can recreate it as a real directory \u2014
+  rm ${dir}
+then re-run the command. If the symlink is intentional, point TERMINALHIRE_DIR at a real directory instead of routing it through this one.`
+    );
+  }
+  if (status === STATE_DIR_UNVERIFIED && !warnedUnverifiedSecretWriteThisProcess) {
+    warnedUnverifiedSecretWriteThisProcess = true;
+    try {
+      process.stderr.write(
+        `terminalhire: could not verify ${dir}'s permissions (expected on Windows \u2014 POSIX mode bits do not apply there) \u2014 proceeding, but the "owner-only" guarantee on key/token storage is NOT enforced on this platform.
+`
+      );
+    } catch {
+    }
+  }
+}
+function ensureStateDirForSecret(dir) {
+  applyStateDirSecretPolicy(dir, ensureStateDir(dir));
+}
 
 // src/protocol.ts
 var CLAIM_URL_RE = /^(th|terminalhire):\/\/claim\/([A-Za-z0-9_-]{8})\/?$/i;
@@ -80,8 +105,11 @@ function defaultProtocolDeps() {
     ensureStateDir: (path) => {
       ensureStateDir(path);
     },
-    writeFileSync: (path, contents) => {
-      writeFileSync(path, contents, "utf8");
+    ensureStateDirForSecret: (path) => {
+      ensureStateDirForSecret(path);
+    },
+    writeFileSync: (path, contents, mode) => {
+      writeFileSync(path, contents, mode === void 0 ? "utf8" : { encoding: "utf8", mode });
     },
     readFileSync: (path) => readFileSync(path, "utf8"),
     rmSync: (path) => {
@@ -123,30 +151,52 @@ function appleScriptStringLiteral(s) {
 function shellQuoteSingle(s) {
   return `'${s.replace(/'/g, `'\\''`)}'`;
 }
-function buildAppleScriptHandler(execPath, dispatchPath) {
+function preferredTerminalApp(env) {
+  const raw = typeof env.TERM_PROGRAM === "string" ? env.TERM_PROGRAM.trim() : "";
+  if (!raw) return null;
+  const known = {
+    apple_terminal: "Terminal",
+    "iterm.app": "iTerm"
+  };
+  return known[raw.toLowerCase()] ?? null;
+}
+function buildAppleScriptHandler(execPath, dispatchPath, terminalApp) {
   const execLit = appleScriptStringLiteral(execPath);
   const dispatchLit = appleScriptStringLiteral(dispatchPath);
+  const fallback = (indent) => [
+    `${indent}display notification "Couldn't open your terminal. Run: " & launcher with title "Terminalhire"`,
+    `${indent}try`,
+    `${indent}	do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " handle-url " & quoted form of theURL & " > /dev/null 2>&1 &"`,
+    `${indent}end try`
+  ];
+  const launch = terminalApp ? [
+    "	try",
+    `		do shell script "open -a " & quoted form of ${appleScriptStringLiteral(terminalApp)} & " " & quoted form of launcher`,
+    "	on error",
+    "		try",
+    '			do shell script "open " & quoted form of launcher',
+    "		on error",
+    ...fallback("			"),
+    "		end try",
+    "	end try"
+  ] : [
+    "	try",
+    '		do shell script "open " & quoted form of launcher',
+    "	on error",
+    ...fallback("		"),
+    "	end try"
+  ];
   return [
     "on open location theURL",
-    '	set claimCmd to ""',
+    '	set launcher to ""',
     "	try",
-    `		set claimCmd to do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " print-claim-command " & quoted form of theURL`,
+    `		set launcher to do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " write-claim-launcher " & quoted form of theURL`,
     "	end try",
-    '	if claimCmd is "" then',
+    '	if launcher is "" then',
     `		display notification "That isn't a valid Terminalhire claim link." with title "Terminalhire"`,
     "		return",
     "	end if",
-    "	try",
-    '		tell application "Terminal"',
-    "			activate",
-    "			do script claimCmd",
-    "		end tell",
-    "	on error",
-    `		display notification "Couldn't open Terminal automatically. Run: " & claimCmd with title "Terminalhire"`,
-    "		try",
-    `			do shell script quoted form of ${execLit} & " " & quoted form of ${dispatchLit} & " handle-url " & quoted form of theURL & " > /dev/null 2>&1 &"`,
-    "		end try",
-    "	end try",
+    ...launch,
     "end open location",
     ""
   ].join("\n");
@@ -157,7 +207,12 @@ function buildPreviewShellCommand(token, deps) {
     shellQuoteSingle(deps.dispatchPath),
     "claim",
     "preview",
-    token
+    // Quoted like the paths beside it, though parseClaimUrl's `[A-Za-z0-9_-]{8}` already
+    // forbids every shell metacharacter. Leaving the ONE value that came from a URL bare
+    // while quoting the two that never did is backwards: it makes the safety depend on a
+    // regex two files away rather than on this line, and a future loosening of that regex
+    // would open an injection here silently.
+    shellQuoteSingle(token)
   ].join(" ");
 }
 function printClaimCommand(raw, deps = defaultProtocolDeps()) {
@@ -169,6 +224,28 @@ function printClaimCommand(raw, deps = defaultProtocolDeps()) {
   deps.log(buildPreviewShellCommand(parsed.token, deps));
   deps.exit(0);
 }
+function launcherPath(token, deps) {
+  return join(stateDir(deps), `claim-${token}.command`);
+}
+function buildLauncherScript(token, deps) {
+  return ["#!/bin/sh", `exec ${buildPreviewShellCommand(token, deps)}`, ""].join("\n");
+}
+function writeLauncherFile(token, deps) {
+  deps.ensureStateDirForSecret(stateDir(deps));
+  const path = launcherPath(token, deps);
+  deps.rmSync(path);
+  deps.writeFileSync(path, buildLauncherScript(token, deps), 448);
+  return path;
+}
+function writeClaimLauncher(raw, deps = defaultProtocolDeps()) {
+  const parsed = parseClaimUrl(raw);
+  if (!parsed) {
+    deps.exit(1);
+    return;
+  }
+  deps.log(writeLauncherFile(parsed.token, deps));
+  deps.exit(0);
+}
 function darwinAppPaths(deps) {
   const appDir = join(deps.homedir(), "Applications");
   const appPath = join(appDir, "Terminalhire Handler.app");
@@ -181,7 +258,16 @@ function darwinRegister(deps) {
   const { appDir, appPath, plistPath } = darwinAppPaths(deps);
   deps.mkdirSync(appDir);
   const scriptPath = join(dir, "handler.applescript");
-  deps.writeFileSync(scriptPath, buildAppleScriptHandler(deps.execPath, deps.dispatchPath));
+  deps.writeFileSync(
+    scriptPath,
+    buildAppleScriptHandler(
+      deps.execPath,
+      deps.dispatchPath,
+      // Resolved at REGISTER time, from the shell the user ran `protocol register` in.
+      // `open location` runs with no TERM_PROGRAM at all, so this cannot be deferred.
+      preferredTerminalApp(deps.env)
+    )
+  );
   deps.rmSync(appPath);
   const compile = deps.spawnSync("osacompile", ["-o", appPath, scriptPath]);
   if (compile.status !== 0) {
@@ -249,14 +335,10 @@ function darwinStatus(deps) {
   return { registered: exists && registered, appExists: exists };
 }
 function darwinOpenPreviewTerminal(token, deps) {
-  const doScript = `do script ${appleScriptStringLiteral(buildPreviewShellCommand(token, deps))}`;
-  const res = deps.spawnSync("osascript", [
-    "-e",
-    'tell application "Terminal" to activate',
-    "-e",
-    doScript
-  ]);
-  return res.status === 0;
+  const path = writeLauncherFile(token, deps);
+  const app = preferredTerminalApp(deps.env);
+  if (app && deps.spawnSync("open", ["-a", app, path]).status === 0) return true;
+  return deps.spawnSync("open", [path]).status === 0;
 }
 var WIN32_SCHEMES = ["th", "terminalhire"];
 function win32Register(deps) {
@@ -348,7 +430,7 @@ var LINUX_TERMINAL_CANDIDATES = [
   ["konsole", ["-e"]],
   ["xterm", ["-e"]]
 ];
-var HANDLER_TEMPLATE_VERSION = 2;
+var HANDLER_TEMPLATE_VERSION = 3;
 function handlerTemplateVersionPath(deps) {
   return join(stateDir(deps), "handler-template-version");
 }
@@ -547,8 +629,10 @@ export {
   handleUrl,
   healStaleHandler,
   parseClaimUrl,
+  preferredTerminalApp,
   printClaimCommand,
   registerScheme,
   schemeStatus,
-  unregisterScheme
+  unregisterScheme,
+  writeClaimLauncher
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "terminalhire",
-  "version": "0.42.2",
+  "version": "0.42.3",
   "description": "Local-first job matching for developers — ambient job matches in the Claude Code spinner. Your profile never leaves your machine.",
   "repository": {
     "type": "git",
@@ -31,7 +31,7 @@
     "test": "node scripts/run-tests.mjs test",
     "build": "tsup",
     "bundle:plugin": "npm run build && rm -rf ../../plugins/terminalhire/dist && cp -R dist ../../plugins/terminalhire/dist && cp package.json ../../plugins/terminalhire/dist/package.json && cp install.js ../../plugins/terminalhire/dist/install.js && cp statusline-install.js ../../plugins/terminalhire/dist/statusline-install.js && cp postinstall.js ../../plugins/terminalhire/dist/postinstall.js && node ../../scripts/write-bundle-manifest.mjs",
-    "prepublishOnly": "npm run build",
+    "prepublishOnly": "node ../../scripts/check-publish-preconditions.mjs && npm run build",
     "install-hook": "node install.js",
     "postinstall": "node ./postinstall.js"
   },