Every acct command.

With no arguments, prints the welcome tip sheet (npm hides postinstall output). Use --help for the full command list.

npm install -g acct-sh
acct
acct --help

Create a profile, bind a directory tree, wire includeIf identity, and install enforce hooks. This is the usual first command after install.

acct init \
  --id work \
  --user your-work-user \
  --email you@company.com \
  --name "Your Name" \
  --bind ~/Work

--id <id>required

Profile id, e.g. work or personal.

--user <githubUser>required

GitHub username for this profile.

--email <email>required

Commit email (user.email).

--name <name>required

Commit name (user.name).

--host <host>

GitHub host. Default github.com.

--protocol <https|ssh>

Preferred clone style. Default https.

--bind <dir>

Directory tree to bind. Default: current directory.

--import-gh

Seed the OS keychain from gh auth token --user. Optional — HTTPS and acct exec already follow gh for that user.

--global-hooks

Set core.hooksPath globally. Discouraged; replaces hooks in every repo.

--force

Overwrite an existing non-acct core.hooksPath in the bind directory.

• New profiles start in strict enforce mode.
• After init, add a shell hook so gh follows the directory on every cd.

Create a profile without binding a folder. Bind it afterwards with acct bind.

acct profile add \
  --id personal \
  --user you-home \
  --email you@home \
  --name "Your Name"

--id <id>required

Profile id.

--user <githubUser>required

GitHub username.

--email <email>required

Commit email.

--name <name>required

Commit name.

--host <host>

GitHub host. Default github.com.

--protocol <https|ssh>

Preferred protocol. Default https.

--import-gh

Import a token from gh into the OS keychain.

Print every profile as id, user@host, email, and protocol.

acct profile list

Print one profile as JSON. Does not include the token.

acct profile show work

Delete the profile, its stored token, and includeIf artifacts. Bindings that pointed at it should be unbound first.

acct profile remove work

Store a token in the OS keychain. One of --import-gh or --stdin is required.

acct profile token work --import-gh
printf '%s' "$PAT" | acct profile token work --stdin

--import-gh

Import from gh auth token --user and keep following gh on refresh.

--stdin

Read a PAT from stdin. Sets followGh: false so gh will not overwrite it.

• Default path: HTTPS and acct exec follow gh auth token --user. After gh auth refresh you usually do not need --import-gh again.
• Use --stdin for a dedicated PAT that must not track gh.

Generate an ed25519 key for the profile, or attach an existing private key. HTTPS isolation stays installed unless you pass --protocol.

acct profile ssh-key work --generate
acct profile ssh-key work --path ~/.ssh/id_work

--generate

Create an ed25519 key. Defaults protocol to ssh.

--path <path>

Attach an existing private key.

--protocol <https|ssh>

Set preferred protocol. Generate defaults to ssh if omitted.

Map a directory tree to an existing profile and refresh includeIf rules.

acct bind ~/Personal personal

--enforce <mode>

Override enforce for this binding only: strict, warn, or off.

Remove a directory → profile binding. The profile itself is kept.

acct unbind ~/Downloads

Dump how cwd resolved: reason, binding, profile, identity, token presence, and the auth principal. If unhealthy, prints what is wrong, commands to run, and whether commit or push will go through. Exits 1 on error findings.

acct status

--profile <id>

Show this profile for the gh principal. Does not rebind git HTTPS — directory / .acct still win.

• Ambient ACCT_PROFILE is ignored for git auth. A warning is printed if it disagrees with cwd.

One line: expected GitHub user vs actual login vs commit email. Prints unbound outside a bound tree. Exits 1 on mismatch.

acct whoami

--profile <id>

Explicit profile for the gh plane.

Scan credential-helper competition, missing install blocks, orphan bindings, sticky GH_TOKEN, enforce fallthrough, and keyring availability. Also diagnoses the cwd profile when unhealthy.

acct doctor
acct doctor --online

--online

Call gh api to verify ambient GH_TOKEN against the cwd profile.

Test SSH auth for a profile against github.com using that profile's key.

acct ssh-test work

Run a command with the profile GH_TOKEN. Refuses gh auth switch / login / token because those mutate global gh state. Git HTTPS still follows cwd / .acct, not --profile.

acct exec gh pr list
acct exec --profile work --allow-cross-profile gh api user

--profile <id>

Inject this profile's token for gh. Does not rebind the git credential helper.

--allow-cross-profile

Required when --profile differs from the cwd binding.

git clone with the cwd profile's GH_TOKEN in the environment. Git credentials still follow the directory binding.

acct clone https://github.com/org/repo.git

--profile <id>

Inject GH_TOKEN for helpers that honor it. Git still uses the cwd binding.

Set the default enforcement mode. on is an alias for strict. A binding can override this with acct bind --enforce.

acct enforce strict

• In strict, a missing profile token or mismatched gh principal blocks push.
• A commit still uses includeIf name/email, not gh. Raw gh without acct exec can still be the wrong user — that is the leak risk.

Wire includeIf git identity and set core.hooksPath on the current repo (local by default).

acct install

--global

Set core.hooksPath globally. Discouraged; replaces hooks in every repo.

--force

Overwrite an existing non-acct core.hooksPath in this repo.

Remove the acct-managed gitconfig block and unset global core.hooksPath. OS helpers (osxkeychain, wincred, libsecret) may still answer for github.com — doctor will say so.

acct uninstall --restore-backup

--restore-backup

Restore the pre-acct gitconfig backup if one exists.

Print a shell hook. Eval it from your shell startup so cd rebinds env (or clears it when unbound).

eval "$(acct hook zsh)"
eval "$(acct hook bash)"
acct hook fish | source
acct hook powershell | Out-String | Invoke-Expression

Print env exports for the cwd profile. Used by the shell hook; you rarely run this yourself.

acct shell-env

--powershell

Emit PowerShell syntax.

Install optional PATH shims so gh is invoked as acct exec gh. Then add the wrap-path export to your shell.

acct wrap-install
eval "$(acct wrap-path)"

Print the PATH export for wrap shims. Installs the shims if they are missing.

eval "$(acct wrap-path)"

--powershell

Emit PowerShell syntax.

Internal entry for enforce hooks. pre-commit checks commit identity; pre-push checks auth. On failure, prints the block message plus a status diagnosis.

acct hook-run pre-push