ACCT RELEASES
Release notes
Review the changes, fixes, and upgrade instructions for each version of acct.
Overview
- Run acct install once after upgrading. Profiles and bindings carry over unchanged. Full notes: docs/releases/v0.2.0.md.
Security
- gh no longer falls back to its global active account in a bound folder when the token check is inconclusive; acct uses gh's token for the folder's user, and blocks gh in strict folders that have no token.
- Credential-helper errors emit quit=1, so git never falls through to a later helper.
- Commit checks use the effective author/committer (git var), cover merge commits, and pre-push re-checks every outgoing commit.
- pre-push verifies the account the push actually authenticates as, over HTTPS or SSH (GitHub greeting), instead of an unrelated token.
- acct exec refuses unknown profiles and strict profiles without a token, and blocks gh auth --hostname … token / gh auth status --show-token.
- GH_HOST is always set to the profile's host.
- Plaintext token copies are migrated to the keychain and deleted; no .bak copies. Secret errors never echo file contents. Shared tokens and SSH keys survive removing one of the profiles that use them.
- A failed shell refresh clears acct's variables instead of keeping the previous folder's token.
Changed
- The credential helper is scoped to the GitHub hosts in your profiles; other HTTPS hosts keep their own helpers.
- Hooks install globally by default and chain to existing hooks (.git/hooks, a previous core.hooksPath). New acct install --repo covers repositories with their own local core.hooksPath. acct uninstall restores the previous path.
- Resolution starts at the repository root. .acct below the root is ignored and reported. Linked worktrees that git and acct would assign differently are refused in strict.
- Bindings are canonical (symlinks resolved; case-insensitive on macOS/Windows), and nested bindings are emitted so the most specific folder wins.
- Git config values are quoted and escaped; the SSH command no longer forces a HostName onto every SSH remote.
- Config edits are serialized and transactional; locks record their owner and are never stolen from a live process; ownerless locks older than 60 s are recovered.
- ~/.gitconfig is written with git's own lock, keeping symlinks and permissions.
- Editing profiles or bindings after acct uninstall no longer reinstalls acct.
- The config file is validated on load; enum flags only accept valid values.
- GitHub usernames are compared case-insensitively.
- acct exec passes child options through (acct exec gh --version), and the gh wrapper resolves the real gh without recursion.
- acct whoami exits 0 (match), 1 (mismatch) or 2 (unknown). Status and doctor report hook coverage, auth state and helper order as measured.
Added
- acct rebind <old> <new> for moved folders.
- acct local set <profile> | --unbound and acct local clear for single repositories.
- Doctor warnings for an unloaded shell hook, missing binding paths, stale generated shims, and credential helpers that override acct.
- acct_refresh shell function; native Fish output (acct shell-env --fish).
Build
- Vitest 4.1.11 (clears dev-only advisories). Prettier formatting with a CI check.
- Release builds run read-only; the publish job only uploads the verified tarballs. All GitHub Actions are pinned to commit SHAs.