v3.3.1 — Shell Hook Auto-Switch & Security Hardening

CCM v3.3.1

Shell Hook — Auto-Switch on cd

Add one line to your shell rc and CCM auto-switches accounts when you enter a bound directory:

# ~/.zshrc or ~/.bashrc
eval "$(ccm hook)"

Then:

ccm bind ~/work/project work
ccm bind ~/personal/side-project personal

cd ~/work/project      # → auto-switches to work account
cd ~/personal/side     # → auto-switches to personal

Performance: ~30ms at shell startup (one jq call), ~0ms per cd (pure bash array lookup). Re-reads sequence.json only when file mtime changes. Parent directory matching — binding ~/work matches ~/work/project/src.

Shell support: Zsh uses native chpwd hook. Bash wraps cd/pushd/popd.

Security Hardening

• Atomic file creation — umask 077 + mktemp replaces post-hoc chmod 600 (prevents race condition where file is briefly world-readable)
• Input validation — validate_account_params() guards all credential file operations against path traversal
• Injection prevention — awk -v var="$val" replaces awk "BEGIN{... $val ...}" everywhere
• Statusline — eval of jq output replaced with safe IFS=$'\t' read pattern
• Safe mv — all mv calls use -- to prevent filenames starting with - being interpreted as flags
• Account lookup hardening — resolve_account_identifier validates jq output is ^[0-9]+$
• Input bounds — identifiers rejected if >255 chars
• write_json — removed unconditional chmod 600 (was wrong for settings.json which should be 644)

Fixes

• Shell hook returns 0 on switch failure (doesn't break cd exit code in bash scripts)
• trap quoting fixed in export/import ('$var' → "$var")
• Standalone statusline.sh synced with all security improvements

Install / Update

curl -fsSL https://raw.githubusercontent.com/dr5hn/ccm/main/install.sh | bash

Statusline (standalone, no CCM needed):

curl -fsSL https://raw.githubusercontent.com/dr5hn/ccm/main/statusline.sh | bash