@bordoni/claudep 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -6,6 +6,27 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-09-10
+
+### Added
+
+- fish support: `claudep shell-init fish` prints a hook for `config.fish` that follows `.claudep` pins on `cd` using builtins only, and `claudep env` prints `set -gx` and `set -e` lines when run from fish. Load both with `| source`. Needs fish 3.0 or later.
+- `claudep env` looks at the shell it runs in (fish, pwsh, or an sh-like shell) before falling back to `$SHELL`, and `--shell sh|zsh|bash|fish|powershell` overrides both. `claudep env <name> | Invoke-Expression` works in pwsh on macOS and Linux as a result.
+- `claudep current --name` prints only the profile name (`default` for `~/.claude`, `custom` for a config dir outside the profiles root), for prompts, scripts and the statusline.
+- `claudep list --json` prints the same flat objects as `claudep status --json`, one per profile.
+- `claudep doctor` fails when the shared `settings.json` sets `env.CLAUDE_CONFIG_DIR`, and on macOS when Claude Code is older than 2.1.144, the first build whose Keychain item is namespaced per config dir.
+- `claudep doctor` and `claudep <name>` warn when `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN` or `CLAUDE_CODE_OAUTH_TOKEN` is set, because Claude Code uses it instead of the profile's login. The variable is left alone.
+- `claudep rm` says when the shell is on the profile being removed or the current directory pins it, and names the command that clears each.
+- CI runs the shell hook in fish on macOS and Linux.
+
+## [0.2.1] - 2026-09-08
+
+### Changed
+
+- `rules/`, `output-styles/`, `themes/` and `workflows/` are shared with every profile, matching what Claude Code 2.1.263 reads from the user config directory. A custom theme named in the shared `settings.json` now resolves inside a profile. Existing profiles pick the links up on their next `claudep init <name>`.
+- `teams/`, `uploads/`, `usage-data/`, `mcp-discovery-cache/`, `mcp-skill-archives/`, `daemon.json`, `launch.json`, `scheduled_tasks.json` and `seed-admin` are known-private, so `claudep doctor` no longer reports them as unclassified.
+- The README notes that `claude --bg` sessions and `claude daemon install` do not work under a profile in Claude Code 2.1.263.
+
 ## [0.2.0] - 2026-09-07
 
 ### Added
@@ -55,7 +76,9 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 - Keychain isolation per config dir verified against Claude Code 2.1.259: the service name is `Claude Code-credentials-<sha256(dir)[0:8]>`.
 - Test suite with `bun test`, a sandboxed `$HOME`, a fake `claude` and `security` on PATH, and a real-shell test for the hook. CI runs typecheck, lint and tests on macOS and Linux.
 
-[Unreleased]: https://github.com/bordoni/claudep/compare/0.2.0...HEAD
+[Unreleased]: https://github.com/bordoni/claudep/compare/0.3.0...HEAD
+[0.3.0]: https://github.com/bordoni/claudep/compare/0.2.1...0.3.0
+[0.2.1]: https://github.com/bordoni/claudep/compare/0.2.0...0.2.1
 [0.2.0]: https://github.com/bordoni/claudep/compare/0.1.1...0.2.0
 [0.1.1]: https://github.com/bordoni/claudep/compare/0.1.0...0.1.1
 [0.1.0]: https://github.com/bordoni/claudep/releases/tag/0.1.0

package/README.md

@@ -54,16 +54,16 @@ Two things differ from macOS:
 ```
 claudep <name> [claude args…]        run claude with profile <name>
 claudep init <name> [options]        create/update a profile and log in
-claudep list                         every profile and who it is logged in as
+claudep list [--json]                every profile and who it is logged in as
 claudep status <name> [--json]       login state for one profile ("default" = ~/.claude)
-claudep env <name>                   print "export CLAUDE_CONFIG_DIR=…" for eval
+claudep env <name> [--shell <sh>]    print the CLAUDE_CONFIG_DIR pin for eval, source or Invoke-Expression
 claudep alias <name> <command>       write a shim so "<command>" == "claudep <name>"
-claudep current [--json]             which profile this shell is on, and why
-claudep doctor [name]                verify symlinks, keychain entry, unclassified files
+claudep current [--json|--name]      which profile this shell is on, and why
+claudep doctor [name]                verify symlinks, keychain entry, unclassified files, Claude Code version
 claudep rm <name> [--keep-login]     log out and delete a profile (base is never touched)
 claudep local <name> | --remove      pin the current directory tree to a profile (see below)
 claudep resolve [dir]                print the profile pinned for a directory
-claudep shell-init [zsh|bash|powershell]   print the hook that applies pins on cd
+claudep shell-init [zsh|bash|fish|powershell]   print the hook that applies pins on cd
 claudep --version
 ```
 
@@ -84,20 +84,42 @@ Shells apply pins through a hook. Add one line to `~/.zshrc` (or `~/.bashrc` wit
 eval "$(claudep shell-init zsh)"
 ```
 
-In PowerShell the line goes in `$PROFILE`:
+In fish the line goes in `~/.config/fish/config.fish`, and in PowerShell in `$PROFILE`:
+
+```fish
+claudep shell-init fish | source
+```
 
 ```powershell
 claudep shell-init powershell | Out-String | Invoke-Expression
 ```
 
-From then on, `cd` into a pinned tree sets `CLAUDE_CONFIG_DIR` for that profile and `cd` out of it returns the shell to `~/.claude`. The hook is pure shell with no subprocess (cmdlets only in PowerShell), so it costs nothing at the prompt. The rules:
+From then on, `cd` into a pinned tree sets `CLAUDE_CONFIG_DIR` for that profile and `cd` out of it returns the shell to `~/.claude`. The hook is pure shell with no subprocess (builtins in fish, cmdlets only in PowerShell), so it costs nothing at the prompt. The rules:
 
 - The nearest `.claudep` file upward from the current directory wins. An empty one cancels a parent pin.
-- The hook only changes a `CLAUDE_CONFIG_DIR` it set itself. It tracks that in `CLAUDEP_AUTO`, so a manual pin from `eval "$(claudep env work)"` (`claudep env work | Invoke-Expression` in PowerShell) or a plain `export` stays put until you `eval "$(claudep env --unset)"`.
+- The hook only changes a `CLAUDE_CONFIG_DIR` it set itself. It tracks that in `CLAUDEP_AUTO`, so a manual pin from `eval "$(claudep env work)"` (`claudep env work | source` in fish, `claudep env work | Invoke-Expression` in PowerShell) or a plain `export` stays put until you `eval "$(claudep env --unset)"`.
 - A pin that names a profile you have not created prints one warning per directory change and sets nothing.
 
+`claudep env` prints the syntax of the shell it runs in: it looks at its parent process (fish, pwsh, or an sh-like shell) and falls back to your login shell. Pass `--shell sh|fish|powershell` when neither answer fits, for example from a script or a Makefile.
+
 `claudep current` tells you which profile the shell is on and how it got there (hook, manual pin, or nothing). `claudep list` adds the same line at the bottom.
 
+## Show the profile in your prompt or statusline
+
+In a shell prompt use the variable itself; no command runs:
+
+```sh
+# zsh or bash: the last path segment is the profile name when a profile is active
+PROMPT='${CLAUDE_CONFIG_DIR:+[${CLAUDE_CONFIG_DIR##*/}] }'"$PROMPT"
+```
+
+```fish
+# fish
+function fish_prompt; set -q CLAUDE_CONFIG_DIR; and echo -n "[$(string replace -r '.*/' '' -- $CLAUDE_CONFIG_DIR)] "; ...; end
+```
+
+In scripts, and in the shared `statusline-command.sh`, `claudep current --name` prints exactly one word: the profile name, `default` for `~/.claude`, or `custom` for a `CLAUDE_CONFIG_DIR` outside the profiles root. The statusline script inherits Claude Code's environment, so it sees the profile the session was started with.
+
 ## How it works
 
 `~/.claude` is left exactly as it is and stays the **default** profile. Each named profile is a thin directory under `~/.claudep/<name>`. Inside it, shared configuration is a symlink back into `~/.claude`:
@@ -106,8 +128,8 @@ From then on, `cd` into a pinned tree sets `CLAUDE_CONFIG_DIR` for that profile
 |---|---|
 | `CLAUDE.md` and other top-level `*.md` | `.claude.json` (login identity, user-scope MCP servers, folder trust) |
 | `settings.json`, `keybindings.json`, `statusline-command.sh` | org-pushed `remote-settings.json`, `policy-limits.json` |
-| `hooks/`, `skills/`, `commands/`, `agents/`, `plugins/`, `plans/` | `history.jsonl`, `todos/`, `sessions/`, caches, telemetry |
-| `projects/` (session transcripts and auto-memory) | credentials |
+| `hooks/`, `skills/`, `commands/`, `agents/`, `rules/`, `output-styles/`, `themes/`, `workflows/` | `history.jsonl`, `todos/`, `sessions/`, `teams/`, caches, telemetry |
+| `plugins/`, `plans/`, `projects/` (session transcripts and auto-memory) | credentials |
 
 On macOS, credentials never touch the profile directory: Claude Code stores them in the Keychain under `Claude Code-credentials-<sha256(CLAUDE_CONFIG_DIR)[0:8]>`, so every profile has its own login and refresh token and they cannot overwrite each other. I verified this against Claude Code 2.1.259. An older bug where every config dir shared one Keychain entry no longer applies. On Linux and Windows the login is `<profile>/.credentials.json`, a real file inside the profile that is never shared.
 
@@ -117,8 +139,11 @@ The shared list is an allowlist, so an account-specific file cannot leak across
 
 - The first time you open a repository under a new profile you will re-accept folder trust, and claude.ai connectors need their OAuth redone in that profile.
 - Two profiles running at the same time write the same `settings.json` and `plugins/`. That is the same situation as two terminals today.
+- Background sessions and the daemon are tied to `~/.claude`. As of Claude Code 2.1.263, `claude daemon install` refuses to run with `CLAUDE_CONFIG_DIR` set, and `claude --bg` under a profile runs without the daemon.
 - Set `CLAUDE_PROFILES_DIR` to move the profiles root. Keep it out of iCloud or Dropbox; `.claude.json` is rewritten constantly and sync tools create conflict copies.
-- Never put `CLAUDE_CONFIG_DIR` in a `settings.json` `env` block. Claude Code detects that mismatch and disables features.
+- Never put `CLAUDE_CONFIG_DIR` in a `settings.json` `env` block. Claude Code detects that mismatch and disables features; `claudep doctor` reports it.
+- `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN` and `CLAUDE_CODE_OAUTH_TOKEN` override the login in any config dir, always in `-p` mode. `claudep <name>` and `claudep doctor` warn when one is set and leave it alone.
+- `claudep doctor` fails on macOS when Claude Code is older than 2.1.144, the first build whose Keychain item is namespaced per config dir.
 
 ## Releases
 

package/claudep.ts

@@ -236,7 +236,19 @@ export function version(): string {
 
 /** Top-level base items symlinked into every profile (only if they exist). */
 export const SHARED_FILES = ["CLAUDE.md", "settings.json", "keybindings.json", "statusline-command.sh"] as const;
-export const SHARED_DIRS = ["hooks", "skills", "commands", "agents", "plugins", "plans", "projects"] as const;
+export const SHARED_DIRS = [
+  "hooks",
+  "skills",
+  "commands",
+  "agents",
+  "plugins",
+  "plans",
+  "projects",
+  "rules",
+  "output-styles",
+  "themes",
+  "workflows",
+] as const;
 
 /** Per-profile state. First block is Claude Code's own runtime-state list;
  *  the rest are observed extras. Never shared. */
@@ -280,6 +292,15 @@ export const KNOWN_PRIVATE = new Set<string>([
   ".last-update-result.json",
   "daemon-auth-cooldown",
   "daemon-auth-status.json",
+  "teams",
+  "uploads",
+  "usage-data",
+  "mcp-discovery-cache",
+  "mcp-skill-archives",
+  "daemon.json",
+  "launch.json",
+  "scheduled_tasks.json",
+  "seed-admin",
 ]);
 
 /** Keys copied from the base .claude.json into a fresh profile so first-run
@@ -500,6 +521,49 @@ export async function readJson(path: string): Promise<JsonObject | undefined> {
   }
 }
 
+/** Variables Claude Code uses instead of the login in its config dir when
+ *  they are set (always in -p mode). They make a profile's login moot. */
+export const AUTH_ENV = ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"] as const;
+
+/** The AUTH_ENV names that are set and non-empty. Windows environments are
+ *  case-insensitive, so any spelling counts there. */
+export function authEnvOverrides(env: Env = process.env, platform: NodeJS.Platform = process.platform): string[] {
+  return AUTH_ENV.filter((name) => {
+    if (platform !== "win32") return Boolean(env[name]);
+    return Object.keys(env).some((k) => k.toUpperCase() === name && Boolean(env[k]));
+  });
+}
+
+/** The oldest Claude Code whose macOS Keychain item is namespaced per config
+ *  dir. Before it every config dir shared one login. */
+export const MIN_CLAUDE_VERSION = "2.1.144";
+
+export type Version = [number, number, number];
+
+/** The first x.y.z in `claude --version` output. */
+export function parseVersion(text: string): Version | undefined {
+  const m = /(\d+)\.(\d+)\.(\d+)/.exec(text);
+  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : undefined;
+}
+
+export function versionBelow(a: Version, b: Version): boolean {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return (a[i] as number) < (b[i] as number);
+  }
+  return false;
+}
+
+/** `env.CLAUDE_CONFIG_DIR` from a settings file, when present and a string.
+ *  Claude Code disables features when it finds one that differs from the
+ *  active dir, and under claudep it always differs for some profile. */
+export async function settingsEnvConfigDir(settingsPath: string): Promise<string | undefined> {
+  const settings = await readJson(settingsPath);
+  const env = settings?.env;
+  if (!env || typeof env !== "object" || Array.isArray(env)) return undefined;
+  const value = (env as JsonObject).CLAUDE_CONFIG_DIR;
+  return typeof value === "string" ? value : undefined;
+}
+
 export type SeedResult = "seeded" | "exists" | "no-base";
 
 export async function seedGlobalJson(baseGlobalJson: string, dir: string, copyMcp: boolean): Promise<SeedResult> {
@@ -894,6 +958,8 @@ async function cmdRun(L: Layout, args: string[]): Promise<never> {
   if (name === "default" || name === "base") return execClaude(L, undefined, rest);
   const dir = profileDir(L, name);
   if (!existsSync(dir)) die(`profile "${name}" does not exist. Run: claudep init ${name}`);
+  for (const v of authEnvOverrides(process.env, L.platform))
+    console.error(`claudep: ${v} is set; Claude Code will use it instead of the "${name}" login`);
   return execClaude(L, dir, rest);
 }
 
@@ -931,9 +997,20 @@ function printTable(rows: Row[], home: string, platform: NodeJS.Platform): void
   });
 }
 
-async function cmdList(L: Layout): Promise<void> {
+/** The flat object `status --json` prints for one row; `list --json` prints an array of them. */
+function rowJson(row: Row): JsonObject {
+  return { name: row.name, dir: row.dir, ...row.status };
+}
+
+async function cmdList(L: Layout, args: string[]): Promise<void> {
+  const f = parseFlags(args, ["--json"], []);
   const names = ["default", ...listProfileNames(L)];
-  printTable(await collectRows(L, names), L.home, L.platform);
+  const rows = await collectRows(L, names);
+  if (f.bools.has("--json")) {
+    console.log(JSON.stringify(rows.map(rowJson), null, 2));
+    return;
+  }
+  printTable(rows, L.home, L.platform);
   if (names.length === 1) console.log(c.dim("\nNo profiles yet. Create one: claudep init <name>"));
   const cur = currentProfile(L);
   if (cur.kind !== "base") console.log(c.dim(`\nactive in this shell: ${describeCurrent(cur)}`));
@@ -946,43 +1023,65 @@ async function cmdStatus(L: Layout, args: string[]): Promise<void> {
   if (name !== "default" && !profileExists(L, name)) die(`profile "${name}" does not exist`);
   const [row] = await collectRows(L, [name]);
   if (!row) return;
-  if (f.bools.has("--json")) console.log(JSON.stringify({ name: row.name, dir: row.dir, ...row.status }, null, 2));
+  if (f.bools.has("--json")) console.log(JSON.stringify(rowJson(row), null, 2));
   else printTable([row], L.home, L.platform);
 }
 
+function envUsage(syntax: EnvSyntax): string {
+  if (syntax === "powershell")
+    return "usage: claudep env <name> | Invoke-Expression   or   claudep env --unset | Invoke-Expression";
+  if (syntax === "fish") return "usage: claudep env <name> | source   or   claudep env --unset | source";
+  return 'usage: eval "$(claudep env <name>)"   or   eval "$(claudep env --unset)"   (add --shell fish|powershell|sh when the shell was not detected)';
+}
+
+/** The line that clears a pin, in the syntax of the shell the user is in. */
+export function envUnsetHint(syntax: EnvSyntax): string {
+  if (syntax === "powershell") return "claudep env --unset | Invoke-Expression";
+  if (syntax === "fish") return "claudep env --unset | source";
+  return 'eval "$(claudep env --unset)"';
+}
+
 function cmdEnv(L: Layout, args: string[]): void {
-  const name = args[0];
-  const syntax = shellSyntax(process.env, L.platform);
-  if (!name)
-    die(
-      syntax === "powershell"
-        ? "usage: claudep env <name> | Invoke-Expression   or   claudep env --unset | Invoke-Expression"
-        : 'usage: eval "$(claudep env <name>)"   or   eval "$(claudep env --unset)"',
-    );
-  if (name === "--unset") {
+  const f = parseFlags(args, ["--unset"], ["--shell"]);
+  const forced = f.strs.get("--shell");
+  const syntax =
+    forced === undefined ? shellSyntax(process.env, L.platform, parentProcessName(L.platform)) : envSyntaxOf(forced);
+  if (!syntax) die(`unsupported shell "${forced}". Use sh, zsh, bash, fish or powershell`);
+  if (f.bools.has("--unset")) {
     process.stdout.write(envScript(undefined, syntax));
     return;
   }
+  const name = f.rest[0];
+  if (!name) die(envUsage(syntax));
   const dir = profileDir(L, name);
   if (!existsSync(dir)) die(`profile "${name}" does not exist`);
   process.stdout.write(envScript(dir, syntax));
 }
 
 function describeCurrent(cur: Current): string {
-  const label = cur.kind === "profile" ? (cur.name ?? "?") : cur.kind === "custom" ? "custom" : "default";
+  const label = currentLabel(cur);
   const how = cur.setBy === "hook" ? "shell hook" : cur.setBy === "manual" ? "manual pin" : "nothing pinned";
   return `${label} (${how})`;
 }
 
+/** The one-word answer: the profile name, `default` for the base, `custom` otherwise. */
+export function currentLabel(cur: Current): string {
+  return cur.kind === "profile" ? (cur.name ?? "?") : cur.kind === "custom" ? "custom" : "default";
+}
+
 function cmdCurrent(L: Layout, args: string[]): void {
-  const f = parseFlags(args, ["--json"], []);
+  const f = parseFlags(args, ["--json", "--name"], []);
   const cur = currentProfile(L);
+  const label = currentLabel(cur);
+  if (f.bools.has("--name")) {
+    console.log(label);
+    return;
+  }
   const pin = resolvePin(process.cwd());
   if (f.bools.has("--json")) {
     console.log(JSON.stringify({ ...cur, pin: pin ?? null }, null, 2));
     return;
   }
-  const label = cur.kind === "profile" ? (cur.name ?? "?") : cur.kind === "custom" ? "custom" : "default";
   console.log(`${c.bold(label)}  ${c.dim(shortHome(cur.dir, L.home, L.platform))}`);
   if (cur.setBy === "hook")
     console.log(`set by: shell hook${pin ? ` (${PIN_FILE} in ${shortHome(pin.dir, L.home, L.platform)})` : ""}`);
@@ -1042,28 +1141,83 @@ function cmdLocal(L: Layout, args: string[]): void {
 /** The shell hook. Pure parameter expansion and builtins: it runs on every
  *  directory change (zsh chpwd) or prompt (bash PROMPT_COMMAND), so no
  *  subprocess is allowed here. Logic mirrors resolvePin(). */
-export type Shell = "zsh" | "bash" | "powershell";
-export const SHELLS: readonly Shell[] = ["zsh", "bash", "powershell"];
+export type Shell = "zsh" | "bash" | "fish" | "powershell";
+export const SHELLS: readonly Shell[] = ["zsh", "bash", "fish", "powershell"];
 
 /** The shell to name in hints and to default `shell-init` to. */
 export function defaultShell(env: Env = process.env, platform: NodeJS.Platform = process.platform): Shell {
   if (platform === "win32") return env.MSYSTEM ? "bash" : "powershell";
   const name = env.SHELL ? posix.basename(env.SHELL) : "";
-  if (name === "zsh" || name === "bash") return name;
+  if (name === "zsh" || name === "bash" || name === "fish") return name;
   return platform === "darwin" ? "zsh" : "bash";
 }
 
 /** The one line that loads the hook in a shell's rc file. */
 export function hookHint(shell: Shell): string {
   if (shell === "powershell") return "claudep shell-init powershell | Out-String | Invoke-Expression";
+  if (shell === "fish") return "claudep shell-init fish | source";
   return `eval "$(claudep shell-init ${shell})"`;
 }
 
-export type EnvSyntax = "sh" | "powershell";
+export type EnvSyntax = "sh" | "fish" | "powershell";
 
-/** What `claudep env` prints. PowerShell syntax only on Windows outside Git Bash. */
-export function shellSyntax(env: Env = process.env, platform: NodeJS.Platform = process.platform): EnvSyntax {
-  return platform === "win32" && !env.MSYSTEM ? "powershell" : "sh";
+/** The executable name of the parent process, which for `claudep env` is
+ *  the shell the user typed it in: `eval "$(...)"` forks the shell and a
+ *  fish pipeline runs claudep as a child of fish. Read from /proc on Linux
+ *  and from `ps` on macOS; undefined elsewhere or when it cannot be read.
+ *  This is `claudep env`, not the hook, so one `ps` is fine. */
+export function parentProcessName(
+  platform: NodeJS.Platform = process.platform,
+  ppid: number = process.ppid,
+): string | undefined {
+  try {
+    if (platform === "linux") return readFileSync(`/proc/${ppid}/comm`, "utf8").trim() || undefined;
+    if (platform === "darwin") {
+      const r = Bun.spawnSync(["ps", "-o", "comm=", "-p", String(ppid)], { stdout: "pipe", stderr: "ignore" });
+      const name = r.exitCode === 0 ? r.stdout.toString().trim() : "";
+      return name || undefined;
+    }
+  } catch {
+    /* fall through */
+  }
+  return undefined;
+}
+
+/** `fish` from `fish`, `-fish` (a login shell) or `/usr/local/bin/fish`. */
+export function shellNameOf(comm: string): string {
+  return posix.basename(comm.trim()).replace(/^-/, "");
+}
+
+const SH_LIKE = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash"]);
+
+/** What `claudep env` prints. PowerShell on Windows outside Git Bash. Then the
+ *  parent process decides when it is a shell claudep knows (fish, pwsh, or an
+ *  sh-like shell); otherwise the login shell in $SHELL: fish when that is
+ *  fish, sh for anything else. fish exports no marker a child could see,
+ *  which is why the parent is consulted at all. `--shell` overrides all of it. */
+export function shellSyntax(
+  env: Env = process.env,
+  platform: NodeJS.Platform = process.platform,
+  parent: string | undefined = undefined,
+): EnvSyntax {
+  if (platform === "win32" && !env.MSYSTEM) return "powershell";
+  const p = parent !== undefined ? shellNameOf(parent) : "";
+  if (p === "fish") return "fish";
+  if (p === "pwsh" || p === "powershell") return "powershell";
+  if (SH_LIKE.has(p)) return "sh";
+  return env.SHELL && posix.basename(env.SHELL) === "fish" ? "fish" : "sh";
+}
+
+/** The syntax for a `--shell` value: the shell-init names plus `sh`. */
+export function envSyntaxOf(name: string): EnvSyntax | undefined {
+  if (name === "sh" || name === "zsh" || name === "bash") return "sh";
+  if (name === "fish" || name === "powershell") return name;
+  return undefined;
+}
+
+/** fish single-quoting: only \ and ' are special inside single quotes. */
+export function fishQuote(s: string): string {
+  return `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
 }
 
 /** The `claudep env` script: pin the shell to `dir`, or clear the pin. */
@@ -1073,12 +1227,81 @@ export function envScript(dir: string | undefined, syntax: EnvSyntax): string {
     // Clearing CLAUDEP_AUTO turns this into a manual pin the shell hook will not touch.
     return `$env:CLAUDE_CONFIG_DIR = '${dir.replace(/'/g, "''")}'\nRemove-Item Env:CLAUDEP_AUTO -ErrorAction SilentlyContinue\n`;
   }
+  if (syntax === "fish") {
+    // A bare `set -e` on a missing name returns 1 and `source` reports its
+    // last status, which prompt themes paint red; the guard keeps it at 0.
+    if (dir === undefined)
+      return "not set -q CLAUDE_CONFIG_DIR; or set -e CLAUDE_CONFIG_DIR\nnot set -q CLAUDEP_AUTO; or set -e CLAUDEP_AUTO\n";
+    return `set -gx CLAUDE_CONFIG_DIR ${fishQuote(dir)}\nnot set -q CLAUDEP_AUTO; or set -e CLAUDEP_AUTO\n`;
+  }
   if (dir === undefined) return "unset CLAUDE_CONFIG_DIR CLAUDEP_AUTO\n";
   return `export CLAUDE_CONFIG_DIR='${dir.replace(/'/g, `'\\''`)}'\nunset CLAUDEP_AUTO\n`;
 }
 
 export function shellInit(shell: Shell, profilesRoot: string, platform: NodeJS.Platform = process.platform): string {
-  return shell === "powershell" ? powershellHook(profilesRoot) : shHook(shell, profilesRoot, platform);
+  if (shell === "powershell") return powershellHook(profilesRoot);
+  if (shell === "fish") return fishHook(profilesRoot);
+  return shHook(shell, profilesRoot, platform);
+}
+
+/** The fish hook. Builtins only (set, test, read, printf, string); every
+ *  `(...)` is a `string` builtin, which runs in-process. Needs fish 3.0:
+ *  `path dirname` would need 3.5 and `$(...)` 3.4, and Ubuntu 22.04 ships
+ *  3.3. fish fires --on-variable on every `set` of PWD, `cd .` included, so
+ *  the last-pwd dedupe stays. Not a Windows target; joins with `/`. */
+function fishHook(profilesRoot: string): string {
+  return `# claudep shell hook. Load it from ~/.config/fish/config.fish:  ${hookHint("fish")}
+set -g _claudep_root ${fishQuote(profilesRoot)}
+function _claudep_auto --on-variable PWD
+  test "$PWD" = "$_claudep_last_pwd"; and return 0
+  set -g _claudep_last_pwd $PWD
+  # Only manage a CLAUDE_CONFIG_DIR this hook set itself. A manual pin wins.
+  if test -n "$CLAUDE_CONFIG_DIR"; and test "$CLAUDE_CONFIG_DIR" != "$CLAUDEP_AUTO"
+    return 0
+  end
+  set -l dir $PWD
+  set -l name ''
+  set -l found ''
+  while true
+    if test -f "$dir/${PIN_FILE}"
+      set found $dir
+      test -n "$found"; or set found /
+      while read -l line
+        set line (string trim -- $line)
+        if test -z "$line"; or string match -q -- '#*' $line
+          continue
+        end
+        set name $line
+        break
+      end < "$dir/${PIN_FILE}"
+      break
+    end
+    if test -z "$dir"; or test "$dir" = /
+      break
+    end
+    set dir (string replace -r -- '/[^/]*$' '' $dir)
+  end
+  if test -z "$name"
+    # No pin here: hand the shell back to the base account.
+    if test -n "$CLAUDEP_AUTO"
+      set -e CLAUDE_CONFIG_DIR
+      set -e CLAUDEP_AUTO
+    end
+    return 0
+  end
+  if not test -d "$_claudep_root/$name"
+    if test -n "$CLAUDEP_AUTO"
+      set -e CLAUDE_CONFIG_DIR
+      set -e CLAUDEP_AUTO
+    end
+    printf 'claudep: %s/${PIN_FILE} names profile "%s", which does not exist. Run: claudep init %s\\n' "$found" "$name" "$name" >&2
+    return 0
+  end
+  set -gx CLAUDE_CONFIG_DIR "$_claudep_root/$name"
+  set -gx CLAUDEP_AUTO "$_claudep_root/$name"
+end
+_claudep_auto
+`;
 }
 
 /** The PowerShell hook, for Windows PowerShell 5.1 and PowerShell 7. Wraps
@@ -1196,7 +1419,7 @@ _claudep_auto
 
 function cmdShellInit(L: Layout, args: string[]): void {
   const shell = args[0] ?? defaultShell(process.env, L.platform);
-  if (!SHELLS.includes(shell as Shell)) die(`unsupported shell "${shell}". Use zsh, bash or powershell`);
+  if (!SHELLS.includes(shell as Shell)) die(`unsupported shell "${shell}". Use ${SHELLS.join(", ")}`);
   process.stdout.write(shellInit(shell as Shell, L.profilesRoot, L.platform));
 }
 
@@ -1209,6 +1432,7 @@ function msysConfigDirWarning(L: Layout, env: Env = process.env): string | undef
 
 async function cmdDoctor(L: Layout, args: string[]): Promise<void> {
   const names = args[0] ? [args[0]] : listProfileNames(L);
+  let problems = 0;
   const launch = findClaude();
   if (launch && launch.kind !== "ps1") {
     const { out } = await captureClaude(L, undefined, ["--version"]);
@@ -1217,11 +1441,29 @@ async function cmdDoctor(L: Layout, args: string[]): Promise<void> {
       console.log(
         `${c.dim("·")} claude is the npm cmd shim and runs through cmd.exe; the native installer's claude.exe avoids that hop`,
       );
+    const v = parseVersion(out);
+    const floor = parseVersion(MIN_CLAUDE_VERSION);
+    if (L.platform === "darwin" && v && floor && versionBelow(v, floor)) {
+      bad(
+        `Claude Code ${v.join(".")} is older than ${MIN_CLAUDE_VERSION}; every config dir shares one Keychain item there, so profiles cannot hold separate logins. Update Claude Code`,
+      );
+      problems++;
+    }
   } else if (launch) bad(`only ${launch.bin} found; claudep needs claude.exe or claude.cmd`);
   else bad("claude binary not found on PATH");
   ok(`base: ${L.base}${L.callerConfigDir && !L.managed ? c.yellow("  (from CLAUDE_CONFIG_DIR in your shell)") : ""}`);
   const msysWarning = msysConfigDirWarning(L);
   if (msysWarning) warn(msysWarning);
+  const settingsFile = join(L.base, "settings.json");
+  const pinnedInSettings = await settingsEnvConfigDir(settingsFile);
+  if (pinnedInSettings !== undefined) {
+    bad(
+      `${settingsFile} sets env.CLAUDE_CONFIG_DIR (${pinnedInSettings}). Claude Code disables features when that differs from the active dir, which it does in every profile. Remove it; pin shells with claudep env or a ${PIN_FILE} file instead`,
+    );
+    problems++;
+  }
+  for (const v of authEnvOverrides(process.env, L.platform))
+    warn(`${v} is set in this shell; Claude Code uses it instead of the profile login, always in -p mode`);
   ok(`profiles root: ${L.profilesRoot}`);
 
   const shared = sharedItems(L.base);
@@ -1235,7 +1477,6 @@ async function cmdDoctor(L: Layout, args: string[]): Promise<void> {
     warn(`base items neither shared nor known-private (they stay per-profile): ${unclassified.join(", ")}`);
   }
 
-  let problems = 0;
   for (const name of names) {
     const dir = profileDir(L, name);
     console.log(`\n${c.bold(name)}  ${c.dim(dir)}`);
@@ -1294,6 +1535,18 @@ async function cmdRm(L: Layout, args: string[]): Promise<void> {
     samePath(real, L.home, L.platform)
   )
     die(`refusing to remove ${real}: not inside ${L.profilesRoot}`);
+  const cur = currentProfile(L);
+  if (cur.kind === "profile" && cur.name === name) {
+    const unset = envUnsetHint(shellSyntax(process.env, L.platform, parentProcessName(L.platform)));
+    warn(
+      `this shell is on ${name} (${cur.setBy === "hook" ? "shell hook" : "manual pin"}). After removal run: ${unset}`,
+    );
+  }
+  const pin = resolvePin(process.cwd());
+  if (pin && pin.name === name)
+    warn(
+      `${shortHome(pin.file, L.home, L.platform)} pins this directory tree to ${name}. Remove it with: claudep local --remove`,
+    );
   if (!f.bools.has("--yes")) {
     const yes = confirm(`Remove profile "${name}" (${dir})? Shared items are only unlinked; ${L.base} is untouched.`);
     if (!yes) {
@@ -1335,12 +1588,13 @@ function help(L: Layout): void {
 ${c.bold("USAGE")}
   claudep <name> [claude args…]        run claude with profile <name>  (alias for "run")
   claudep init <name> [options]        create/update a profile and log in
-  claudep list                         show every profile and who it is logged in as
+  claudep list [--json]                show every profile and who it is logged in as
   claudep status <name> [--json]       login state for one profile ("default" = ~/.claude)
-  claudep current [--json]             which profile this shell is on, and why
-  claudep env <name> | --unset         print the CLAUDE_CONFIG_DIR export (or the unset) for eval / Invoke-Expression
+  claudep current [--json|--name]      which profile this shell is on, and why; --name prints only the name
+  claudep env <name> | --unset         print the CLAUDE_CONFIG_DIR pin (or the unset) for eval, source or Invoke-Expression;
+                                       --shell sh|fish|powershell picks the syntax when the shell was not detected
   claudep alias <name> <command>       write a shim so "<command>" == "claudep <name>"
-  claudep doctor [name]                verify symlinks, keychain entry, unclassified files
+  claudep doctor [name]                verify symlinks, keychain entry, unclassified files, Claude Code version
   claudep rm <name> [--keep-login]     log out and delete a profile (base is never touched)
   claudep --version                    print the version
 
@@ -1348,7 +1602,7 @@ ${c.bold("DIRECTORY PINS")}
   claudep local <name> [--force]       write ./${PIN_FILE} so this tree uses <name>; --remove deletes it
   claudep local                        show the pin that applies to the current directory
   claudep resolve [dir] [--json]       print the profile pinned for a directory (exit 1 when none)
-  claudep shell-init [zsh|bash|powershell]   print the hook that applies pins on cd; load it from your rc file
+  claudep shell-init [zsh|bash|fish|powershell]   print the hook that applies pins on cd; load it from your rc file
 
 ${c.bold("INIT OPTIONS")}
   --sso               force the SSO login flow (Enterprise orgs)
@@ -1365,9 +1619,11 @@ ${c.bold("EXAMPLES")}
   claude                                        # Claude Code as whatever ~/.claude is logged in as
   claudep enterprise -p "summarize this repo"
   eval "$(claudep env enterprise)"              # pin the whole shell to a profile
+  claudep env enterprise | source               # the same from fish
   claudep env enterprise | Invoke-Expression    # the same from PowerShell
   claudep local enterprise                      # pin this repo; commit the ${PIN_FILE} file for the team
   eval "$(claudep shell-init zsh)"              # in .zshrc: shells follow ${PIN_FILE} pins on cd
+  ${hookHint("fish")}              # the same line for config.fish
   ${hookHint("powershell")}   # the same line for $PROFILE
 
 ${c.bold("HOW IT WORKS")}
@@ -1416,7 +1672,7 @@ export async function main(argv: string[]): Promise<void> {
       return cmdRun(L, args);
     case "list":
     case "ls":
-      return cmdList(L);
+      return cmdList(L, args);
     case "status":
       return cmdStatus(L, args);
     case "env":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bordoni/claudep",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Unofficial, not affiliated with Anthropic. Run Claude Code under separate accounts on one machine (work + personal) with isolated logins and shared config.",
   "type": "module",
   "license": "MIT",