@efoo/ccprofile 0.1.0 → 0.1.2

package/README.md

@@ -1,9 +1,22 @@
 # ccprofile
 
-Per-directory Claude Code account routing via `CLAUDE_CODE_OAUTH_TOKEN`, direnv, and the macOS Keychain.
+Per-directory Claude Code account routing via `ANTHROPIC_AUTH_TOKEN`, direnv, and the macOS Keychain.
 
 `ccprofile` lets you run **multiple Claude Code accounts in parallel** — one per terminal, one per project — with zero manual switching. It never touches Claude Code's own Keychain entry, so there is no global "active account" to corrupt.
 
+## 🤖 Install with an AI agent
+
+Paste this prompt into Claude Code, Cursor, or any coding agent:
+
+```
+Install and configure ccprofile by following the instructions here:
+https://raw.githubusercontent.com/efoo-team/ccprofile/main/docs/install-for-agents.md
+```
+
+The agent will check prerequisites (direnv, hooks), install the CLI, ask
+whether you want shell completion, and walk you through registering accounts —
+only the browser OAuth step needs your hands.
+
 ## Why
 
 Claude Code stores its OAuth credentials in a single macOS Keychain entry, shared across every `CLAUDE_CONFIG_DIR` profile ([#20553](https://github.com/anthropics/claude-code/issues/20553)). Switcher-style tools work around this by swapping that entry in place — which breaks down the moment two sessions with different accounts run at the same time (in-session token refresh writes the old account back).
@@ -11,8 +24,8 @@ Claude Code stores its OAuth credentials in a single macOS Keychain entry, share
 `ccprofile` takes the declarative route instead:
 
 - Each account's **long-lived OAuth token** (`claude setup-token`, valid ~1 year) is stored in the Keychain under ccprofile's own namespace — one entry per profile, no sharing, no swapping.
-- `ccprofile link` writes a **self-contained `.envrc`** that exports `CLAUDE_CODE_OAUTH_TOKEN` straight from the Keychain. direnv activates it when you enter the directory. No node/npx in the hot path.
-- `CLAUDE_CODE_OAUTH_TOKEN` outranks the stored login in Claude Code's [documented auth precedence](https://code.claude.com/docs/en/authentication#authentication-precedence), so linked directories route to their account and everywhere else falls back to your normal `/login`.
+- `ccprofile link` writes a **self-contained `.envrc`** that exports the token as `ANTHROPIC_AUTH_TOKEN` straight from the Keychain. direnv activates it when you enter the directory. No node/npx in the hot path.
+- `ANTHROPIC_AUTH_TOKEN` outranks the stored login in Claude Code's [documented auth precedence](https://code.claude.com/docs/en/authentication#authentication-precedence), so linked directories route to their account and everywhere else falls back to your normal `/login`.
 
 Auth state lives in each process's environment — parallel sessions cannot interfere with each other by construction.
 
@@ -45,7 +58,7 @@ ccprofile link work
 ccprofile link work ~/src/my-project
 
 # 3. Done — any claude launched in that directory (and below) runs as "work"
-claude        # /status shows "Auth token: CLAUDE_CODE_OAUTH_TOKEN"
+claude        # /status shows "Auth token: ANTHROPIC_AUTH_TOKEN"
 ```
 
 Repeat with `ccprofile add personal` etc. Different terminals in different directories run different accounts concurrently.
@@ -60,7 +73,7 @@ Repeat with `ccprofile add personal` etc. Different terminals in different direc
 | `ccprofile unlink [dir]` | Remove the managed block (deletes `.envrc` if nothing else remains) |
 | `ccprofile token <name>` | Print the stored token to stdout (for scripting — handle with care) |
 | `ccprofile remove <name>` | Delete the profile and its Keychain entry |
-| `ccprofile doctor [dir]` | Diagnose overriding env vars (`ANTHROPIC_API_KEY` etc.), `apiKeyHelper`, expiry, token liveness, broken links. `--offline` skips the server probe |
+| `ccprofile doctor [dir]` | Diagnose provider overrides, stale/missing active token env, expiry, token liveness, broken links. `--offline` skips the server probe |
 | `ccprofile completion <shell>` | Print a completion script for fish, zsh, or bash |
 
 ## Shell completion
@@ -89,7 +102,10 @@ macOS Keychain               service "ccprofile", one entry per profile (the sec
 
   # >>> ccprofile managed >>>
   # profile: work
-  export CLAUDE_CODE_OAUTH_TOKEN="$(security find-generic-password -w -s 'ccprofile' -a 'work' 2>/dev/null)"
+  _ccprofile_token="$(security find-generic-password -w -s 'ccprofile' -a 'work' 2>/dev/null)"
+  export ANTHROPIC_AUTH_TOKEN="$_ccprofile_token"
+  unset CLAUDE_CODE_OAUTH_TOKEN
+  unset _ccprofile_token
   # <<< ccprofile managed <<<
 ```
 
@@ -97,6 +113,7 @@ Notes:
 
 - Tokens are written to the Keychain via `security -i` (stdin), so secrets never appear in `ps` output.
 - The `.envrc` block is **self-contained**: direnv re-evaluates it on every directory entry, and it must stay fast and dependency-free. ccprofile is only needed for CRUD operations.
+- Claude Code v2.1.199 treats `CLAUDE_CODE_OAUTH_TOKEN` as suitable for SDK/non-interactive automation, but interactive TUI sessions still consult `/login` account policy and quota. ccprofile therefore injects the same setup-token as `ANTHROPIC_AUTH_TOKEN`, which the interactive TUI uses as the active bearer token.
 - Add `.envrc` to your project's `.gitignore` — it is machine-local.
 
 ## Limitations — the price of parallel accounts
@@ -108,10 +125,8 @@ ccprofile is built on `claude setup-token`, whose long-lived tokens are **delibe
 - **`/status` → Usage tab shows no plan utilization** in token-authenticated sessions (same scope restriction). Check usage on claude.ai instead.
 - **Remote Control is unavailable** in token-authenticated sessions; it requires a full-scope login token.
 - **Tokens last up to 1 year but can die earlier** (password change, logout-all). The recorded expiry is a hint, not a guarantee — `ccprofile doctor` probes the server and tells live tokens apart from revoked ones.
-- **`claude --bare` does not read `CLAUDE_CODE_OAUTH_TOKEN`.**
-- **Subscription accounting:** from June 15, 2026, `claude -p` / Agent SDK usage on subscription plans draws from a separate monthly Agent SDK credit.
-- **direnv only sees shell-launched processes.** Apps started outside a hooked shell (GUI launchers) bypass the routing.
-- **Higher-precedence auth wins silently.** `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `apiKeyHelper`, and Bedrock/Vertex/Foundry env vars all outrank the token — `ccprofile doctor` flags them.
+- **Routing only applies to shell-launched processes.** direnv activates the token when a hooked shell enters the directory; apps launched outside a hooked shell (GUI launchers) bypass it.
+- **Cloud provider auth wins silently.** Bedrock/Vertex/Foundry env vars outrank `ANTHROPIC_AUTH_TOKEN`; `ccprofile doctor` flags them.
 - **macOS only** for now (the token store is the macOS Keychain).
 
 ## Development
@@ -123,6 +138,22 @@ pnpm test        # vitest
 node dist/index.js --help
 ```
 
+## Release
+
+Releases are automated with GitHub Actions + semantic-release.
+
+- Merging to `main` runs CI and then `semantic-release`.
+- Versioning is derived from Conventional Commits:
+  - `fix:` / `perf:` -> patch release
+  - `feat:` -> minor release
+  - `feat!:` or `BREAKING CHANGE:` -> major release
+  - `docs:` / `test:` / `ci:` / `chore:` -> no npm release
+- Do not manually edit `package.json` version for normal releases; semantic-release updates the published package version.
+- npm publishing uses trusted publishing (OIDC). Configure npm package `@efoo/ccprofile` with GitHub trusted publisher:
+  - repository: `efoo-team/ccprofile`
+  - workflow: `.github/workflows/release.yml`
+  - environment: none
+
 ## License
 
 MIT

package/dist/commands/add.js

@@ -68,6 +68,9 @@ export async function addCommand(argv) {
     saveConfig(config);
     console.log(ok(`Profile ${bold(name)} saved (Keychain: ${KEYCHAIN_SERVICE}/${name}).`));
     console.log(dim(`Token recorded as expiring at ${expiresAt} (setup-token issues 1-year tokens).`));
+    if (values.force) {
+        console.log(warn("Existing shells in linked directories may still export the old token. Run `direnv reload` there and restart Claude Code."));
+    }
     console.log(`\nNext: route a project directory to this account:\n  ${cyan(`ccprofile link ${name} <project-dir>`)}`);
     return 0;
 }

package/dist/commands/doctor.js

@@ -9,16 +9,14 @@ import { Keychain } from "../lib/keychain.js";
 import { probeToken } from "../lib/probe.js";
 import { bold, fail, ok, warn } from "../lib/format.js";
 /**
- * Env vars that outrank CLAUDE_CODE_OAUTH_TOKEN in Claude Code's documented
- * authentication precedence. If any is set, ccprofile routing is silently
- * bypassed — that is the failure mode this command exists to catch.
+ * Env vars that outrank ccprofile's managed ANTHROPIC_AUTH_TOKEN in Claude
+ * Code's documented authentication precedence. If any is set, ccprofile
+ * routing is bypassed before the token is considered.
  */
 const OVERRIDING_ENV_VARS = [
     "CLAUDE_CODE_USE_BEDROCK",
     "CLAUDE_CODE_USE_VERTEX",
     "CLAUDE_CODE_USE_FOUNDRY",
-    "ANTHROPIC_AUTH_TOKEN",
-    "ANTHROPIC_API_KEY",
 ];
 export async function doctorCommand(argv) {
     const { values, positionals } = parseArgs({
@@ -53,7 +51,7 @@ export async function doctorCommand(argv) {
     }
     for (const envVar of OVERRIDING_ENV_VARS) {
         if (process.env[envVar] !== undefined) {
-            console.log(fail(`${envVar} is set: it overrides CLAUDE_CODE_OAUTH_TOKEN and bypasses ccprofile routing.`));
+            console.log(fail(`${envVar} is set: it overrides ANTHROPIC_AUTH_TOKEN and bypasses ccprofile routing.`));
             problems += 1;
         }
     }
@@ -63,8 +61,8 @@ export async function doctorCommand(argv) {
         try {
             const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
             if (settings.apiKeyHelper !== undefined) {
-                console.log(fail(`apiKeyHelper is configured in ${settingsPath}: it overrides CLAUDE_CODE_OAUTH_TOKEN.`));
-                problems += 1;
+                console.log(warn(`apiKeyHelper is configured in ${settingsPath}; linked ccprofile directories use ANTHROPIC_AUTH_TOKEN, which takes precedence.`));
+                warnings += 1;
             }
         }
         catch {
@@ -125,6 +123,24 @@ export async function doctorCommand(argv) {
         }
         else if (config.profiles[linked]) {
             console.log(ok(`${bold(dir)} is linked to profile "${linked}".`));
+            if (dir === resolve(process.cwd())) {
+                const linkedProfile = config.profiles[linked];
+                const exportedToken = process.env.ANTHROPIC_AUTH_TOKEN;
+                if (exportedToken === undefined) {
+                    console.log(fail("Current shell does not export ANTHROPIC_AUTH_TOKEN. Run: direnv reload"));
+                    problems += 1;
+                }
+                else {
+                    const linkedToken = await keychain.getToken(linkedProfile.keychain.service, linkedProfile.keychain.account);
+                    if (linkedToken !== null && exportedToken !== linkedToken) {
+                        console.log(fail(`Current shell exports a different ANTHROPIC_AUTH_TOKEN than profile "${linked}". Run: direnv reload, then restart Claude Code.`));
+                        problems += 1;
+                    }
+                    else if (linkedToken !== null) {
+                        console.log(ok(`Current shell exports profile "${linked}" token via ANTHROPIC_AUTH_TOKEN.`));
+                    }
+                }
+            }
         }
         else {
             console.log(fail(`${envrcPath} references unknown profile "${linked}". Run: ccprofile link <profile> ${dir}`));

package/dist/index.js

@@ -29,7 +29,7 @@ ${bold("Commands")}
 ${bold("Typical flow")}
   ccprofile add work --email you@company.example
   ccprofile link work ~/src/my-project
-  cd ~/src/my-project && claude   # runs as "work" via CLAUDE_CODE_OAUTH_TOKEN
+  cd ~/src/my-project && claude   # runs as "work" via ANTHROPIC_AUTH_TOKEN
 `;
 async function main() {
     const [command, ...rest] = process.argv.slice(2);

package/dist/lib/envrc.js

@@ -12,7 +12,10 @@ export function renderBlock(profile, service, account) {
     return [
         BEGIN,
         `# profile: ${profile}`,
-        `export CLAUDE_CODE_OAUTH_TOKEN="$(security find-generic-password -w -s '${service}' -a '${account}' 2>/dev/null)"`,
+        `_ccprofile_token="$(security find-generic-password -w -s '${service}' -a '${account}' 2>/dev/null)"`,
+        `export ANTHROPIC_AUTH_TOKEN="$_ccprofile_token"`,
+        `unset CLAUDE_CODE_OAUTH_TOKEN`,
+        `unset _ccprofile_token`,
         END,
         "",
     ].join("\n");

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@efoo/ccprofile",
-  "version": "0.1.0",
-  "description": "Per-directory Claude Code account routing via CLAUDE_CODE_OAUTH_TOKEN, direnv, and macOS Keychain",
+  "version": "0.1.2",
+  "description": "Per-directory Claude Code account routing via ANTHROPIC_AUTH_TOKEN, direnv, and macOS Keychain",
   "type": "module",
+  "packageManager": "pnpm@10.33.4",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -38,10 +39,16 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
+    "release": "semantic-release",
     "prepublishOnly": "pnpm run build"
   },
   "devDependencies": {
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/github": "^12.0.9",
+    "@semantic-release/npm": "^13.1.5",
+    "@semantic-release/release-notes-generator": "^14.1.1",
     "@types/node": "^22.10.0",
+    "semantic-release": "^25.0.5",
     "typescript": "^5.7.0",
     "vitest": "^3.0.0"
   }