@event4u/agent-switch 2.1.0 → 2.3.0

package/dist/desktop-settings.js

@@ -0,0 +1,90 @@
+/**
+ * Copy one desktop profile's local settings into another (Claude Desktop):
+ * MCP servers, preferences and installed extensions. Chats, Projects and
+ * memory live with the account on the server, so they are not here at all.
+ *
+ * What is never copied: `config.json` (it holds the OAuth token cache),
+ * cookies and web storage (the login), session folders (bound to an account
+ * id), and preference keys scoped to one account (`…ByAccount`) or to the
+ * target's own files (`coworkUserFilesPath`).
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+const LAYOUTS = {
+    "claude-desktop": {
+        merged: ["claude_desktop_config.json", "claude_desktop_config.mcp.json"],
+        replaced: ["Claude Extensions", "Claude Extensions Settings"],
+    },
+};
+/** The app's own data dir outside agent-switch (the plain, unprofiled install). */
+export const DEFAULT_DATA_DIR = {
+    "claude-desktop": path.posix.join(os.homedir(), "Library", "Application Support", "Claude"),
+};
+export function hasSettingsLayout(appId) {
+    return appId in LAYOUTS;
+}
+function isObject(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v);
+}
+export function mergeDesktopConfig(src, dst) {
+    const out = { ...dst };
+    if (src.mcpServers !== undefined)
+        out.mcpServers = src.mcpServers;
+    if (isObject(src.preferences)) {
+        const prefs = isObject(dst.preferences) ? { ...dst.preferences } : {};
+        for (const [k, v] of Object.entries(src.preferences))
+            if (!k.endsWith("ByAccount"))
+                prefs[k] = v;
+        out.preferences = prefs;
+    }
+    return out;
+}
+function readJson(file) {
+    try {
+        const v = JSON.parse(fs.readFileSync(file, "utf8"));
+        return isObject(v) ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+function backup(file) {
+    let to = `${file}.pre-copy`;
+    if (fs.existsSync(to))
+        to = `${file}.pre-copy-${Date.now()}`;
+    fs.cpSync(file, to, { recursive: true });
+    return to;
+}
+export function copyDesktopSettings(appId, fromDir, toDir) {
+    const layout = LAYOUTS[appId];
+    if (!layout)
+        throw new Error(`${appId} has no settings layout agent-switch knows how to copy.`);
+    fs.mkdirSync(toDir, { recursive: true });
+    const copied = [];
+    const backups = [];
+    for (const name of layout.merged) {
+        const src = readJson(path.join(fromDir, name));
+        if (!src)
+            continue;
+        const dstFile = path.join(toDir, name);
+        const dst = fs.existsSync(dstFile) ? readJson(dstFile) : null;
+        if (fs.existsSync(dstFile))
+            backups.push(backup(dstFile));
+        fs.writeFileSync(dstFile, JSON.stringify(mergeDesktopConfig(src, dst ?? {}), null, 2) + "\n");
+        copied.push(name);
+    }
+    for (const name of layout.replaced) {
+        const src = path.join(fromDir, name);
+        if (!fs.existsSync(src))
+            continue;
+        const dst = path.join(toDir, name);
+        if (fs.existsSync(dst)) {
+            backups.push(backup(dst));
+            fs.rmSync(dst, { recursive: true, force: true });
+        }
+        fs.cpSync(src, dst, { recursive: true });
+        copied.push(name);
+    }
+    return { copied, backups };
+}

package/dist/dir-resolve.js

@@ -0,0 +1,178 @@
+/**
+ * Which profile a new session in a folder gets, and why — the logic behind
+ * `agent-switch dir` (the shell wrapper's hot path) and `dir --json`.
+ *
+ * Order: folder rule (to a profile, or to a pool) > balanced plain start > active
+ * profile > none. A rule never resolves outside itself: a disabled or missing
+ * profile, like a pool that cannot serve, refuses the start (`blocked`).
+ * A pool resolves to the member with the most headroom on FRESH cached usage.
+ * Unknown usage is never treated as free: a member whose usage is older than
+ * {@link FRESH_USAGE_MS}, missing, or who is signed out is skipped. A pool rule
+ * never leaves its pool: with no fresh member it takes a usable member anyway,
+ * and when the pool is gone or has no usable member the start is refused
+ * (`blocked`) rather than run on an account outside it. No
+ * network call happens here — only the cache the daemon / `status` already wrote.
+ * The background service (`agent-switch service`) is what keeps that cache
+ * fresh for pool members: it polls every member of a pool a folder rule targets.
+ *
+ * Live sessions: under guard `block` a member that already holds a live
+ * session is skipped (starting there would be refused). Otherwise a free member
+ * wins a headroom tie over a busy one, and a busy pick is called out.
+ */
+import { describe, level, weigh } from "./balance.js";
+import { isPoolRef, poolIdOf, parseMember } from "./pools.js";
+export const FRESH_USAGE_MS = 10 * 60_000;
+export const DEFAULT_LIMIT_PCT = 95;
+export function ago(ms) {
+    const s = Math.max(0, Math.round(ms / 1000));
+    if (s < 60)
+        return "just now";
+    const m = Math.round(s / 60);
+    if (m < 60)
+        return `${m} min ago`;
+    const h = Math.round(m / 60);
+    return h < 48 ? `${h} h ago` : `${Math.round(h / 24)} days ago`;
+}
+function fallbackToActive(i, why) {
+    if (i.active && i.exists(i.active)) {
+        why.push(`Using the active profile ${i.providerId}/${i.active}`);
+        return { name: i.active, why };
+    }
+    why.push("No active profile — the tool starts with its own default login");
+    return { name: null, why };
+}
+function refuse(why, reason) {
+    why.push(`Refused: ${reason}`);
+    return { name: null, why, blocked: reason };
+}
+export function resolveForDir(i) {
+    const shown = (p) => (i.displayPath ? i.displayPath(p) : p);
+    const why = [];
+    if (i.mapping && isPoolRef(i.mapping.name)) {
+        const id = poolIdOf(i.mapping.name);
+        why.push(`Rule: folder ${shown(i.mapping.path)} → pool ${id}`);
+        const pool = i.pool(id);
+        if (!pool)
+            return refuse(why, `pool ${id} no longer exists — bind the folder anew or remove the rule (agent-switch unmap)`);
+        const considered = pool.members.map(parseMember).filter((m) => m && m.provider === i.providerId);
+        if (considered.length === 0)
+            return refuse(why, `pool ${id} has no ${i.providerId} profile — add one with agent-switch pool add`);
+        const members = considered.map((m) => m.name);
+        const best = pickBalanced(i, members, why, null);
+        if (best)
+            return { name: best, why };
+        // No fresh numbers to weigh: still a member — the rule is a boundary first.
+        const usable = (n) => i.exists(n) && !i.disabled?.(n) && !i.sharesDefaultLogin?.(n) && i.signedIn(n) && !(i.guard === "block" && (i.live?.(n) ?? false));
+        const anyone = members.filter(usable);
+        if (!anyone.length)
+            return refuse(why, `pool ${id} has no usable ${i.providerId} member (signed out, disabled, busy or sharing the default login)`);
+        why.push(`No member of pool ${id} has fresh usage`);
+        why.push("Usage comes from the background service or the open desktop app — keep one running (agent-switch service install)");
+        if (i.active && anyone.includes(i.active)) {
+            why.push(`Using the plain-start account ${i.providerId}/${i.active}, a member of pool ${id}`);
+            return { name: i.active, why };
+        }
+        why.push(`Using ${i.providerId}/${anyone[0]}, the first usable member of pool ${id}`);
+        return { name: anyone[0], why };
+    }
+    // A rule to one account is a boundary too: never another account in its place.
+    if (i.mapping) {
+        const key = `${i.providerId}/${i.mapping.name}`;
+        const flag = i.providerId === "claude" ? "" : ` --provider ${i.providerId}`;
+        why.push(`Rule: folder ${shown(i.mapping.path)} → ${key}`);
+        if (!i.exists(i.mapping.name))
+            return refuse(why, `${key} no longer exists — bind the folder anew (agent-switch map) or remove the rule (agent-switch unmap)`);
+        if (i.disabled?.(i.mapping.name))
+            return refuse(why, `${key} is disabled — turn it back on (agent-switch enable ${i.mapping.name}${flag}) or change the rule`);
+        return { name: i.mapping.name, why };
+    }
+    return balancePlain(i, why);
+}
+/** No rule decides: balance across all profiles, or the active one when the
+ *  caller gave no profile list. */
+function balancePlain(i, why) {
+    if (!i.names)
+        return fallbackToActive(i, why);
+    const n = i.names.length;
+    why.push(`No folder rule — balancing across ${n} ${i.providerId} account${n === 1 ? "" : "s"} by what each would lose at its reset`);
+    const best = pickBalanced(i, i.names, why, i.active);
+    if (best)
+        return { name: best, why };
+    why.push("No account has fresh usage to weigh — using the plain-start account");
+    return fallbackToActive(i, why);
+}
+/**
+ * The candidate that would lose the most at its reset (see balance.ts), after
+ * dropping every profile that can't take work. A level tie goes to `prefer`
+ * (the plain-start account), then to one without a live session.
+ */
+function pickBalanced(i, names, why, prefer) {
+    const isLive = i.live ?? (() => false);
+    const guard = i.guard ?? "off";
+    const picks = [];
+    for (const name of names) {
+        const key = `${i.providerId}/${name}`;
+        if (!i.exists(name)) {
+            why.push(`Skipped ${key}: profile not found`);
+            continue;
+        }
+        if (i.disabled?.(name)) {
+            why.push(`Skipped ${key}: disabled`);
+            continue;
+        }
+        if (i.sharesDefaultLogin?.(name)) {
+            why.push(`Skipped ${key}: shares its login with the default install`);
+            continue;
+        }
+        if (!i.signedIn(name)) {
+            why.push(`Skipped ${key}: signed out`);
+            continue;
+        }
+        const live = isLive(name);
+        if (live && guard === "block") {
+            why.push(`Skipped ${key}: already has a live session (guard: block would refuse it)`);
+            continue;
+        }
+        const u = i.usage(name);
+        if (u.capturedMs === null || !u.snapshot) {
+            why.push(`Skipped ${key}: usage unknown`);
+            continue;
+        }
+        const ageMs = i.now - u.capturedMs;
+        if (ageMs > FRESH_USAGE_MS) {
+            why.push(`Skipped ${key}: usage checked ${ago(ageMs)} (too old to trust)`);
+            continue;
+        }
+        const w = weigh(u.snapshot, i.now, i.threshold?.(name) ?? DEFAULT_LIMIT_PCT);
+        if (!w.usable) {
+            why.push(`Skipped ${key}: ${w.why}`);
+            continue;
+        }
+        picks.push({ name, w, live, ageMs });
+    }
+    if (!picks.length)
+        return null;
+    const top = picks.reduce((a, b) => (b.w.need > a.w.need ? b : a));
+    const tied = picks.filter((p) => level(p.w.need, top.w.need));
+    let chosen = top;
+    if (tied.length > 1) {
+        const free = tied.filter((p) => !p.live);
+        const roomiest = (ps) => ps.reduce((a, b) => (b.w.peak < a.w.peak ? b : a));
+        chosen = tied.find((p) => p.name === prefer) ?? (free.length ? roomiest(free) : roomiest(tied));
+        const keys = tied.map((p) => `${i.providerId}/${p.name}`).join(", ");
+        const by = chosen.name === prefer
+            ? "the plain-start account"
+            : !chosen.live && tied.some((p) => p.live)
+                ? "the one without a live session"
+                : tied.some((p) => p.w.peak !== chosen.w.peak)
+                    ? "the one with the most room right now"
+                    : "the first of them";
+        why.push(`${keys} are level (${top.w.need.toFixed(1)} %/h) — taking ${by}, ${i.providerId}/${chosen.name}`);
+    }
+    const runnerUp = picks.filter((p) => p !== chosen).reduce((a, b) => (!a || b.w.need > a.w.need ? b : a), null);
+    if (chosen.live)
+        why.push(`Note: ${i.providerId}/${chosen.name} already has a live session (guard: ${guard})`);
+    why.push(`Picked ${describe(`${i.providerId}/${chosen.name}`, chosen.w)} · usage checked ${ago(chosen.ageMs)}` +
+        (runnerUp && tied.length === 1 ? ` — ahead of ${i.providerId}/${runnerUp.name} (${runnerUp.w.need.toFixed(1)} %/h)` : ""));
+    return chosen.name;
+}

package/dist/doctor.js

@@ -1,21 +1,146 @@
 /**
- * `agent-switch doctor` — a per-OS, per-provider self-check.
+ * `agent-switch doctor [--json]` — a per-OS, per-provider self-check.
  *
- * Reports health with actionable fixes and returns an exit code: 0 when there
- * is no hard error, 1 when a provider that has profiles is missing its binary.
- * Read-only — it never mutates a profile.
+ * Every finding is a {@link DoctorCheck} (`id, status, title, detail, fix?`);
+ * the text output and `--json` render the same list. The exit code is 1 only
+ * on a hard error (a provider with profiles but no binary). Read-only — it never
+ * mutates a profile, and it never prints a credential or an env var's value.
  */
 import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
-import { ROOT, activeFor, configDir, listProfiles, profileExists, readGuard } from "./profiles.js";
+import * as os from "node:os";
+import * as path from "node:path";
+import { ROOT, activeFor, configDir, identity, listProfiles, profileExists, readGuard, sharesDefaultLogin } from "./profiles.js";
 import { allProviders } from "./providers.js";
 import { credentialStore } from "./credentials.js";
 import { sharedLinkHealth } from "./share.js";
 import { checkAuth, liveSessionPids } from "./api.js";
 import { checkTooling, doctorToolingLine } from "./tooling.js";
-const OK = "✅";
-const WARN = "⚠️";
-const ERR = "❌";
+import { readGuiSettings } from "./gui-settings.js";
+/**
+ * Env vars that make a provider CLI ignore the profile's login and use a key
+ * or token from the environment instead (D5) — the same credential in every
+ * profile, often billed per use. Only the NAMES are ever reported.
+ */
+export const AUTH_OVERRIDE_ENV = {
+    ANTHROPIC_API_KEY: "claude",
+    ANTHROPIC_AUTH_TOKEN: "claude",
+    CLAUDE_CODE_OAUTH_TOKEN: "claude",
+    OPENAI_API_KEY: "codex",
+    CODEX_API_KEY: "codex",
+    GEMINI_API_KEY: "antigravity",
+    GOOGLE_API_KEY: "antigravity",
+};
+export function apiKeyOverrideCheck(env = process.env) {
+    const set = Object.keys(AUTH_OVERRIDE_ENV).filter((k) => typeof env[k] === "string" && env[k] !== "");
+    if (set.length === 0) {
+        return { id: "api-key-overrides", status: "ok", title: "No API-key overrides", detail: "No provider key or token is set in the environment, so each profile uses its own login." };
+    }
+    const which = set.map((k) => `${k} (${AUTH_OVERRIDE_ENV[k]})`).join(", ");
+    return {
+        id: "api-key-overrides",
+        status: "warn",
+        title: "API key overrides profile logins",
+        detail: `${which} is set in the environment agent-switch runs in. The provider uses it instead of the profile's login — the same credential in every profile, usually billed per use.`,
+        fix: `Unset it in your shell profile (e.g. \`unset ${set[0]}\`) unless you mean to use a key.`,
+    };
+}
+/** Is `agent-switch` reachable on PATH (the shell wrapper and the GUI call it by name)? */
+export function cliOnPathCheck(env = process.env, platform = process.platform, exists = fs.existsSync) {
+    const dirs = (env.PATH ?? env.Path ?? "").split(platform === "win32" ? ";" : ":").filter(Boolean);
+    const names = platform === "win32" ? ["agent-switch.cmd", "agent-switch.exe", "agent-switch"] : ["agent-switch"];
+    const hit = dirs.flatMap((d) => names.map((n) => path.join(d, n))).find(exists);
+    return hit
+        ? { id: "cli-on-path", status: "ok", title: "agent-switch is on PATH", detail: hit }
+        : {
+            id: "cli-on-path",
+            status: "warn",
+            title: "agent-switch is not on PATH",
+            detail: "The shell wrapper and the desktop app call `agent-switch` by name.",
+            fix: "npm install -g @event4u/agent-switch",
+        };
+}
+function rcCandidates(home) {
+    return [
+        path.join(home, ".zshrc"),
+        path.join(home, ".bashrc"),
+        path.join(home, ".bash_profile"),
+        path.join(home, ".profile"),
+        path.join(home, ".config", "fish", "config.fish"),
+        path.join(home, "Documents", "PowerShell", "Microsoft.PowerShell_profile.ps1"),
+        path.join(home, "Documents", "WindowsPowerShell", "Microsoft.PowerShell_profile.ps1"),
+    ];
+}
+export function shellIntegrationCheck(home = os.homedir(), read = readOrNull) {
+    const found = rcCandidates(home).find((f) => /agent-switch\s+shellenv/.test(read(f) ?? ""));
+    return found
+        ? { id: "shell-integration", status: "ok", title: "Shell integration installed", detail: `Loaded from ${found}.` }
+        : {
+            id: "shell-integration",
+            status: "warn",
+            title: "Shell integration not found",
+            detail: "Without it, `claude`/`codex`/`agy` in a terminal ignore the active profile and folder rules. (Checked the usual zsh, bash, fish and PowerShell profile files.)",
+            fix: 'Run `agent-switch shellenv install` — it adds `eval "$(agent-switch shellenv)"` (or your shell\'s equivalent) to your shell profile.',
+        };
+}
+export function autostartCheck(s) {
+    const a = s.autostart;
+    if (a.state === "enabled") {
+        return { id: "autostart", status: "ok", title: "Starts at login", detail: a.by === "user" ? "Turned on by you." : "On by default since the first launch." };
+    }
+    if (a.state === "disabled") {
+        return { id: "autostart", status: "info", title: "Does not start at login", detail: "Turned off by you; updates keep it off." };
+    }
+    if (s.autostartDegraded) {
+        return {
+            id: "autostart",
+            status: "warn",
+            title: "Start at login could not be confirmed",
+            detail: `The desktop app tried to turn it on but the system did not confirm it (${s.autostartDegraded.reason}). It retries on the next launch.`,
+            fix: "Open the desktop app → Settings → turn on start at login.",
+        };
+    }
+    return { id: "autostart", status: "info", title: "Start at login not set up yet", detail: "The desktop app turns it on at its first launch (default on)." };
+}
+export function antigravityOsCheck(platform = process.platform) {
+    return platform === "darwin"
+        ? { id: "antigravity-os", status: "ok", title: "Antigravity supported on this OS", detail: "Per-profile keychain and account readout work on macOS." }
+        : {
+            id: "antigravity-os",
+            status: "warn",
+            title: "Antigravity is only partly supported here",
+            detail: `On ${platform} agent-switch isolates agy's HOME per profile but cannot read which account is signed in or seed a per-profile keychain — both are macOS-only today.`,
+        };
+}
+/** Two profiles of one provider signed into the same account defeat the isolation. */
+export function signInIsolationCheck(rows) {
+    const seen = new Map();
+    for (const r of rows) {
+        if (!r.identity)
+            continue;
+        const k = `${r.provider}\u0000${r.identity.toLowerCase()}`;
+        seen.set(k, [...(seen.get(k) ?? []), `${r.provider}/${r.name}`]);
+    }
+    const dupes = [...seen.values()].filter((v) => v.length > 1);
+    if (dupes.length === 0) {
+        return { id: "sign-in-isolation", status: "ok", title: "Each profile has its own account", detail: "No two profiles of one provider are signed into the same account (where the account is readable)." };
+    }
+    return {
+        id: "sign-in-isolation",
+        status: "warn",
+        title: "Profiles share an account",
+        detail: `Signed into the same account: ${dupes.map((d) => d.join(" + ")).join("; ")}. They share one set of usage limits.`,
+        fix: "Sign one of them into a different account, or remove the duplicate.",
+    };
+}
+function readOrNull(p) {
+    try {
+        return fs.readFileSync(p, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
 function binaryOnPath(binary) {
     // Timeout so a hung binary can't hang the doctor.
     const probe = spawnSync(binary, ["--version"], { stdio: "ignore", timeout: 5000 });
@@ -37,42 +162,30 @@ function credentialReadable(p, name) {
         return false;
     }
 }
-export async function runDoctor() {
-    let hardError = false;
-    const line = (mark, msg) => console.log(`${mark}  ${msg}`);
-    console.log(`agent-switch doctor — platform ${process.platform}, node ${process.version}`);
-    console.log(process.platform === "darwin"
-        ? "  claude credential store: macOS Keychain (hashed per config dir), file fallback"
-        : "  claude credential store: plaintext .credentials.json per profile");
-    console.log("");
+async function providerChecks(checks) {
     for (const p of allProviders()) {
         const names = listProfiles(p.id);
         const onPath = binaryOnPath(p.binary);
+        const addHint = `agent-switch add <name>${p.id === "claude" ? "" : ` --provider ${p.id}`}`;
         if (onPath === "no") {
-            if (names.length > 0) {
-                line(ERR, `\`${p.binary}\` not on PATH but ${names.length} ${p.id} profile(s) exist — install ${p.id}.`);
-                hardError = true;
-            }
-            else {
-                line(WARN, `\`${p.binary}\` not on PATH (no ${p.id} profiles yet — fine unless you use ${p.id}).`);
-            }
+            checks.push(names.length > 0
+                ? { id: `binary-${p.id}`, status: "error", title: `\`${p.binary}\` not on PATH`, detail: `${names.length} ${p.id} profile(s) exist but the CLI is missing.`, fix: `Install ${p.id}, or link it: agent-switch providers link --provider ${p.id} --path <path>` }
+                : { id: `binary-${p.id}`, status: "info", title: `\`${p.binary}\` not on PATH`, detail: `No ${p.id} profiles yet — fine unless you use ${p.id}.` });
             continue;
         }
-        if (onPath === "error")
-            line(WARN, `could not probe \`${p.binary} --version\`.`);
-        else
-            line(OK, `\`${p.binary}\` is on PATH.`);
+        checks.push(onPath === "error"
+            ? { id: `binary-${p.id}`, status: "warn", title: `Could not probe \`${p.binary} --version\``, detail: "The binary exists but did not answer." }
+            : { id: `binary-${p.id}`, status: "ok", title: `\`${p.binary}\` is on PATH`, detail: "" });
         if (names.length === 0) {
-            line(WARN, `  no ${p.id} profiles yet — \`agent-switch add <name>${p.id === "claude" ? "" : ` --provider ${p.id}`}\`.`);
+            checks.push({ id: `profiles-${p.id}`, status: "info", title: `No ${p.id} profiles yet`, detail: "", fix: addHint });
             continue;
         }
-        line(OK, `  ${names.length} ${p.id} profile(s): ${names.join(", ")}.`);
+        checks.push({ id: `profiles-${p.id}`, status: "ok", title: `${names.length} ${p.id} profile(s)`, detail: names.join(", ") });
         const active = activeFor(p.id);
         if (active && !profileExists(p.id, active)) {
-            line(WARN, `  active ${p.id} profile "${active}" no longer exists.`);
+            checks.push({ id: `active-${p.id}`, status: "warn", title: `Active ${p.id} profile "${active}" no longer exists`, detail: "", fix: `agent-switch use <name>${p.id === "claude" ? "" : ` --provider ${p.id}`}` });
         }
-        // Login validity (Claude only): probe readable credentials in parallel, so
-        // an expired login is caught here instead of failing silently at next use.
+        // Login validity (Claude only): probe readable credentials in parallel.
         // Read-only; offline / transient degrades to a neutral note, never a WARN.
         const authByName = new Map();
         if (p.id === "claude") {
@@ -81,23 +194,66 @@ export async function runDoctor() {
             readable.forEach((n, i) => authByName.set(n, states[i]));
         }
         for (const n of names) {
+            const id = `login-${p.id}-${n}`;
+            const run = `agent-switch run ${n}${p.id === "claude" ? "" : ` --provider ${p.id}`}`;
             if (!credentialReadable(p, n)) {
-                line(WARN, `  ${p.id}/${n}: credential not readable — \`agent-switch run ${n}${p.id === "claude" ? "" : ` --provider ${p.id}`}\` and log in.`);
+                checks.push({ id, status: "warn", title: `${p.id}/${n}: no readable login`, detail: "", fix: `${run} and sign in` });
                 continue;
             }
             const auth = authByName.get(n);
-            if (auth === "expired") {
-                line(WARN, `  ${p.id}/${n}: login expired — \`agent-switch run ${n}\` and /login again.`);
-            }
-            else if (auth === "ok") {
-                line(OK, `  ${p.id}/${n}: credential readable, login valid.`);
-            }
-            else {
-                // Non-Claude (no probe) or Claude "unknown"/offline — don't over-claim.
-                line(OK, `  ${p.id}/${n}: credential readable${p.id === "claude" ? " (login not verified — offline?)" : ""}.`);
-            }
+            if (auth === "expired")
+                checks.push({ id, status: "warn", title: `${p.id}/${n}: login expired`, detail: "", fix: `${run} and /login again` });
+            else if (auth === "ok")
+                checks.push({ id, status: "ok", title: `${p.id}/${n}: login valid`, detail: "" });
+            else
+                checks.push({ id, status: "ok", title: `${p.id}/${n}: login stored`, detail: p.id === "claude" ? "Not verified — offline?" : "" });
         }
     }
+}
+/** Profiles that share their login with the default install: agent-switch
+ *  never refreshes or balances onto them; a separate sign-in ends that. */
+/** The account the provider's own default install is signed into, where it can
+ *  be read without touching a credential (Antigravity's needs the keychain). */
+function defaultIdentity(p) {
+    if (p.id === "antigravity")
+        return null;
+    // Claude keeps .claude.json in the home dir, next to (not inside) ~/.claude.
+    return p.readIdentity(p.id === "claude" ? os.homedir() : p.defaultConfigDir());
+}
+export function sharedLoginCheck(rows, likely = []) {
+    if (!rows.length && !likely.length)
+        return { id: "shared-login", status: "ok", title: "No profile shares its login with the default install", detail: "" };
+    const key = (r) => `${r.provider}/${r.name}`;
+    const flag = (p) => (p === "claude" ? "" : ` --provider ${p}`);
+    const parts = [];
+    if (rows.length) {
+        parts.push(`${rows.map(key).join(", ")} — imported with the default install's credential. agent-switch never refreshes ${rows.length === 1 ? "it" : "them"} (that would sign the other side out) and never starts ${rows.length === 1 ? "it" : "them"} by balancing.`);
+    }
+    // Imports from before the marker existed: same account as the default install.
+    if (likely.length) {
+        parts.push(`${likely.map(key).join(", ")} may share ${likely.length === 1 ? "its" : "their"} login with the default install (same account, no mark) — if imported, mark ${likely.length === 1 ? "it" : "them"}; if signed in on ${likely.length === 1 ? "its" : "their"} own, ignore this.`);
+    }
+    const n = rows.length + likely.length;
+    return {
+        id: "shared-login",
+        status: "warn",
+        title: rows.length ? `${n === 1 ? "A profile shares" : `${n} profiles share`} the default install's login` : "A profile may share the default install's login",
+        detail: parts.join(" "),
+        fix: rows.length ? `agent-switch login ${rows[0].name}${flag(rows[0].provider)}` : `agent-switch mark-shared ${likely[0].name}${flag(likely[0].provider)}`,
+    };
+}
+export async function collectDoctorReport() {
+    const checks = [];
+    checks.push(cliOnPathCheck());
+    checks.push(shellIntegrationCheck());
+    checks.push(autostartCheck(readGuiSettings()));
+    checks.push(apiKeyOverrideCheck());
+    checks.push(antigravityOsCheck());
+    await providerChecks(checks);
+    const identities = allProviders().flatMap((p) => listProfiles(p.id).map((n) => ({ provider: p.id, name: n, identity: identity(p.id, n) })));
+    checks.push(signInIsolationCheck(identities));
+    const defaults = new Map(allProviders().map((p) => [p.id, defaultIdentity(p)]));
+    checks.push(sharedLoginCheck(identities.filter((r) => sharesDefaultLogin(r.provider, r.name)), identities.filter((r) => !sharesDefaultLogin(r.provider, r.name) && r.identity !== null && r.identity === defaults.get(r.provider))));
     // Share-link health (Claude-config sharing).
     for (const n of listProfiles("claude")) {
         const health = sharedLinkHealth(configDir("claude", n));
@@ -106,42 +262,56 @@ export async function runDoctor() {
         const forked = health.filter((h) => h.state === "forked").map((h) => h.name);
         const missing = health.filter((h) => h.state === "missing").map((h) => h.name);
         if (forked.length === 0 && missing.length === 0) {
-            line(OK, `claude/${n}: ${health.length} shared link(s) intact.`);
+            checks.push({ id: `share-${n}`, status: "ok", title: `claude/${n}: ${health.length} shared link(s) intact`, detail: "" });
         }
         else {
             const parts = [forked.length ? `forked: ${forked.join(", ")}` : "", missing.length ? `missing: ${missing.join(", ")}` : ""].filter(Boolean);
-            line(WARN, `claude/${n}: ${parts.join("; ")} — run \`agent-switch share sync\`.`);
+            checks.push({ id: `share-${n}`, status: "warn", title: `claude/${n}: shared links drifted`, detail: parts.join("; "), fix: "agent-switch share sync" });
         }
     }
     // Single-load guard: the policy, and whether any profile is doubled RIGHT NOW.
-    // Reported even when the policy is `warn`/`off` — the point of doctor is to
-    // surface the state, and a silently tolerated duplicate is exactly the thing
-    // the user came here to find.
-    {
-        const policy = readGuard();
-        line(policy === "off" ? WARN : OK, `single-load guard: ${policy}${policy === "off" ? " — a profile can be loaded twice" : ""}.`);
-        const doubled = [];
-        for (const p of allProviders()) {
-            if (!p.hasLiveSessionSignal)
-                continue;
-            for (const n of listProfiles(p.id)) {
-                const count = liveSessionPids(configDir(p.id, n)).length;
-                if (count > 1)
-                    doubled.push(`${p.id}/${n} (${count} sessions)`);
-            }
-        }
-        if (doubled.length > 0) {
-            line(WARN, `  loaded more than once: ${doubled.join(", ")} — they share one account's rate limits.`);
+    const policy = readGuard();
+    checks.push({ id: "guard", status: policy === "off" ? "warn" : "ok", title: `Single-load guard: ${policy}`, detail: policy === "off" ? "A profile can be loaded twice." : "" });
+    const doubled = [];
+    for (const p of allProviders()) {
+        if (!p.hasLiveSessionSignal)
+            continue;
+        for (const n of listProfiles(p.id)) {
+            const count = liveSessionPids(configDir(p.id, n)).length;
+            if (count > 1)
+                doubled.push(`${p.id}/${n} (${count} sessions)`);
         }
     }
-    // Ecosystem tooling (agent-config + rtk) — same detection module as
-    // `agent-switch tooling`, never a second implementation. Both tools are
-    // optional, so an unhealthy row is a WARN, never a blocking error.
+    if (doubled.length > 0) {
+        checks.push({ id: "guard-doubled", status: "warn", title: "A profile is loaded more than once", detail: `${doubled.join(", ")} — they share one account's rate limits.` });
+    }
+    // Ecosystem tooling (agent-config + rtk) — both optional, so never an error.
     for (const t of checkTooling({ ids: ["agent-config", "rtk"] })) {
-        line(t.healthy ? OK : WARN, doctorToolingLine(t));
+        checks.push({ id: `tooling-${t.id}`, status: t.healthy ? "ok" : "warn", title: doctorToolingLine(t), detail: "" });
+    }
+    const readiness = checks.some((c) => c.status === "error") ? "blocked" : checks.some((c) => c.status === "warn") ? "attention" : "ready";
+    return { readiness, platform: process.platform, checks };
+}
+const MARK = { ok: "✅", warn: "⚠️", error: "❌", info: "ℹ️" };
+export async function runDoctor(json = false) {
+    const report = await collectDoctorReport();
+    if (json) {
+        console.log(JSON.stringify(report, null, 2));
+        return report.readiness === "blocked" ? 1 : 0;
+    }
+    console.log(`agent-switch doctor — platform ${process.platform}, node ${process.version}`);
+    console.log(process.platform === "darwin"
+        ? "  claude credential store: macOS Keychain (hashed per config dir), file fallback"
+        : "  claude credential store: plaintext .credentials.json per profile");
+    console.log("");
+    for (const c of report.checks) {
+        console.log(`${MARK[c.status]}  ${c.title}${c.detail ? ` — ${c.detail}` : ""}`);
+        if (c.fix)
+            console.log(`     fix: ${c.fix}`);
     }
     console.log(`\n  profile root: ${ROOT}`);
     console.log("");
-    line(hardError ? ERR : OK, hardError ? "doctor found a blocking problem (see above)." : "no blocking problems.");
-    return hardError ? 1 : 0;
+    const blocked = report.readiness === "blocked";
+    console.log(`${blocked ? MARK.error : MARK.ok}  ${blocked ? "doctor found a blocking problem (see above)." : "no blocking problems."}`);
+    return blocked ? 1 : 0;
 }