@event4u/agent-switch 2.1.0 → 2.3.0

package/dist/rebind.js

@@ -13,9 +13,10 @@
  *
  * Move-semantics + safety: the target account's credential is moved INTO the
  * running profile's store and the target's own store is emptied, so the family
- * is live in exactly one store. Both original credentials are stashed in a
- * per-profile binding-marker BEFORE any mutation, so `--restore` fully reverses
- * it and a crash leaves a recoverable marker. Nothing is deleted without a stash.
+ * is live in exactly one store. Both original credentials are stashed in the
+ * Keychain BEFORE any mutation and a per-profile binding-marker names those
+ * entries (never the tokens), so `--restore` fully reverses it and a crash
+ * leaves a recoverable marker. Nothing is deleted without a stash.
  *
  * Deferred to later Phase-2 slices (see road-to-live-rebind.md), not built here:
  * live pid/process auto-detection, a global cross-profile binding registry +
@@ -29,7 +30,7 @@ import * as nodePath from "node:path";
 import { fetchProfile } from "./api.js";
 import * as keychain from "./keychain.js";
 import { withProperLock } from "./locks.js";
-import { configDir, ROOT, readRebindKillSwitch, writeRebindKillSwitch } from "./profiles.js";
+import { configDir, ROOT, readRebindKillSwitch, sharesDefaultLogin, writeRebindKillSwitch } from "./profiles.js";
 import { freshenToken } from "./token-freshen.js";
 /** <10 min to expiry → refuse (2× Claude Code's own 5-min refresh buffer). */
 export const FRESHEN_FLOOR_MS = 10 * 60 * 1000;
@@ -126,6 +127,7 @@ export function defaultDeps() {
             }
         },
         resolveAccount: resolveAccountViaApi,
+        sharesDefaultLogin: (name) => sharesDefaultLogin("claude", name),
     };
 }
 function credFile(cfgDir) {
@@ -365,15 +367,30 @@ export function readBinding(cfgDir, d = defaultDeps()) {
         return null;
     try {
         const m = JSON.parse(raw);
-        if (m && typeof m.boundToProfile === "string" && typeof m.runningOwnCredential === "string" && typeof m.targetOrigCredential === "string") {
+        if (!m || typeof m.boundToProfile !== "string")
+            return null;
+        const stashed = typeof m.runningOwnStash === "string" && typeof m.targetOrigStash === "string";
+        const legacy = typeof m.runningOwnCredential === "string" && typeof m.targetOrigCredential === "string";
+        if (stashed || legacy)
             return m;
-        }
     }
     catch {
         /* corrupt marker → treat as none */
     }
     return null;
 }
+/** Keychain services that hold a binding's originals while the rebind is live. */
+function stashServices(pConfig, d) {
+    const base = d.serviceNameFor(pConfig);
+    return { own: `${base}-agent-switch-rebind-own`, target: `${base}-agent-switch-rebind-target` };
+}
+/** The two original credentials a binding needs for restore — from the Keychain
+ *  stash, or inline for a marker written before D16. Null when unreadable. */
+export function bindingCredentials(m, d = defaultDeps()) {
+    const runningOwn = m.runningOwnStash ? d.kcGet(m.runningOwnStash) : (m.runningOwnCredential ?? null);
+    const targetOrig = m.targetOrigStash ? d.kcGet(m.targetOrigStash) : (m.targetOrigCredential ?? null);
+    return runningOwn && targetOrig ? { runningOwn, targetOrig } : null;
+}
 export class RebindError extends Error {
 }
 /**
@@ -533,6 +550,11 @@ async function performRebind(opts, d) {
     if (account === profile) {
         throw new RebindRefused(`cannot rebind "${profile}" to itself`);
     }
+    for (const name of [profile, account]) {
+        if (d.sharesDefaultLogin?.(name)) {
+            throw new RebindRefused(`"${name}" shares its login with the default install — rebinding would refresh or move it and sign the default install out. Give it its own login first: agent-switch login ${name}`);
+        }
+    }
     const pConfig = configDir("claude", profile);
     const aConfig = configDir("claude", account);
     // Already rebound → RE-SWITCH: put both profiles back on their own accounts
@@ -615,12 +637,21 @@ async function performRebind(opts, d) {
             // All guards passed — commit the global binding record.
             reg[account] = { runningProfile: profile, boundAt: new Date(d.now()).toISOString() };
             writeRegistry(reg, d);
-            // 1. Recovery point BEFORE any store mutation: stash both originals.
+            // 1. Recovery point BEFORE any store mutation: stash both originals in the
+            //    Keychain (never in the marker file), then point the marker at them.
+            const stash = stashServices(pConfig, d);
+            if (!d.kcAdd(stash.own, pCred) || !d.kcAdd(stash.target, credToMove)) {
+                d.kcDelete(stash.own);
+                d.kcDelete(stash.target);
+                delete reg[account];
+                writeRegistry(reg, d);
+                throw new RebindError(`could not stash the original credentials in the Keychain — no swap performed.`);
+            }
             const marker = {
                 boundToProfile: account,
                 boundAt: new Date(d.now()).toISOString(),
-                runningOwnCredential: pCred,
-                targetOrigCredential: credToMove,
+                runningOwnStash: stash.own,
+                targetOrigStash: stash.target,
                 targetFileMoved: false,
                 // Snapshot the running profile's OWN identity stamp before the swap: from
                 // here on Claude Code will overwrite it with the borrowed account's.
@@ -648,6 +679,57 @@ async function performRebind(opts, d) {
             `Restore with: agent-switch rebind --restore --profile ${profile}`,
     };
 }
+/**
+ * Drop an active rebind on `profile` WITHOUT restoring it — the `remove --force`
+ * path, where the running profile is about to be deleted. Deletes both Keychain
+ * stash entries (they would otherwise outlive the profile), releases the
+ * registry entry and the marker, and hands the borrowed account back to its own
+ * profile: the stashed original goes back into that store only while it is
+ * empty (a store that holds a login again is never overwritten), and a lent
+ * plaintext file is returned. Returns false when there was no rebind.
+ */
+export function discardBinding(profile, d = defaultDeps()) {
+    const pConfig = configDir("claude", profile);
+    const marker = readBinding(pConfig, d);
+    if (!marker)
+        return false;
+    const originals = bindingCredentials(marker, d);
+    const aConfig = configDir("claude", marker.boundToProfile);
+    const aSvc = d.serviceNameFor(aConfig);
+    if (originals && d.kcGet(aSvc) === null)
+        d.kcAdd(aSvc, originals.targetOrig);
+    const aFile = credFile(aConfig);
+    if (marker.targetFileMoved && d.exists(aFile + LENT_SUFFIX) && !d.exists(aFile))
+        d.renameFile(aFile + LENT_SUFFIX, aFile);
+    const stash = stashServices(pConfig, d);
+    d.kcDelete(marker.runningOwnStash ?? stash.own);
+    d.kcDelete(marker.targetOrigStash ?? stash.target);
+    const reg = readRegistry(d);
+    if (reg[marker.boundToProfile]?.runningProfile === profile) {
+        delete reg[marker.boundToProfile];
+        writeRegistry(reg, d);
+    }
+    d.removeFile(markerFile(pConfig));
+    return true;
+}
+/** The profile currently serving `account`'s login through a rebind, or null. */
+export function borrowerOf(account, d = defaultDeps()) {
+    return readRegistry(d)[account]?.runningProfile ?? null;
+}
+/**
+ * Before `account`'s profile is deleted (`remove --force`): put the profile
+ * borrowing it back on its own login through the normal restore path, so both
+ * stores stay consistent and the stash is cleared. Restore's provenance checks
+ * still apply — a refusal propagates and nothing is released. Returns the
+ * borrower that was restored, or null when nothing borrowed the account.
+ */
+export async function releaseBorrowedAccount(account, d = defaultDeps()) {
+    const holder = borrowerOf(account, d);
+    if (!holder)
+        return null;
+    await restoreRebind({ profile: holder }, d);
+    return holder;
+}
 /** Reverse an active rebind on `profile`: restore both profiles' own credentials. */
 export async function restoreRebind(opts, d = defaultDeps()) {
     const { profile } = opts;
@@ -658,6 +740,11 @@ export async function restoreRebind(opts, d = defaultDeps()) {
     const marker = readBinding(pConfig, d);
     if (!marker)
         throw new RebindRefused(`no active rebind on profile "${profile}".`);
+    const originals = bindingCredentials(marker, d);
+    if (!originals) {
+        throw new RebindRefused(`the stashed credentials for profile "${profile}"'s rebind are not readable — refusing restore (no mutation). ` +
+            `The binding marker is left in place for manual recovery.`);
+    }
     const aConfig = configDir("claude", marker.boundToProfile);
     const pSvc = d.serviceNameFor(pConfig);
     const aSvc = d.serviceNameFor(aConfig);
@@ -672,7 +759,7 @@ export async function restoreRebind(opts, d = defaultDeps()) {
             // account we bound INTO it. If someone re-logged the running profile, its
             // store now holds a DIFFERENT account — never clobber that fresh login.
             const liveRunning = readCred(pConfig, d);
-            const branch = await compareAccounts(marker.targetOrigCredential, liveRunning, d);
+            const branch = await compareAccounts(originals.targetOrig, liveRunning, d);
             if (branch === "unparseable") {
                 throw new RebindRefused(`running profile "${profile}"'s live credential is missing or unparseable — refusing restore (no mutation). ` +
                     `The binding marker is left in place for manual recovery.`);
@@ -691,11 +778,23 @@ export async function restoreRebind(opts, d = defaultDeps()) {
             }
             // "same" / "rotated" → the bound account is still there → restore normally.
             // Restore the running profile to its own account.
-            d.kcAdd(pSvc, marker.runningOwnCredential);
+            if (!d.kcAdd(pSvc, originals.runningOwn)) {
+                throw new RebindError(`could not write profile "${profile}"'s own credential back to the Keychain — restore aborted. ` +
+                    `Nothing was changed; the marker and the stashed credentials are kept — retry the restore.`);
+            }
             // Restore the target profile's own store. On "rotated" the live credential
             // is the same account with a FRESHER (rotated) refresh token — hand that
             // back instead of the stale stash, or the target profile logs out.
-            d.kcAdd(aSvc, branch === "rotated" ? liveRunning : marker.targetOrigCredential);
+            if (!d.kcAdd(aSvc, branch === "rotated" ? liveRunning : originals.targetOrig)) {
+                // Put the running store back on the bound account, so the provenance
+                // check of a retry still sees the account it was rebound to (otherwise
+                // the retry would read its own credential as a foreign re-login).
+                const rolledBack = d.kcAdd(pSvc, liveRunning);
+                throw new RebindError(`could not write "${marker.boundToProfile}"'s credential back to the Keychain — restore aborted. ` +
+                    (rolledBack
+                        ? `Profile "${profile}" still serves "${marker.boundToProfile}"; the marker and the stashed credentials are kept — retry the restore.`
+                        : `Profile "${profile}" could not be rolled back either; the marker and the stashed credentials are kept for manual recovery.`));
+            }
             if (marker.targetFileMoved && d.exists(aFile + LENT_SUFFIX)) {
                 d.renameFile(aFile + LENT_SUFFIX, aFile);
             }
@@ -703,6 +802,10 @@ export async function restoreRebind(opts, d = defaultDeps()) {
             // Claude Code stamped into its `.claude.json` while it served the other account.
             await restoreStampedIdentity(pConfig, marker.runningOwnIdentity, d);
             d.removeFile(markerFile(pConfig));
+            if (marker.runningOwnStash)
+                d.kcDelete(marker.runningOwnStash);
+            if (marker.targetOrigStash)
+                d.kcDelete(marker.targetOrigStash);
             // Release the global binding-registry entry for the bound account.
             const reg = readRegistry(d);
             if (reg[marker.boundToProfile]) {

package/dist/service.js

@@ -68,21 +68,52 @@ export function schtasksCreateArgs(exec, args, label = LABEL) {
     return ["/create", "/tn", label, "/tr", cmd, "/sc", "onlogon", "/f"];
 }
 // ---------- manifest ----------
-function readManifest() {
+function readManifestRaw() {
     try {
         const d = JSON.parse(fs.readFileSync(MANIFEST, "utf8"));
-        return Array.isArray(d?.files) ? d.files : [];
+        const inv = d?.invocation;
+        const invocation = inv && typeof inv.exec === "string" && Array.isArray(inv.args) ? { exec: inv.exec, args: inv.args.map(String) } : null;
+        return { files: Array.isArray(d?.files) ? d.files : [], invocation };
     }
     catch {
-        return [];
+        return { files: [], invocation: null };
     }
 }
+function readManifest() {
+    return readManifestRaw().files;
+}
 function writeManifest(files) {
     fs.mkdirSync(ROOT, { recursive: true });
-    fs.writeFileSync(MANIFEST, JSON.stringify({ label: LABEL, files }, null, 2) + "\n", { mode: 0o600 });
+    // The invocation is what `activate` compares against to re-point the service.
+    fs.writeFileSync(MANIFEST, JSON.stringify({ label: LABEL, files, invocation: runInvocation() }, null, 2) + "\n", { mode: 0o600 });
+}
+/** Whether the installed service runs this very CLI. An install from before the
+ *  manifest recorded its invocation counts as another one. */
+export function serviceTarget() {
+    const m = readManifestRaw();
+    if (!m.files.length)
+        return "not-installed";
+    const me = runInvocation();
+    return m.invocation && m.invocation.exec === me.exec && m.invocation.args.join("\0") === me.args.join("\0") ? "this-cli" : "other-cli";
+}
+/** What `update` does with the service once the new version is on disk. Our
+ *  own service is re-installed so it restarts on the new code; one that runs
+ *  another CLI (a dev checkout) is not ours to re-point. */
+export function serviceAfterUpdate(target, interactive) {
+    if (target === "this-cli")
+        return "reinstall";
+    if (target === "other-cli")
+        return "leave";
+    return interactive ? "ask" : "hint";
+}
+/** Runs `service install` through the CLI file on disk — after a self-update
+ *  that is the new version, while this process is still the old one. */
+export function serviceInstallFromDisk() {
+    const { exec, args } = runInvocation();
+    return spawnSync(exec, [args[0], "service", "install"], { stdio: "inherit" }).status ?? 1;
 }
 // ---------- install / uninstall ----------
-export function serviceInstall() {
+export function serviceInstall(log = console.log) {
     const { exec, args } = runInvocation();
     fs.mkdirSync(ROOT, { recursive: true });
     if (process.platform === "darwin") {
@@ -94,7 +125,7 @@ export function serviceInstall() {
         if (r.status !== 0)
             die(`launchctl load failed: ${r.stderr || r.stdout}`);
         writeManifest([plist]);
-        console.log(`Installed LaunchAgent ${plist} (loaded).`);
+        log(`Installed LaunchAgent ${plist} (loaded).`);
     }
     else if (process.platform === "linux") {
         const unit = path.join(os.homedir(), ".config", "systemd", "user", "agent-switch.service");
@@ -103,16 +134,16 @@ export function serviceInstall() {
         spawnSync("systemctl", ["--user", "daemon-reload"], { stdio: "ignore" });
         const r = spawnSync("systemctl", ["--user", "enable", "--now", "agent-switch.service"], { encoding: "utf8" });
         if (r.status !== 0)
-            console.log(`(note: \`systemctl --user enable --now\` returned nonzero — unit written to ${unit}; enable manually if needed)`);
+            log(`(note: \`systemctl --user enable --now\` returned nonzero — unit written to ${unit}; enable manually if needed)`);
         writeManifest([unit]);
-        console.log(`Installed systemd user unit ${unit}.`);
+        log(`Installed systemd user unit ${unit}.`);
     }
     else if (process.platform === "win32") {
         const r = spawnSync("schtasks", schtasksCreateArgs(exec, args), { encoding: "utf8" });
         if (r.status !== 0)
             die(`schtasks /create failed: ${r.stderr || r.stdout}`);
         writeManifest([`schtasks:${LABEL}`]); // a task, not a file
-        console.log(`Installed Task Scheduler logon task ${LABEL}.`);
+        log(`Installed Task Scheduler logon task ${LABEL}.`);
     }
     else {
         die(`service install is not supported on ${process.platform}`);

package/dist/sessions.js

@@ -10,7 +10,7 @@
  *
  * Iron rules (roadmap: road-to-session-handoff):
  *   - Transcripts are OPAQUE, version-unstable blobs FOR TRANSFER. The only
- *     read in THIS module is `readSessionHeader` — first line, capped,
+ *     read in THIS module is `readSessionHeader` — first 64 KiB, capped,
  *     try/catch. There are exactly TWO sanctioned body readers, both guarded +
  *     capped + fenced + degraded-mode, and NO others: read-only TELEMETRY
  *     (context/token counts, `src/telemetry.ts`, road-to-agent-switch-session-
@@ -33,9 +33,9 @@ import { liveSessionPids } from "./api.js";
 export function encodeProjectDir(cwd) {
     return cwd.replace(/[^A-Za-z0-9]/g, "-");
 }
-/** Best-effort metadata from a transcript's FIRST line only. The line is
- *  capped (a >64 KiB first line counts as unparseable), the parse is fenced,
- *  and absence degrades to nulls — the format is internal and version-unstable,
+/** Best-effort metadata (cwd, summary) from the complete lines in a
+ *  transcript's first 64 KiB. Each parse is fenced, a line cut by the cap is
+ *  ignored, and absence degrades to nulls — the format is internal and version-unstable,
  *  so a failed parse must never fail a listing. */
 const HEADER_CAP = 64 * 1024;
 export function readSessionHeader(file) {
@@ -51,15 +51,30 @@ export function readSessionHeader(file) {
         const buf = Buffer.alloc(HEADER_CAP);
         const n = fs.readSync(fd, buf, 0, HEADER_CAP, 0);
         const chunk = buf.subarray(0, n).toString("utf8");
-        const nl = chunk.indexOf("\n");
-        if (nl < 0 && n === HEADER_CAP)
-            return none; // first line larger than the cap
-        const line = nl >= 0 ? chunk.slice(0, nl) : chunk;
-        const parsed = JSON.parse(line);
-        return {
-            cwd: typeof parsed?.cwd === "string" ? parsed.cwd : null,
-            summary: typeof parsed?.summary === "string" ? parsed.summary : null,
-        };
+        // Claude Code 2.1.x opens with metadata lines that carry no cwd, so scan the
+        // complete lines inside the cap. A trailing partial line (cut by the cap) is
+        // dropped rather than guessed at.
+        const lines = chunk.split("\n");
+        if (n === HEADER_CAP)
+            lines.pop();
+        let cwd = null;
+        let summary = null;
+        for (const line of lines) {
+            if (cwd !== null && summary !== null)
+                break;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (cwd === null && typeof parsed?.cwd === "string")
+                cwd = parsed.cwd;
+            if (summary === null && typeof parsed?.summary === "string")
+                summary = parsed.summary;
+        }
+        return { cwd, summary };
     }
     catch {
         return none;
@@ -68,6 +83,60 @@ export function readSessionHeader(file) {
         fs.closeSync(fd);
     }
 }
+/** Tools that always stop for the user's answer. Other tools can't be told
+ *  apart from one that is still running. */
+const QUESTION_TOOLS = new Set(["AskUserQuestion", "ExitPlanMode"]);
+const TAIL_CAP = 64 * 1024;
+/** Whether the transcript ends on an open question to the user. */
+export function awaitingAnswer(file) {
+    return openQuestion(file) !== null;
+}
+/**
+ * The id of the question the transcript ends on — an AskUserQuestion /
+ * ExitPlanMode call with no tool_result after it — or null. The id tells one
+ * question from the next, so two in a row are two moments. Reads only the
+ * last {@link TAIL_CAP} bytes.
+ */
+export function openQuestion(file) {
+    let text;
+    try {
+        const fd = fs.openSync(file, "r");
+        try {
+            const size = fs.fstatSync(fd).size;
+            const len = Math.min(size, TAIL_CAP);
+            const buf = Buffer.alloc(len);
+            fs.readSync(fd, buf, 0, len, size - len);
+            text = buf.toString("utf8");
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        return null;
+    }
+    const open = new Set();
+    // The first line may be cut off by the tail window; it fails to parse and is skipped.
+    for (const line of text.split("\n")) {
+        let d;
+        try {
+            d = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const content = d?.message?.content;
+        if (!Array.isArray(content))
+            continue;
+        for (const p of content) {
+            if (p?.type === "tool_use" && p.id && p.name && QUESTION_TOOLS.has(p.name))
+                open.add(p.id);
+            else if (p?.type === "tool_result" && p.tool_use_id)
+                open.delete(p.tool_use_id);
+        }
+    }
+    return open.size ? [...open][open.size - 1] : null;
+}
 /** Recent sessions of one profile config dir, newest first, capped at `limit`.
  *  Pure directory scan — works on seeded fakes, shared trees, and win32. */
 export function listSessions(configDir, limit) {

package/dist/share.js

@@ -15,9 +15,15 @@
  *     re-links (last-sync-wins across profiles). On win32, file symlinks need
  *     Developer Mode/admin, so file links degrade with a message there.
  *
+ *   - Prompt history (`history.jsonl`, what ↑ and Ctrl+R search) — always
+ *     linked: it holds no account state, and Claude Code only ever APPENDS to
+ *     it (under a lock), so the link never forks. A profile's own file is
+ *     merged into the shared one (chronological, de-duplicated) and kept as a
+ *     `history.jsonl.pre-share*` backup instead of blocking the link.
+ *
  * Account-/instance-scoped items (`.claude.json`, `.credentials.json`,
  * `plugins/`, `sessions/`, `ide/`, `statsig/`) are deliberately never shared.
- * History (`projects/`, `history.jsonl`, `plans/`) is a POSIX-only opt-in.
+ * Conversations (`projects/`, `plans/`) are a POSIX-only opt-in (`--history`).
  * (`plans/` defaults to `<CLAUDE_CONFIG_DIR>/plans/` in Claude Code, so plan-mode
  * files are otherwise isolated per profile — verified against claude-code 2.1.215.)
  *
@@ -34,18 +40,21 @@ const BASE_ITEMS = [
     { name: "commands", kind: "dir" },
     { name: "agents", kind: "dir" },
 ];
-/** Conversation history + plan-mode files; opt-in — shares `claude --resume`
+/** Append-only logs shared by every `share on`, but never part of a config
+ *  export (`SHARED_ITEMS` is that export's allowlist). */
+const LOG_ITEMS = [{ name: "history.jsonl", kind: "log" }];
+/** Conversations + plan-mode files; opt-in — shares `claude --resume`
  *  and the plan store across accounts. `plans/` is a `dir`, so writes inside it
  *  reach the source (no atomic-rename fork), exactly like `projects/`. */
 const HISTORY_ITEMS = [
     { name: "projects", kind: "dir" },
-    { name: "history.jsonl", kind: "file" },
     { name: "plans", kind: "dir" },
 ];
 /** Names exported for messaging/tests. */
 export const SHARED_ITEMS = BASE_ITEMS.map((i) => i.name);
-export const HISTORY_ITEM_NAMES = HISTORY_ITEMS.map((i) => i.name);
-const ITEM_KIND = new Map([...BASE_ITEMS, ...HISTORY_ITEMS].map((i) => [i.name, i.kind]));
+export const PROMPT_HISTORY = LOG_ITEMS[0].name;
+export const HISTORY_ITEM_NAMES = [...HISTORY_ITEMS, ...LOG_ITEMS].map((i) => i.name);
+const ITEM_KIND = new Map([...BASE_ITEMS, ...LOG_ITEMS, ...HISTORY_ITEMS].map((i) => [i.name, i.kind]));
 const MANIFEST = ".agent-switch-shared.json";
 function readManifest(dir) {
     try {
@@ -72,6 +81,59 @@ function link(src, dst, kind) {
         fs.symlinkSync(src, dst, process.platform === "win32" ? "file" : undefined);
     }
 }
+const stampOf = (l) => {
+    try {
+        const t = JSON.parse(l)?.timestamp;
+        return typeof t === "number" && Number.isFinite(t) ? t : null;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Merge the lines of `extra` into the prompt history at `src`: de-duplicated by
+ * exact line, ordered by timestamp (Claude Code reads the file newest-last, so
+ * ↑ walks back in time). Unparseable lines keep their place after their
+ * predecessor. Written via temp + rename; re-read when the source grew while we
+ * merged, so a concurrent append is not lost. Returns the lines added.
+ */
+export function mergePromptHistory(src, extra) {
+    const linesOf = (f) => fs.existsSync(f) ? fs.readFileSync(f, "utf8").split("\n").filter((l) => l.trim() !== "") : [];
+    const incoming = linesOf(extra);
+    for (let attempt = 0;; attempt++) {
+        const before = fs.existsSync(src) ? fs.statSync(src).size : -1;
+        const own = linesOf(src);
+        const seen = new Set(own);
+        const added = incoming.filter((l) => !seen.has(l) && (seen.add(l), true));
+        if (added.length === 0)
+            return 0;
+        let last = 0;
+        const keyed = [...own, ...added].map((l, i) => {
+            last = stampOf(l) ?? last;
+            return { l, i, t: last };
+        });
+        keyed.sort((a, b) => a.t - b.t || a.i - b.i);
+        const tmp = `${src}.agent-switch-merge`;
+        fs.writeFileSync(tmp, keyed.map((k) => k.l).join("\n") + "\n", { mode: 0o600 });
+        const after = fs.existsSync(src) ? fs.statSync(src).size : -1;
+        if (after !== before && attempt < 3) {
+            fs.unlinkSync(tmp);
+            continue;
+        }
+        fs.renameSync(tmp, src);
+        return added.length;
+    }
+}
+/** Merge a profile's own prompt history into the shared one, keep the original
+ *  as a backup next to it, and leave the slot free for the link. */
+function adoptLog(src, dst, name) {
+    const n = mergePromptHistory(src, dst);
+    let backup = `${dst}.pre-share`;
+    if (fs.existsSync(backup))
+        backup = `${backup}-${Date.now()}`;
+    fs.renameSync(dst, backup);
+    return `merged ${n} prompt(s) from ${name} (original kept as ${path.basename(backup)})`;
+}
 /** True when the existing symlink already points at src (junction paths on
  *  win32 may carry a trailing separator / `\\?\` prefix, so compare loosely). */
 function pointsAt(dst, src) {
@@ -108,14 +170,12 @@ export function settingsSharingRisk(settingsPath) {
 /** Link items from sourceDir into targetDir. Returns human-readable actions. */
 export function applySharing(sourceDir, targetDir, withHistory) {
     const actions = [];
-    const items = withHistory ? [...BASE_ITEMS, ...HISTORY_ITEMS] : [...BASE_ITEMS];
+    const items = withHistory ? [...BASE_ITEMS, ...LOG_ITEMS, ...HISTORY_ITEMS] : [...BASE_ITEMS, ...LOG_ITEMS];
     const managed = new Set(readManifest(targetDir));
     fs.mkdirSync(targetDir, { recursive: true, mode: 0o700 });
     for (const item of items) {
         const src = path.join(sourceDir, item.name);
         const dst = path.join(targetDir, item.name);
-        if (!fs.existsSync(src))
-            continue;
         let st = null;
         try {
             st = fs.lstatSync(dst);
@@ -123,6 +183,12 @@ export function applySharing(sourceDir, targetDir, withHistory) {
         catch {
             /* absent */
         }
+        // The shared prompt history starts empty when the source never had one.
+        if (item.kind === "log" && !fs.existsSync(src) && process.platform !== "win32") {
+            fs.writeFileSync(src, "", { mode: 0o600 });
+        }
+        if (!fs.existsSync(src))
+            continue;
         if (st?.isSymbolicLink()) {
             if (pointsAt(dst, src)) {
                 managed.add(item.name);
@@ -136,14 +202,19 @@ export function applySharing(sourceDir, targetDir, withHistory) {
         }
         else if (st) {
             // A regular file/dir sits where a link would go.
-            if (item.kind === "file" && managed.has(item.name)) {
+            if (item.kind === "log" && st.isFile() && process.platform !== "win32") {
+                actions.push(adoptLog(src, dst, item.name));
+            }
+            else if (item.kind === "file" && managed.has(item.name)) {
                 // We linked it before; it's now a regular file → an in-profile write
                 // forked it. Don't clobber — `share sync` reconciles it.
                 actions.push(`forked ${item.name}: run 'agent-switch share sync' to re-link`);
                 continue;
             }
-            actions.push(`skipped ${item.name}: profile has its own copy (remove it to share)`);
-            continue;
+            else {
+                actions.push(`skipped ${item.name}: profile has its own copy (remove it to share)`);
+                continue;
+            }
         }
         if (item.name === "settings.json") {
             const risk = settingsSharingRisk(src);
@@ -158,7 +229,7 @@ export function applySharing(sourceDir, targetDir, withHistory) {
             actions.push(`linked ${item.name}`);
         }
         catch (err) {
-            if (process.platform === "win32" && item.kind === "file") {
+            if (process.platform === "win32" && item.kind !== "dir") {
                 actions.push(`skipped ${item.name}: Windows file symlinks need Developer Mode or admin ` +
                     `(directories are shared via junction regardless)`);
             }
@@ -199,7 +270,11 @@ export function syncSharing(sourceDir, targetDir) {
         }
         if (st.isSymbolicLink())
             continue; // intact
-        if (st.isFile()) {
+        if (st.isFile() && kind === "log") {
+            actions.push(`${adoptLog(src, dst, name)}, re-linked`);
+            link(src, dst, kind);
+        }
+        else if (st.isFile()) {
             // Forked file: propagate the profile's edit to the source, then re-link.
             if (name === "settings.json") {
                 const risk = settingsSharingRisk(dst);
@@ -244,7 +319,11 @@ export function removeSharing(targetDir) {
             // A symlink (POSIX) or a junction (win32, reported as a symlink by
             // lstat) is ours to remove; a forked regular file is the user's, leave it.
             if (st.isSymbolicLink()) {
+                const shared = ITEM_KIND.get(name) === "log" && fs.existsSync(dst) ? fs.realpathSync(dst) : null;
                 fs.unlinkSync(dst);
+                // Unsharing must not empty a profile's prompt history: it keeps a copy.
+                if (shared)
+                    fs.copyFileSync(shared, dst);
                 actions.push(`unlinked ${name}`);
             }
         }