@lifeaitools/clauth 1.9.2 → 1.16.9

package/.clauth-skill/SKILL.md

@@ -11,23 +11,47 @@ Hardware-bound credential vault for the LIFEAI stack. Your machine is the second
 
 ## How Claude Interfaces with clauth
 
-> **CRITICAL:** Never pipe input to clauth or use interactive prompts. The CLI uses `inquirer` which produces ANSI garbage when stdin is piped. Always use one of the two methods below.
+> **CRITICAL:** Agents should use the local daemon for credential discovery and
+> exact secret retrieval. Do not ask the user for the vault password just to get
+> a key, do not use interactive prompts, and do not walk every service.
 
-### Method 1 — CLI with `--pw` flag (simplest)
+### Method 1 — Local daemon (preferred for agents)
 
-All clauth commands accept `-p` / `--pw <password>` to skip the interactive password prompt:
+Discover services without reading secrets:
+
+```bash
+curl -s http://127.0.0.1:52437/ping
+curl -s http://127.0.0.1:52437/knowledge
+curl -s http://127.0.0.1:52437/list-services
+```
+
+Retrieve exactly one credential only when the next command needs it:
+
+```bash
+curl -s http://127.0.0.1:52437/v/<service>
+```
+
+`/knowledge` is safe to cache for a session: it returns service metadata and
+`has_key`, but no raw secrets and no Vault secret names. `/status` uses the same
+short metadata cache and can be forced with `?refresh=1`.
+
+### Method 2 — CLI with `--pw` flag (admin/setup only)
+
+All clauth commands accept `-p` / `--pw <password>` to skip the interactive
+password prompt. Use this for local admin/setup tasks, not routine agent secret
+retrieval:
 
 ```bash
 clauth status -p "YourPassword"
-clauth get github -p "YourPassword"
 clauth test -p "YourPassword"
 clauth enable github -p "YourPassword"
 clauth write key github -p "YourPassword"   # still prompts for the key value
 ```
 
-### Method 2 — Direct API calls (full control, no CLI needed)
+### Method 3 — Direct API calls (implementation/debugging only)
 
-Call the auth-vault Edge Function directly. This is the most reliable method for Claude.
+Call the auth-vault Edge Function directly only when debugging clauth internals.
+Normal agents should not bypass the daemon metadata cache.
 
 **Base URL:** `https://<project-ref>.supabase.co/functions/v1/auth-vault`
 **Auth header:** `Authorization: Bearer <supabase-anon-key>`
@@ -75,10 +99,10 @@ All auth routes require: `machine_hash`, `token`, `timestamp`, `password`.
 
 ### Password Handling
 
-- Ask the user for their clauth password **once per session**
-- Store it in working memory for the duration of the conversation
+- Do not ask the user for their clauth password for routine credential lookup
+- Use the unlocked local daemon whenever possible
 - Never log or echo the password
-- If the user says "use clauth" or "get my github key", ask for the password if you don't have it yet
+- If the daemon is locked, ask the user to unlock `http://127.0.0.1:52437`
 
 ---
 
@@ -141,12 +165,14 @@ See `references/keys-guide.md` for where to find every credential.
 ```
 clauth install [--ref R] [--pat P]     First-time: provision Supabase + install skill
 clauth setup [--admin-token T] [-p P]  Register this machine
-clauth status [-p P]                   All services + state
-clauth test [-p P]                     Verify HMAC connection
-clauth list [-p P]                     Service names
-clauth search <query> [-p P]           Search names, metadata, and redacted server addresses
-
-clauth write key <service> [-p P]      Store a credential
+clauth status [-p P]                   All services + state
+clauth test [-p P]                     Verify HMAC connection
+clauth list [-p P]                     Service names
+clauth search <query> [-p P]           Search names and metadata
+clauth search <query> --addresses [-p P]
+                                      Also search redacted address hints (may read multiple secrets)
+
+clauth write key <service> [-p P]      Store a credential
 clauth write pw [-p P]                 Change password
 clauth enable <svc|all> [-p P]         Activate service
 clauth disable <svc|all> [-p P]        Suspend service
@@ -175,32 +201,64 @@ Service type `fileserver` — mount configuration for fs tools (UI-only config).
 
 ---
 
-## MCP Server (v1.5.38+)
+## Daemon Metadata Cache
+
+When discovering service names, do not retrieve secrets. Use the daemon metadata
+cache:
+
+```bash
+curl -s http://127.0.0.1:52437/knowledge
+curl -s http://127.0.0.1:52437/list-services
+```
 
-clauth runs as an MCP server with 3 namespaces and 27 tools:
+`/knowledge` is agent-safe: it returns service metadata and `has_key`, but no
+raw secrets and no Vault secret names. Fetch `GET /v/<service>` only for the one
+exact credential needed by the next command. Never walk every service and never
+bulk-fetch all secrets.
+
+## MCP Server (v1.16.9+)
+
+clauth runs as an MCP server with five namespaced paths and safe
+credential-discovery tools:
 
 | Path | Namespace | Tools |
 |------|-----------|-------|
-| `/clauth` | `clauth_*` | 13 credential vault tools |
+| `/clauth` | `clauth_*` + runtime helpers | 23 default live tools, including `clauth_knowledge` |
 | `/gws` | `gws_*` | 6 Google Workspace tools |
-| `/fs` | `fs_*` | 8 filesystem tools (read, write, grep, glob, list, delete, mkdir, mounts) |
-| `/mcp` | all | 27 tools combined |
+| `/fs` | `fs_*` | 20 filesystem and git-safe file tools |
+| `/chitchat` | `chitchat_*` | 7 collaboration relay tools |
+| `/codevelop` | `codevelop_*` | 7 peer development tools |
+| `/mcp` | all | 63 tools combined |
+
+The default live `/clauth` surface includes credential tools plus
+`call_agent`, `monkey_dispatch`, `handoff_start`, `terminal_*`, and `channel_*`.
+Admin write tools are gated by write-mode.
 
 ### claude.ai Connector URLs (noauth mode)
 - `https://clauth.regendevcorp.com/clauth` — credential tools
 - `https://clauth.regendevcorp.com/gws` — Google Workspace
+- `https://clauth.regendevcorp.com/chitchat` — collaboration relay tools
+- `https://clauth.regendevcorp.com/codevelop` — peer development tools
 - `https://fs.regendevcorp.com/fs` — filesystem tools
 
 Noauth mode: fresh domains that return 404 on OAuth endpoints. claude.ai connects directly (Anthropic OAuth proxy bug workaround).
 
+Use `clauth_knowledge` or `clauth_status` for discovery. Use `clauth_get` only
+for one exact secret. `clauth_search` is metadata-only by default; pass
+`addresses: true` only when redacted address hints are intentionally needed.
+`clauth_inject` is guarded against accidental bulk vault sweeps.
+
 ### FS Tools
-`fs_read` `fs_write` `fs_list` `fs_grep` `fs_glob` `fs_delete` `fs_mkdir` `fs_mounts`
+`fs_read` `fs_write` `fs_stat` `fs_append` `fs_write_chunk` `fs_ingest_url`
+`fs_import_git_files` `fs_list` `fs_grep` `fs_glob` `fs_delete` `fs_mkdir`
+`fs_edit` `fs_move` `fs_copy` `fs_mounts` `fs_repo_status` `fs_use_branch`
+`fs_commit` `fs_diff`
 
 Path-jail security: all paths resolved against mount root. Permission flags (r/w/d) per mount. Uses `@vscode/ripgrep` for grep, `fast-glob` for glob.
 
 ### Testing
 ```bash
-node test-tools.mjs    # 25 tool execution tests across all 3 namespaces
+node test-tools.mjs    # MCP tool execution smoke tests
 ```
 
 ---

package/README.md

@@ -27,37 +27,37 @@ At the end it prints a **bootstrap token** — save it for the next step.
 
 ---
 
-## After Install — Register Your Machine
-
-```bash
-clauth setup
-```
+## After Install — Register Your Machine
+
+```bash
+clauth setup
+```
 
 Prompts for: machine label, password, bootstrap token (from `clauth install`).
 
-Then verify:
-```bash
-clauth test      # → PASS
-clauth status    # → 12 services, all NO KEY
-```
-
-### Add A New Computer
-
-On an old computer where clauth is already registered:
-
-```bash
-clauth enroll --label "Dave-New-Laptop"
-```
-
-This creates a one-time enrollment code tied to the same `install_id` and writes
-a one-time PowerShell setup script. Move that script to the new computer and run
-it. The script installs clauth, enrolls the computer, installs startup, then
-deletes itself. Setup defaults the machine label to the computer name and only
-asks you to set the new computer's local clauth password.
-
-The enrollment code does not copy repo credentials into the script. It lets the
-new hardware-bound `machine_hash` join the shared Supabase Vault once. After the
-code is redeemed, it cannot be used again.
+Then verify:
+```bash
+clauth test      # → PASS
+clauth status    # → 12 services, all NO KEY
+```
+
+### Add A New Computer
+
+On an old computer where clauth is already registered:
+
+```bash
+clauth enroll --label "Dave-New-Laptop"
+```
+
+This creates a one-time enrollment code tied to the same `install_id` and writes
+a one-time PowerShell setup script. Move that script to the new computer and run
+it. The script installs clauth, enrolls the computer, installs startup, then
+deletes itself. Setup defaults the machine label to the computer name and only
+asks you to set the new computer's local clauth password.
+
+The enrollment code does not copy repo credentials into the script. It lets the
+new hardware-bound `machine_hash` join the shared Supabase Vault once. After the
+code is redeemed, it cannot be used again.
 
 ---
 
@@ -88,11 +88,13 @@ clauth get github
 ## Command Reference
 
 ```
-clauth install              Provision Supabase + install Claude skill
-clauth setup                Register this machine with the vault
-clauth enroll               Create one-time code to add another computer
-clauth status               All services + state
-clauth search <query>       Find services by name, project, description, or redacted address
+clauth install              Provision Supabase + install Claude skill
+clauth setup                Register this machine with the vault
+clauth enroll               Create one-time code to add another computer
+clauth status               All services + state
+clauth search <query>       Find services by name, project, description, or type
+clauth search <query> --addresses
+                            Also search redacted address hints (may read multiple secrets)
 clauth test                 Verify connection
 
 clauth write key <service>  Store a credential
@@ -136,7 +138,7 @@ Nothing stored locally. Password never persisted. Machine hash is one-way only.
 clauth runs as an HTTP daemon on `http://127.0.0.1:52437`. The daemon provides:
 
 - **Web UI** — unlock vault, manage services, configure mounts
-- **REST API** — `GET /get/<service>`, `GET /ping`, `POST /restart`, `GET /shutdown`
+- **REST API** — `GET /knowledge`, `GET /status`, `GET /v/<service>`, `GET /ping`, `POST /restart`, `GET /shutdown`
 - **MCP server** — Model Context Protocol for Claude Code and claude.ai
 - **Cloudflare Tunnel** — exposes MCP endpoints publicly for claude.ai connectors
 
@@ -144,32 +146,71 @@ Start: `clauth serve start` (starts locked, auto-opens browser for unlock).
 
 Full daemon operations reference: see `regen-root/.claude/rules/clauth.md`.
 
+### Safe Metadata Cache
+
+Agents and scripts must discover services through metadata endpoints, not by
+walking every secret endpoint. The daemon caches service metadata for 30 seconds:
+
+```bash
+curl -s http://127.0.0.1:52437/knowledge      # sanitized, agent-safe metadata
+curl -s http://127.0.0.1:52437/list-services  # names only
+curl -s http://127.0.0.1:52437/status         # full daemon metadata, cached
+```
+
+`/knowledge` returns service names, labels, key types, enabled state, project,
+description, timestamps, and `has_key`. It never returns raw secrets or Vault
+secret names. Use `GET /v/<service>` only for the one exact secret needed by the
+next command. Do not bulk-fetch every service.
+
 ---
 
-## MCP Server — 3 Namespaces, 32 Tools
+## MCP Server — 5 Namespaces, 63 Tools
 
 clauth is the single MCP interface for all local tools. One process, namespaced paths:
 
 | Path | Namespace | Tools | Description |
 |------|-----------|-------|-------------|
-| `/clauth` | `clauth_*` | 13 | Credential vault operations |
+| `/clauth` | `clauth_*` + runtime helpers | 23 | Credential vault operations, safe metadata cache, and agent runtime helpers |
 | `/gws` | `gws_*` | 6 | Google Workspace (Gmail, Calendar, Drive) |
-| `/fs` | `fs_*` | 13 | Filesystem (read, write, append, chunked write, URL ingest, Git import, stat, grep, glob, delete, mkdir, mounts) |
-| `/mcp` | all | 32 | All namespaces combined (Claude Code) |
+| `/fs` | `fs_*` | 20 | Filesystem plus guarded git/local-branch tools |
+| `/chitchat` | `chitchat_*` | 7 | Collaboration relay sessions |
+| `/codevelop` | `codevelop_*` | 7 | Peer development sessions |
+| `/mcp` | all | 63 | All namespaces combined (Claude Code) |
+
+The default live `/clauth` surface includes 13 credential tools plus
+`call_agent`, `monkey_dispatch`, `handoff_start`, `terminal_*`, and `channel_*`
+runtime helpers. Admin write tools such as enable/disable/project/token actions
+are gated by write-mode.
+
+### clauth MCP Usage
+
+Use `clauth_knowledge` or `clauth_status` for discovery. They use cached
+metadata and never retrieve raw secrets. `clauth_search` is metadata-only by
+default; pass `addresses: true` only when you intentionally need redacted address
+hints from connstrings/fileserver/oauth secrets. `clauth_get` is for one exact
+secret. `clauth_inject` refuses more than five services unless `allow_many: true`
+is explicitly supplied, to prevent accidental rate-limit lockouts from bulk
+secret sweeps.
 
 ### FS Tools
 
-13 filesystem tools with path-jail security:
-- `fs_read`, `fs_write`, `fs_stat`, `fs_append`, `fs_write_chunk`, `fs_ingest_url`, `fs_import_git_files`, `fs_list`, `fs_grep`, `fs_glob`, `fs_delete`, `fs_mkdir`, `fs_mounts`
+20 filesystem tools with path-jail security:
+- `fs_read`, `fs_write`, `fs_stat`, `fs_append`, `fs_write_chunk`, `fs_ingest_url`, `fs_import_git_files`, `fs_list`, `fs_grep`, `fs_glob`, `fs_delete`, `fs_mkdir`, `fs_edit`, `fs_move`, `fs_copy`, `fs_mounts`, `fs_repo_status`, `fs_use_branch`, `fs_commit`, `fs_diff`
 - Uses `node:fs/promises` (async), `@vscode/ripgrep` (shipped binary), `fast-glob`
 - Permission flags per mount: `r` (read), `w` (write), `d` (delete)
 - Mount config stored as "fileserver" service type in vault — only configurable through web UI
 - Large writes should use `fs_write_chunk`; cloud-to-local transfer should use `fs_ingest_url`; guarded appends should pass `expected_sha256` from `fs_stat`
 - Durable new files authored by Claude.ai in GitHub should use `fs_import_git_files` so the local dirty monorepo fetches and restores only named paths without `git pull`
 
+### Collaboration Tools
+
+Chitchat tools: `chitchat_start`, `chitchat_list`, `chitchat_send`, `chitchat_recv`, `chitchat_reply`, `chitchat_poll`, `chitchat_stop`
+
+Codevelop tools: `codevelop_start`, `codevelop_join`, `codevelop_send`, `codevelop_poll`, `codevelop_status`, `codevelop_stream`, `codevelop_stop`
+
 ### GWS Tools
 
-6 Google Workspace tools: `gws_gmail_list`, `gws_gmail_read`, `gws_gmail_send`, `gws_gmail_draft`, `gws_calendar_list`, `gws_calendar_create`
+6 Google Workspace tools: `gws_run`, `gws_gmail_list`, `gws_gmail_read`, `gws_gmail_send`, `gws_calendar_list`, `gws_drive_list`
 - Calls `gws` CLI via `execSync` with `shell: 'bash'` (fixes Windows cmd.exe JSON quoting)
 
 ---
@@ -196,6 +237,8 @@ Full OAuth 2.1 protocol implementation is present for future use when Anthropic
 |-----------|-----|
 | clauth | `https://clauth.regendevcorp.com/clauth` |
 | gws | `https://clauth.regendevcorp.com/gws` |
+| chitchat | `https://clauth.regendevcorp.com/chitchat` |
+| codevelop | `https://clauth.regendevcorp.com/codevelop` |
 | fs | `https://fs.regendevcorp.com/fs` |
 
 ---
@@ -210,7 +253,7 @@ Full OAuth 2.1 protocol implementation is present for future use when Anthropic
 ## Testing
 
 ```bash
-node test-tools.mjs    # 25 tool execution tests across all 3 namespaces
+node test-tools.mjs    # MCP tool execution smoke tests
 ```
 
 Tests actual MCP tool calls (not just OAuth + listing).

package/cli/api.js

@@ -27,6 +27,16 @@ export function getAnonKey() {
 // ============================================================
 // Core POST helper
 // ============================================================
+// Bound every vault round-trip with a wall-clock timeout. Without this, a TCP
+// stall (DNS black-hole, half-open socket — NOT a clean 4xx) hangs the caller
+// forever. Callers that treat persistence as best-effort (e.g. the call_agent
+// scratchpad mirror) rely on this resolving to an error rather than blocking.
+// Override via CLAUTH_VAULT_TIMEOUT_MS; default 8s.
+const VAULT_FETCH_TIMEOUT_MS = (() => {
+  const n = Number(process.env.CLAUTH_VAULT_TIMEOUT_MS);
+  return Number.isFinite(n) && n > 0 ? n : 8000;
+})();
+
 async function post(route, body) {
   const url = `${getBaseUrl()}/${route}`;
   const anonKey = getAnonKey();
@@ -37,7 +47,8 @@ async function post(route, body) {
       "Content-Type": "application/json",
       "Authorization": `Bearer ${anonKey}`
     },
-    body: JSON.stringify(body)
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(VAULT_FETCH_TIMEOUT_MS)
   });
 
   const data = await res.json();
@@ -102,38 +113,38 @@ export async function test(password, machineHash, token, timestamp) {
   return authPost("test", password, machineHash, token, timestamp);
 }
 
-export async function changePassword(password, machineHash, token, timestamp, newSeedHash) {
-  return authPost("change-password", password, machineHash, token, timestamp, { new_hmac_seed_hash: newSeedHash });
-}
-
-export async function createEnrollment(password, machineHash, token, timestamp, label, ttlMinutes, installId) {
-  const extra = {};
-  if (label) extra.label = label;
-  if (ttlMinutes) extra.ttl_minutes = ttlMinutes;
-  if (installId) extra.install_id = installId;
-  return authPost("create-enrollment", password, machineHash, token, timestamp, extra);
-}
-
-export async function registerMachine(machineHash, seedHash, label, adminToken, extras = {}) {
-  return post("register-machine", {
-    machine_hash: machineHash,
-    hmac_seed_hash: seedHash,
-    label,
-    admin_token: adminToken,
-    ...extras
-  });
-}
-
-export async function redeemEnrollment(machineHash, seedHash, label, enrollmentCode) {
-  return post("redeem-enrollment", {
-    machine_hash: machineHash,
-    hmac_seed_hash: seedHash,
-    label,
-    enrollment_code: enrollmentCode
-  });
-}
-
-export default {
-  retrieve, write, enable, addService, updateService, removeService, revoke,
-  status, test, createEnrollment, registerMachine, redeemEnrollment, getBaseUrl, getAnonKey
-};
+export async function changePassword(password, machineHash, token, timestamp, newSeedHash) {
+  return authPost("change-password", password, machineHash, token, timestamp, { new_hmac_seed_hash: newSeedHash });
+}
+
+export async function createEnrollment(password, machineHash, token, timestamp, label, ttlMinutes, installId) {
+  const extra = {};
+  if (label) extra.label = label;
+  if (ttlMinutes) extra.ttl_minutes = ttlMinutes;
+  if (installId) extra.install_id = installId;
+  return authPost("create-enrollment", password, machineHash, token, timestamp, extra);
+}
+
+export async function registerMachine(machineHash, seedHash, label, adminToken, extras = {}) {
+  return post("register-machine", {
+    machine_hash: machineHash,
+    hmac_seed_hash: seedHash,
+    label,
+    admin_token: adminToken,
+    ...extras
+  });
+}
+
+export async function redeemEnrollment(machineHash, seedHash, label, enrollmentCode) {
+  return post("redeem-enrollment", {
+    machine_hash: machineHash,
+    hmac_seed_hash: seedHash,
+    label,
+    enrollment_code: enrollmentCode
+  });
+}
+
+export default {
+  retrieve, write, enable, addService, updateService, removeService, revoke,
+  status, test, createEnrollment, registerMachine, redeemEnrollment, getBaseUrl, getAnonKey
+};

package/cli/assets/codevelop/launcher-active.cmd.template

@@ -1,20 +1,20 @@
-@echo off
-setlocal
-set "CODEVELOP_SESSION=${SESSION_ID}"
-set "CODEVELOP_PEER=${PEER}"
-set "CODEVELOP_TARGET=${TARGET_PEER}"
-set "CODEVELOP_BASE_URL=${BASE_URL}"
-set "CODEVELOP_MANIFEST=${MANIFEST}"
-set "CODEVELOP_CONTEXT=${CONTEXT_FILE}"
-set "CELL_ROLE=codevelop-${PEER}"
-cd /d "${CWD}"
-if /i "%~1"=="--print-only" (
-  echo command: ${PRINT_COMMAND}
-  exit /b 0
-)
-echo Co-develop ${PEER} ready. Session ${SESSION_ID}. Listening for collaboration.
-echo Context: ${CONTEXT_FILE}
-node "${CLAUTH_CLI}" codevelop check-partner --repo "${REPO}" --peer ${PEER}
-${COMMAND}
-set EXITCODE=%ERRORLEVEL%
-endlocal & exit /b %EXITCODE%
+@echo off
+setlocal
+set "CODEVELOP_SESSION=${SESSION_ID}"
+set "CODEVELOP_PEER=${PEER}"
+set "CODEVELOP_TARGET=${TARGET_PEER}"
+set "CODEVELOP_BASE_URL=${BASE_URL}"
+set "CODEVELOP_MANIFEST=${MANIFEST}"
+set "CODEVELOP_CONTEXT=${CONTEXT_FILE}"
+set "CELL_ROLE=codevelop-${PEER}"
+cd /d "${CWD}"
+if /i "%~1"=="--print-only" (
+  echo command: ${PRINT_COMMAND}
+  exit /b 0
+)
+echo Co-develop ${PEER} ready. Session ${SESSION_ID}. Listening for collaboration.
+echo Context: ${CONTEXT_FILE}
+node "${CLAUTH_CLI}" codevelop check-partner --repo "${REPO}" --peer ${PEER}
+${COMMAND}
+set EXITCODE=%ERRORLEVEL%
+endlocal & exit /b %EXITCODE%

package/cli/assets/codevelop/launcher-static.cmd.template

@@ -1,7 +1,7 @@
-@echo off
-if not exist "${ACTIVE_LAUNCHER}" (
-  echo No active co-develop launcher has been written.
-  echo Run: clauth codevelop start --repo "${REPO}" --port ${PORT} --start-isolated-clauth
-  exit /b 1
-)
-call "${ACTIVE_LAUNCHER}" %*
+@echo off
+if not exist "${ACTIVE_LAUNCHER}" (
+  echo No active co-develop launcher has been written.
+  echo Run: clauth codevelop start --repo "${REPO}" --port ${PORT} --start-isolated-clauth
+  exit /b 1
+)
+call "${ACTIVE_LAUNCHER}" %*

package/cli/assets/codevelop/windows-terminal.profiles.json

@@ -1,48 +1,48 @@
-{
-  "profiles": [
-    {
-      "name": "Co Develop Claude",
-      "guid": "{a2f8548f-82e6-44b4-bdbb-d934e8881f01}",
-      "commandline": "cmd.exe /k \"${CLAUTH_APPDATA}\\codevelop-claude.cmd\"",
-      "startingDirectory": "${REPO}",
-      "environment": {
-        "CELL_ROLE": "codevelop-claude"
-      },
-      "icon": "🔴",
-      "tabColor": "#B91C1C",
-      "colorScheme": "Dimidium"
-    },
-    {
-      "name": "Co Develop Codex",
-      "guid": "{31a52b07-6efd-4b3d-96dd-ded73488140a}",
-      "commandline": "cmd.exe /k \"${CLAUTH_APPDATA}\\codevelop-codex.cmd\"",
-      "startingDirectory": "${REPO}",
-      "environment": {
-        "CELL_ROLE": "codevelop-codex"
-      },
-      "icon": "🧬",
-      "tabColor": "#0F766E",
-      "colorScheme": "Dimidium"
-    }
-  ],
-  "layout": {
-    "wtArgs": [
-      "-w",
-      "new",
-      "new-tab",
-      "--profile",
-      "Co Develop Claude",
-      "--title",
-      "Co Develop Claude",
-      ";",
-      "split-pane",
-      "-V",
-      "--size",
-      "0.50",
-      "--profile",
-      "Co Develop Codex",
-      "--title",
-      "Co Develop Codex"
-    ]
-  }
-}
+{
+  "profiles": [
+    {
+      "name": "Co Develop Claude",
+      "guid": "{a2f8548f-82e6-44b4-bdbb-d934e8881f01}",
+      "commandline": "cmd.exe /k \"${CLAUTH_APPDATA}\\codevelop-claude.cmd\"",
+      "startingDirectory": "${REPO}",
+      "environment": {
+        "CELL_ROLE": "codevelop-claude"
+      },
+      "icon": "🔴",
+      "tabColor": "#B91C1C",
+      "colorScheme": "Dimidium"
+    },
+    {
+      "name": "Co Develop Codex",
+      "guid": "{31a52b07-6efd-4b3d-96dd-ded73488140a}",
+      "commandline": "cmd.exe /k \"${CLAUTH_APPDATA}\\codevelop-codex.cmd\"",
+      "startingDirectory": "${REPO}",
+      "environment": {
+        "CELL_ROLE": "codevelop-codex"
+      },
+      "icon": "🧬",
+      "tabColor": "#0F766E",
+      "colorScheme": "Dimidium"
+    }
+  ],
+  "layout": {
+    "wtArgs": [
+      "-w",
+      "new",
+      "new-tab",
+      "--profile",
+      "Co Develop Claude",
+      "--title",
+      "Co Develop Claude",
+      ";",
+      "split-pane",
+      "-V",
+      "--size",
+      "0.50",
+      "--profile",
+      "Co Develop Codex",
+      "--title",
+      "Co Develop Codex"
+    ]
+  }
+}