@north-light/crouter 0.3.311 → 0.3.313

package/dist/core/locked-file.js

@@ -12,7 +12,7 @@
 // matters: pi asks its CredentialStore for every registered provider (~75) whenever it
 // builds a model runtime, and routing those through the lock made each boot serialize
 // behind seconds of lock acquisition backoff.
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync, closeSync } from 'node:fs';
 import { dirname } from 'node:path';
 import lockfile from 'proper-lockfile';
 const WRITE_OPTIONS = { encoding: 'utf-8', mode: 0o600 };
@@ -24,8 +24,12 @@ const LOCK_UPDATE_MS = 5_000;
 /** A 0600 JSON file guarded by a cross-process `proper-lockfile` lock on its own path. */
 export class LockedJsonFile {
     path;
-    constructor(path) {
+    durable;
+    initialContent;
+    constructor(path, durable = false, initialContent = '{}') {
         this.path = path;
+        this.durable = durable;
+        this.initialContent = initialContent;
     }
     readUnlocked() {
         return existsSync(this.path) ? readFileSync(this.path, 'utf-8') : undefined;
@@ -35,7 +39,7 @@ export class LockedJsonFile {
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         if (!existsSync(this.path)) {
-            writeFileSync(this.path, '{}', WRITE_OPTIONS);
+            writeFileSync(this.path, this.initialContent, WRITE_OPTIONS);
             chmodSync(this.path, 0o600);
         }
     }
@@ -64,16 +68,39 @@ export class LockedJsonFile {
             });
             throwIfCompromised();
             const current = existsSync(this.path) ? readFileSync(this.path, 'utf-8') : undefined;
-            const { result, next } = await fn(current, throwIfCompromised);
-            throwIfCompromised();
-            if (next !== undefined) {
-                // Atomic replace, so a concurrent lock-free reader can never observe a half-written
-                // file (the reason `readUnlocked` is safe).
+            let published = false;
+            const publish = (next) => {
+                if (published)
+                    throw new Error(`locked file was published twice: ${this.path}`);
+                throwIfCompromised();
                 const tmp = `${this.path}.${process.pid}.${Date.now()}.tmp`;
                 writeFileSync(tmp, next, WRITE_OPTIONS);
                 chmodSync(tmp, 0o600);
+                if (this.durable) {
+                    const fd = openSync(tmp, 'r');
+                    try {
+                        fsyncSync(fd);
+                    }
+                    finally {
+                        closeSync(fd);
+                    }
+                }
                 renameSync(tmp, this.path);
-            }
+                if (this.durable) {
+                    const fd = openSync(dirname(this.path), 'r');
+                    try {
+                        fsyncSync(fd);
+                    }
+                    finally {
+                        closeSync(fd);
+                    }
+                }
+                published = true;
+            };
+            const { result, next } = await fn(current, throwIfCompromised, publish);
+            throwIfCompromised();
+            if (next !== undefined)
+                publish(next);
             throwIfCompromised();
             return result;
         }

package/dist/core/memory/extensions.js

@@ -134,6 +134,8 @@ function catalogForPlugins(groups, enabledOnly, candidate) {
 /** Declarations for a native document. Project documents use their owning
  * project scope only, then user scope; profile/node/user docs use user scope. */
 function pluginGroupsForDocument(doc) {
+    if (doc.scope === 'builtin')
+        return [];
     if (doc.scope === 'project') {
         const marker = `${sep}.crouter${sep}`;
         const markerIndex = doc.path.lastIndexOf(marker);

package/dist/core/preview-registry.js

@@ -101,7 +101,6 @@ export const LEAF_ICON_CP = {
     'surface tmux-spread': 0xf009,
     'canvas issue new': 0xf188,
     'canvas prune': 0xf0c4,
-    'canvas rebuild-index': 0xf0ad,
     'human send': 0xf059,
     'human review': 0xf044,
     'human show': 0xf108,

package/dist/core/profiles/__tests__/env-store.test.js

@@ -10,6 +10,7 @@ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createProfile } from '../manifest.js';
+import { initializeFreshScopedStore } from '../../scoped-state/migrate.js';
 import { resetScopeCache } from '../../scope.js';
 import { isReservedEnvName, listProfileEnvNames, readProfileEnvVars, removeProfileEnvVar, setProfileEnvVar, } from '../env-store.js';
 import { envBranch } from '../../../commands/profile/env.js';
@@ -32,6 +33,7 @@ beforeEach(() => {
     home = mkdtempSync(join(tmpdir(), 'crtr-env-store-home-'));
     process.env.HOME = home;
     resetScopeCache();
+    initializeFreshScopedStore({ kind: 'user', root: join(home, '.crouter') });
 });
 afterEach(() => {
     rmSync(home, { recursive: true, force: true });

package/dist/core/profiles/default-binding.d.ts

@@ -1,10 +1,6 @@
-/** Resolve cwd to the same absolute, realpath'd form the profile selector and
- * manifest use. Falls back to the plain resolved path when it cannot be stat'd. */
 export declare function resolveBindingCwd(cwd: string): string;
 export declare function getDefaultProfileId(cwd: string): string | null;
 export declare function setDefaultProfileId(cwd: string, profileId: string): void;
 export declare function clearDefaultProfile(cwd: string): void;
-/** Every directory currently pinned to `profileId`, in deterministic order. */
 export declare function defaultProfileDirs(profileId: string): string[];
-/** Clear every per-directory default that names `profileId`. */
 export declare function clearDefaultProfileId(profileId: string): string[];

package/dist/core/profiles/default-binding.js

@@ -1,13 +1,9 @@
-// A per-cwd default-profile pin. Pins are independent of profile purview: the
-// profile manifest says what a profile can cover, while this user-level map says
-// which covering profile is preferred for one realpath'd directory.
+// Per-directory default-profile pins are user-root SQL state. Profile identity
+// remains stable across renames, so the pin stores only the generated id.
 import { existsSync, realpathSync } from 'node:fs';
-import { join, resolve as resolvePath } from 'node:path';
-import { homedir } from 'node:os';
-import { CRTR_DIR_NAME } from '../../types.js';
-import { readJsonIfExists, writeJson, removePath } from '../fs-utils.js';
-/** Resolve cwd to the same absolute, realpath'd form the profile selector and
- * manifest use. Falls back to the plain resolved path when it cannot be stat'd. */
+import { resolve as resolvePath } from 'node:path';
+import { userScopeRoot } from '../scope.js';
+import { mutateStoredDefaults, readStoredDefaults } from '../scoped-state/profiles.js';
 export function resolveBindingCwd(cwd) {
     const abs = resolvePath(cwd);
     if (!existsSync(abs))
@@ -19,52 +15,10 @@ export function resolveBindingCwd(cwd) {
         return abs;
     }
 }
-function bindingsPath() {
-    return join(homedir(), CRTR_DIR_NAME, 'profile-defaults.json');
-}
-function bindings() {
-    const value = readJsonIfExists(bindingsPath());
-    if (value === null || typeof value !== 'object' || Array.isArray(value))
-        return {};
-    return Object.fromEntries(Object.entries(value).filter(([, profileId]) => typeof profileId === 'string' && profileId !== ''));
-}
-export function getDefaultProfileId(cwd) {
-    return bindings()[resolveBindingCwd(cwd)] ?? null;
-}
-export function setDefaultProfileId(cwd, profileId) {
-    const value = bindings();
-    value[resolveBindingCwd(cwd)] = profileId;
-    writeJson(bindingsPath(), value);
-}
-export function clearDefaultProfile(cwd) {
-    const value = bindings();
-    delete value[resolveBindingCwd(cwd)];
-    if (Object.keys(value).length === 0)
-        removePath(bindingsPath());
-    else
-        writeJson(bindingsPath(), value);
-}
-/** Every directory currently pinned to `profileId`, in deterministic order. */
-export function defaultProfileDirs(profileId) {
-    return Object.entries(bindings())
-        .filter(([, pinnedProfileId]) => pinnedProfileId === profileId)
-        .map(([dir]) => dir)
-        .sort();
-}
-/** Clear every per-directory default that names `profileId`. */
-export function clearDefaultProfileId(profileId) {
-    const value = bindings();
-    const cleared = Object.entries(value)
-        .filter(([, pinnedProfileId]) => pinnedProfileId === profileId)
-        .map(([dir]) => dir)
-        .sort();
-    if (cleared.length === 0)
-        return [];
-    for (const dir of cleared)
-        delete value[dir];
-    if (Object.keys(value).length === 0)
-        removePath(bindingsPath());
-    else
-        writeJson(bindingsPath(), value);
-    return cleared;
-}
+function bindings() { return readStoredDefaults(userScopeRoot()); }
+export function getDefaultProfileId(cwd) { return bindings()[resolveBindingCwd(cwd)] ?? null; }
+export function setDefaultProfileId(cwd, profileId) { const directory = resolveBindingCwd(cwd); mutateStoredDefaults(userScopeRoot(), (current) => ({ ...current, [directory]: profileId })); }
+export function clearDefaultProfile(cwd) { const directory = resolveBindingCwd(cwd); mutateStoredDefaults(userScopeRoot(), (current) => { const next = { ...current }; delete next[directory]; return next; }); }
+export function defaultProfileDirs(profileId) { return Object.entries(bindings()).filter(([, id]) => id === profileId).map(([directory]) => directory).sort(); }
+export function clearDefaultProfileId(profileId) { let cleared = []; mutateStoredDefaults(userScopeRoot(), (current) => { cleared = Object.entries(current).filter(([, id]) => id === profileId).map(([directory]) => directory).sort(); const next = { ...current }; for (const directory of cleared)
+    delete next[directory]; return next; }); return cleared; }

package/dist/core/profiles/env-store.js

@@ -11,7 +11,7 @@
 // and no caller should log or echo what `readProfileEnvVars` returns.
 import { existsSync, readFileSync, renameSync, writeFileSync, chmodSync } from 'node:fs';
 import { join } from 'node:path';
-import { profileRoot, profileManifestPath, withProfileManifestLock } from './manifest.js';
+import { loadExactProfileManifest, profileRoot, withProfileManifestLock } from './manifest.js';
 import { ensureDir } from '../fs-utils.js';
 import { notFound, usage } from '../errors.js';
 const ENV_FILE = 'env.json';
@@ -87,8 +87,13 @@ function writeStoreAtomic(profileId, store) {
     renameSync(tmp, p);
 }
 function requireProfileExists(profileId) {
-    if (!existsSync(profileManifestPath(profileId))) {
-        throw notFound(`profile not found: ${profileId}`, { received: profileId });
+    try {
+        loadExactProfileManifest(profileId);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('profile not found:'))
+            throw notFound(`profile not found: ${profileId}`, { received: profileId });
+        throw error;
     }
 }
 /** Every stored variable NAME for a profile, sorted. Never returns values. */

package/dist/core/profiles/manifest.d.ts

@@ -5,62 +5,27 @@ export declare function profilesRoot(): string;
 export declare function profileRoot(profileId: string): string;
 export declare function profileManifestPath(profileId: string): string;
 export declare function profileMemoryDir(profileId: string): string;
-/** Reject anything a valid project array may not carry. Shape only: takes
- *  `unknown` because an API body and a hand-edited manifest both prove nothing
- *  at runtime, and deliberately says nothing about whether a path exists —
- *  existence and realpath resolution belong to the create/add paths alone, so
- *  a request naming a since-deleted directory still validates. */
 export declare function assertProfileProjects(entries: unknown): asserts entries is ProfileProject[];
-/** The directory a node running under `profileId` is pinned to — the profile's
- *  home, but only while it still exists on disk (a node pinned to a deleted dir
- *  cannot boot). Null for the root profile, a profile with no projects, a home
- *  that has since been deleted, and an unresolvable id.
- *
- *  This is the whole of the profile→cwd direction: cwd SELECTS a profile at the
- *  front door, and the selected profile then SUPPLIES the node's cwd. Never
- *  throws — it sits on the node-create path. */
 export declare function profileHome(profileId: string | null): string | null;
 export interface ProfileEntry {
     profileId: string;
     manifest: ProfileManifest;
 }
 export interface ProfileEnumeration {
-    /** Every profile with a readable manifest, in directory-listing order. */
     entries: ProfileEntry[];
-    /** Ids whose directory is present under the profiles root but whose manifest
-     *  did not read — corrupt JSON, a pre-object project shape, an unreadable or
-     *  missing `profile.json`. These are NOT deleted profiles, and a caller that
-     *  cannot tell the two apart silently substitutes another identity. */
     unreadableIds: string[];
 }
-/** Every profile with a readable manifest, in directory-listing order. A
- *  profile whose manifest is missing or corrupt is skipped rather than
- *  crashing the whole listing — `lookupProfile` is how a caller that must not
- *  confuse "skipped" with "gone" asks. */
 export declare function listProfiles(): ProfileEntry[];
-/** What a stored profile id resolves to — including the case every
- *  null-returning resolver here erases: the profile is THERE and could not be
- *  read. A caller that treats that as "deleted" substitutes another identity
- *  (root) for the one its work was pinned to. */
 export type ProfileLookup = {
     kind: 'resolved';
     entry: ProfileEntry;
-}
-/** Nothing on this host answers to the id or name — a deleted profile. */
- | {
+} | {
     kind: 'absent';
-}
-/** The id's directory is present; its manifest did not read. */
- | {
+} | {
     kind: 'unreadable';
     profileId: string;
     manifestPath: string;
 };
-/** Exact resolution (generated id, else a unique manifest `name`) that reports
- *  WHY it failed. Only an ID can come back `unreadable`: a name lives inside
- *  the manifest that could not be read, so an unreadable profile has no name to
- *  match on. Throws on an ambiguous name, exactly as `loadProfileManifest`
- *  does. */
 export declare function lookupProfile(profileIdOrName: string): ProfileLookup;
 /** Read one exact profile id without falling back to manifest-name matching.
  * Used at persistence gates that already hold a resolved durable identity. */

package/dist/core/profiles/manifest.js

@@ -6,12 +6,13 @@
 // here, so no caller ever passes a raw CLI operand or `CRTR_PROFILE_ID`
 // straight into `join(profilesRoot(), value)`.
 import { randomUUID } from 'node:crypto';
-import { existsSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
-import { dirname, join, relative, resolve as resolvePath, sep } from 'node:path';
+import { existsSync, realpathSync, rmSync, statSync, } from 'node:fs';
+import { join, relative, resolve as resolvePath, sep } from 'node:path';
 import { SCHEMA_VERSION, PROFILE_DIR } from '../../types.js';
 import { PROFILE_PROJECT_MEMORY_VALUES } from '../../api/dto/profiles.js';
 import { userScopeRoot, resetScopeCache } from '../scope.js';
 import { ensureDir, nowIso } from '../fs-utils.js';
+import { deleteStoredProfile, getStoredProfile, insertStoredProfile, listStoredProfiles, updateStoredProfile } from '../scoped-state/profiles.js';
 import { usage, notFound, ambiguous, general } from '../errors.js';
 import { withExclusiveDirectoryLock } from '../exclusive-lock.js';
 import { fuzzyMatchProfile } from './fuzzy-match.js';
@@ -24,11 +25,10 @@ import { fuzzyMatchProfile } from './fuzzy-match.js';
 const ID_SHAPE = /^[a-z0-9]+(?:-[a-z0-9]+)*-[0-9a-f]{8}$/;
 export const ROOT_PROFILE_ID = 'root-00000000';
 const ROOT_PROFILE_NAME = 'root';
-function scaffoldProfile(profileId, manifest) {
+function scaffoldProfile(profileId, _manifest) {
     const root = profileRoot(profileId);
     ensureDir(root);
     ensureDir(join(root, 'memory'));
-    writeManifestAtomic(profileManifestPath(profileId), manifest);
 }
 export function profilesRoot() {
     return join(userScopeRoot(), PROFILE_DIR);
@@ -82,144 +82,36 @@ export function profileMemoryDir(profileId) {
  *  the user started them, not in whatever dir was last added to its purview. */
 function normalizeHome(profileId, manifest) {
     const stored = typeof manifest.home === 'string' && manifest.home !== '' ? manifest.home : null;
-    const home = profileId === ROOT_PROFILE_ID ? stored : stored ?? manifest.projects[0]?.path ?? null;
-    const pausedAt = typeof manifest.paused_at === 'string' && manifest.paused_at !== '' ? manifest.paused_at : null;
-    return { ...manifest, home, paused_at: pausedAt };
-}
-/** Reject anything a valid project array may not carry. Shape only: takes
- *  `unknown` because an API body and a hand-edited manifest both prove nothing
- *  at runtime, and deliberately says nothing about whether a path exists —
- *  existence and realpath resolution belong to the create/add paths alone, so
- *  a request naming a since-deleted directory still validates. */
+    return { ...manifest, home: profileId === ROOT_PROFILE_ID ? stored : stored ?? manifest.projects[0]?.path ?? null, paused_at: typeof manifest.paused_at === 'string' && manifest.paused_at !== '' ? manifest.paused_at : null };
+}
 export function assertProfileProjects(entries) {
     const memories = PROFILE_PROJECT_MEMORY_VALUES.join(', ');
-    if (!Array.isArray(entries)) {
-        throw usage('projects must be an array of {path, memory} objects', {
-            received: typeof entries,
-            field: 'projects',
-            next: `Pass entries like {"path": "/abs/dir", "memory": "content"} — memory is one of: ${memories}.`,
-        });
-    }
+    if (!Array.isArray(entries))
+        throw usage('projects must be an array of {path, memory} objects', { received: typeof entries, field: 'projects', next: `Pass entries like {"path": "/abs/dir", "memory": "content"} — memory is one of: ${memories}.` });
     for (const entry of entries) {
-        if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
-            throw usage(`invalid project entry: ${JSON.stringify(entry)}`, {
-                field: 'projects',
-                next: 'Every project is an object like {"path": "/abs/dir", "memory": "content"}.',
-            });
-        }
+        if (typeof entry !== 'object' || entry === null || Array.isArray(entry))
+            throw usage(`invalid project entry: ${JSON.stringify(entry)}`, { field: 'projects', next: 'Every project is an object like {"path": "/abs/dir", "memory": "content"}.' });
         const { path, memory } = entry;
-        if (typeof path !== 'string' || path.trim() === '') {
-            throw usage(`project entry has no path: ${JSON.stringify(entry)}`, {
-                field: 'projects',
-                next: 'Give every project entry a non-empty directory path.',
-            });
-        }
-        if (typeof memory !== 'string' || !PROFILE_PROJECT_MEMORY_VALUES.includes(memory)) {
-            throw usage(`invalid project memory value: ${JSON.stringify(memory)}`, {
-                received: String(memory),
-                field: 'projects',
-                next: `Set memory on ${path} to one of: ${memories}.`,
-            });
-        }
+        if (typeof path !== 'string' || path.trim() === '')
+            throw usage(`project entry has no path: ${JSON.stringify(entry)}`, { field: 'projects', next: 'Give every project entry a non-empty directory path.' });
+        if (typeof memory !== 'string' || !PROFILE_PROJECT_MEMORY_VALUES.includes(memory))
+            throw usage(`invalid project memory value: ${JSON.stringify(memory)}`, { received: String(memory), field: 'projects', next: `Set memory on ${path} to one of: ${memories}.` });
     }
 }
-function hasCurrentProjectShape(projects) {
-    try {
-        assertProfileProjects(projects);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** A manifest whose projects are not the current object shape is unreadable —
- *  the same treatment as corrupt JSON, so nothing downstream ever guesses a
- *  memory value. `crtr sys migrate` reads raw bytes and is the only converter
- *  of pre-object manifests. */
-function readManifestFile(path, profileId) {
-    if (!existsSync(path))
-        return null;
-    try {
-        const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        if (!hasCurrentProjectShape(parsed.projects))
-            return null;
-        return normalizeHome(profileId, parsed);
-    }
-    catch {
-        return null;
-    }
-}
-/** The directory a node running under `profileId` is pinned to — the profile's
- *  home, but only while it still exists on disk (a node pinned to a deleted dir
- *  cannot boot). Null for the root profile, a profile with no projects, a home
- *  that has since been deleted, and an unresolvable id.
- *
- *  This is the whole of the profile→cwd direction: cwd SELECTS a profile at the
- *  front door, and the selected profile then SUPPLIES the node's cwd. Never
- *  throws — it sits on the node-create path. */
 export function profileHome(profileId) {
     if (profileId === null || profileId === '')
         return null;
     try {
-        const { manifest } = loadProfileManifest(profileId);
-        const home = manifest.home;
-        if (home === null)
-            return null;
-        return existsSync(home) && statSync(home).isDirectory() ? home : null;
+        const home = loadProfileManifest(profileId).manifest.home;
+        return home !== null && existsSync(home) && statSync(home).isDirectory() ? home : null;
     }
     catch {
         return null;
     }
 }
-/** The one walk of the profiles root: immediate children only — never
- *  recurses, never trusts a caller-supplied id. A dir whose name doesn't match
- *  the generated id shape is not a profile at all and is ignored. */
-function enumerateProfiles() {
-    const root = profilesRoot();
-    if (!existsSync(root))
-        return { entries: [], unreadableIds: [] };
-    const entries = [];
-    const unreadableIds = [];
-    for (const dirent of readdirSync(root, { withFileTypes: true })) {
-        if (!dirent.isDirectory())
-            continue;
-        const profileId = dirent.name;
-        if (!ID_SHAPE.test(profileId))
-            continue;
-        const manifest = readManifestFile(join(root, profileId, 'profile.json'), profileId);
-        if (manifest === null)
-            unreadableIds.push(profileId);
-        else
-            entries.push({ profileId, manifest });
-    }
-    return { entries, unreadableIds };
-}
-/** Every profile with a readable manifest, in directory-listing order. A
- *  profile whose manifest is missing or corrupt is skipped rather than
- *  crashing the whole listing — `lookupProfile` is how a caller that must not
- *  confuse "skipped" with "gone" asks. */
-export function listProfiles() {
-    return enumerateProfiles().entries;
-}
-/** Exact resolution (generated id, else a unique manifest `name`) that reports
- *  WHY it failed. Only an ID can come back `unreadable`: a name lives inside
- *  the manifest that could not be read, so an unreadable profile has no name to
- *  match on. Throws on an ambiguous name, exactly as `loadProfileManifest`
- *  does. */
-export function lookupProfile(profileIdOrName) {
-    const { entries, unreadableIds } = enumerateProfiles();
-    const exact = findExactProfile(entries, profileIdOrName);
-    if (exact !== null)
-        return { kind: 'resolved', entry: exact };
-    if (unreadableIds.includes(profileIdOrName)) {
-        return {
-            kind: 'unreadable',
-            profileId: profileIdOrName,
-            manifestPath: join(profilesRoot(), profileIdOrName, 'profile.json'),
-        };
-    }
-    return { kind: 'absent' };
-}
+function enumerateProfiles() { return { entries: listStoredProfiles(userScopeRoot()).map(({ profileId, manifest }) => ({ profileId, manifest: normalizeHome(profileId, manifest) })), unreadableIds: [] }; }
+export function listProfiles() { return enumerateProfiles().entries; }
+export function lookupProfile(profileIdOrName) { const entries = listProfiles(); const exact = findExactProfile(entries, profileIdOrName); return exact ? { kind: 'resolved', entry: exact } : { kind: 'absent' }; }
 // Three resolvers, in descending tolerance. `resolveProfileOperand` is what a
 // command leaf calls for a value the USER TYPED: exact id, exact name, then a
 // fuzzy fallback. `loadProfileManifest` is the strict middle — exact id or
@@ -233,13 +125,10 @@ export function lookupProfile(profileIdOrName) {
  * Used at persistence gates that already hold a resolved durable identity. */
 export function loadExactProfileManifest(profileId) {
     assertSafeProfileId(profileId);
-    const manifest = readManifestFile(profileManifestPath(profileId), profileId);
-    if (manifest !== null)
-        return { profileId, manifest };
-    throw notFound(`profile not found: ${profileId}`, {
-        received: profileId,
-        next: 'Run `crtr profile list` to see available profiles.',
-    });
+    const stored = getStoredProfile(userScopeRoot(), profileId);
+    if (stored !== null)
+        return { profileId, manifest: normalizeHome(profileId, stored.manifest) };
+    throw notFound(`profile not found: ${profileId}`, { received: profileId, next: 'Run `crtr profile list` to see available profiles.' });
 }
 /** Exact resolution only: the generated id, else a unique manifest `name`.
  *  Returns `null` when nothing matches exactly; still THROWS when a name is
@@ -334,12 +223,6 @@ export function withProfileManifestLock(profileId, fn) {
         }),
     });
 }
-function writeManifestAtomic(path, manifest) {
-    ensureDir(dirname(path));
-    const tmp = `${path}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;
-    writeFileSync(tmp, JSON.stringify(manifest, null, 2) + '\n', 'utf8');
-    renameSync(tmp, path);
-}
 // Project dirs — resolved to absolute real paths, must exist + be a directory
 // on add/create, deduped by real path, stored in manifest order.
 function resolveExistingProjectDir(dir) {
@@ -391,16 +274,11 @@ function generateProfileId(name) {
 // (never for a bare last-used-at touch).
 export function ensureRootProfile() {
     return withProfileManifestLock(ROOT_PROFILE_ID, () => {
-        const manifestPath = profileManifestPath(ROOT_PROFILE_ID);
-        const manifestExists = existsSync(manifestPath);
-        const manifest = manifestExists ? readManifestFile(manifestPath, ROOT_PROFILE_ID) : null;
-        if (manifestExists && manifest === null) {
-            throw general(`root profile manifest is unreadable: ${manifestPath}`);
-        }
-        if (manifest !== null) {
+        const existing = getStoredProfile(userScopeRoot(), ROOT_PROFILE_ID);
+        if (existing !== null) {
             ensureDir(profileRoot(ROOT_PROFILE_ID));
             ensureDir(profileMemoryDir(ROOT_PROFILE_ID));
-            return { profileId: ROOT_PROFILE_ID, manifest };
+            return { profileId: ROOT_PROFILE_ID, manifest: normalizeHome(ROOT_PROFILE_ID, existing.manifest) };
         }
         const next = {
             schema_version: SCHEMA_VERSION,
@@ -412,6 +290,7 @@ export function ensureRootProfile() {
             last_used_at: nowIso(),
         };
         scaffoldProfile(ROOT_PROFILE_ID, next);
+        insertStoredProfile(userScopeRoot(), { profileId: ROOT_PROFILE_ID, manifest: next }, profileRoot(ROOT_PROFILE_ID));
         resetScopeCache();
         return { profileId: ROOT_PROFILE_ID, manifest: next };
     });
@@ -515,30 +394,23 @@ export function createProfile(name, projects = [], opts = {}) {
             last_used_at: null,
         };
         scaffoldProfile(profileId, manifest);
+        insertStoredProfile(userScopeRoot(), { profileId, manifest }, profileRoot(profileId));
         resetScopeCache();
         return { profileId, manifest };
     });
 }
 function requireExistingProfile(profileId) {
     assertSafeProfileId(profileId);
-    if (!existsSync(profileManifestPath(profileId))) {
-        throw notFound(`profile not found: ${profileId}`, {
-            received: profileId,
-            next: 'Run `crtr profile list` to see available profiles.',
-        });
-    }
+    if (getStoredProfile(userScopeRoot(), profileId) === null)
+        throw notFound(`profile not found: ${profileId}`, { received: profileId, next: 'Run `crtr profile list` to see available profiles.' });
 }
 function mutateManifest(profileId, mutate) {
     requireExistingProfile(profileId);
     return withProfileManifestLock(profileId, () => {
-        const path = profileManifestPath(profileId);
-        const current = readManifestFile(path, profileId);
-        if (current === null) {
+        const result = updateStoredProfile(userScopeRoot(), profileId, mutate);
+        if (result === null)
             throw notFound(`profile not found: ${profileId}`, { received: profileId });
-        }
-        const next = mutate(current);
-        writeManifestAtomic(path, next);
-        return { profileId, manifest: next };
+        return { profileId, manifest: normalizeHome(profileId, result.manifest) };
     });
 }
 export function updateProfileLastUsed(profileId) {
@@ -694,6 +566,8 @@ export function removeProfileProject(profileId, dir) {
 export function deleteProfile(profileId) {
     requireExistingProfile(profileId);
     withProfileManifestLock(profileId, () => {
+        if (!deleteStoredProfile(userScopeRoot(), profileId))
+            throw notFound(`profile not found: ${profileId}`, { received: profileId });
         rmSync(profileRoot(profileId), { recursive: true, force: true });
     });
     resetScopeCache();

package/dist/core/profiles/select.js

@@ -12,6 +12,8 @@ import { existsSync, realpathSync } from 'node:fs';
 import { basename, resolve as resolvePath, sep } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { emitKeypressEvents } from 'node:readline';
+import { initializeFreshScopedStore } from '../scoped-state/migrate.js';
+import { userScopeRoot } from '../scope.js';
 import { listProfiles, loadProfileManifest, resolveProfileOperand, updateProfileLastUsed, createProfile, addProfileProject, ensureRootProfile, ROOT_PROFILE_ID, } from './manifest.js';
 import { getDefaultProfileId, setDefaultProfileId, clearDefaultProfile, } from './default-binding.js';
 import { tildify } from '../fs-utils.js';
@@ -668,6 +670,7 @@ async function promptPickProfileOrCreate(candidates, cwd, exact, pinnedId, bindi
  *     default to the root profile and print the recovery instruction to STDERR —
  *     never stdout, which the caller may be piping. */
 export async function selectProfileForCwd(cwd, explicitProfile, forcePicker = false) {
+    initializeFreshScopedStore({ kind: 'user', root: userScopeRoot() });
     const resolvedCwd = resolveCwd(cwd);
     const bindings = resolveUserKeybindings();
     if (explicitProfile !== undefined && explicitProfile !== null && explicitProfile !== '') {