@vishalpunjabi/claude-profile 0.1.5

package/dist/bin/claude-profile.js

@@ -0,0 +1,2190 @@
+#!/usr/bin/env node
+
+// src/cli/index.ts
+import { Command } from "commander";
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+
+// src/cli/adopt.ts
+import * as fs7 from "fs/promises";
+import * as path5 from "path";
+import * as os from "os";
+
+// src/io/machine-config.ts
+import * as fs2 from "fs/promises";
+
+// src/io/atomic.ts
+import * as fs from "fs/promises";
+import * as path from "path";
+import * as crypto from "crypto";
+async function atomicWrite(dest, content) {
+  await fs.mkdir(path.dirname(dest), { recursive: true });
+  const tmp = `${dest}.${process.pid}.${crypto.randomBytes(4).toString("hex")}.tmp`;
+  await fs.writeFile(tmp, content);
+  await fs.rename(tmp, dest);
+}
+
+// src/io/machine-config.ts
+async function loadMachineConfig(p) {
+  try {
+    const txt = await fs2.readFile(p, "utf8");
+    const obj = JSON.parse(txt);
+    return obj;
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function saveMachineConfig(p, cfg) {
+  await atomicWrite(p, JSON.stringify(cfg, null, 2) + "\n");
+}
+function addProfile(cfg, name) {
+  if (cfg.profiles.includes(name)) return cfg;
+  return { ...cfg, profiles: [...cfg.profiles, name] };
+}
+function setActive(cfg, name) {
+  if (!cfg.profiles.includes(name)) {
+    throw new Error(`profile "${name}" is not registered on this machine`);
+  }
+  return { ...cfg, active: name };
+}
+function defaultMachineConfigPath(envHome) {
+  if (envHome !== void 0) return `${envHome}/config.json`;
+  const home = process.env.HOME;
+  if (!home) {
+    throw new Error(
+      "Cannot resolve machine config path: HOME is not set and no explicit path was provided"
+    );
+  }
+  return `${home}/.claude-profile/config.json`;
+}
+
+// src/core/utils.ts
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+// src/core/config.ts
+var DEFAULTS = {
+  // Catch-all: everything under ~/.claude/ is in scope unless excluded below.
+  // BUILTIN_DENYLIST is unioned in at resolve time and blocks credentials/secrets
+  // regardless of include/exclude.
+  include: ["**"],
+  exclude: [
+    // Per-machine cache + transient runtime state
+    "cache/**",
+    "daemon*",
+    "daemon/**",
+    "tasks/**",
+    "telemetry/**",
+    "jobs/**",
+    "backups/**",
+    "paste-cache/**",
+    "downloads/**",
+    "file-history/**",
+    "shell-snapshots/**",
+    "session-env/**",
+    ".last-cleanup",
+    "stats-cache.json",
+    "mcp-needs-auth-cache.json",
+    "security/**",
+    "security_warnings_state_*.json",
+    "*.bak.*",
+    // Project + session history (per-machine, conflict-prone)
+    "projects/**",
+    "sessions/**",
+    "history.jsonl",
+    // Plugin caches (plugin code itself now syncs)
+    "plugins/cache/**",
+    "plugins/plugin-catalog-cache.json",
+    "plugins/data/**"
+  ],
+  denylist: [],
+  claude_json: {
+    path: "~/.claude.json",
+    partial_filename: "claude.json.partial",
+    include_keys: [
+      "mcpServers",
+      "autoUpdates",
+      "autoUpdatesProtectedForNative",
+      "showExpandedTodos",
+      "showSpinnerTree"
+    ]
+  },
+  autosync: {
+    enabled: true,
+    pull_on_session_start: true,
+    push_on_session_stop: true,
+    pull_timeout_seconds: 3,
+    push_debounce_seconds: 10,
+    pull_command: "claude-profile sync --pull --quiet",
+    push_command: "claude-profile sync --push --quiet --background",
+    hook_id_pull: "claude-profile-pull",
+    hook_id_push: "claude-profile-push"
+  },
+  git: {
+    pull_strategy: "ff-only",
+    push: true,
+    commit_message_template: "sync from {host} at {iso_ts}",
+    commit_author_from_git: true
+  },
+  state: { dir: ".claude-profile" },
+  backups: {
+    dir: "~/.claude-profile/backups",
+    keep_per_profile: 10,
+    use_hardlinks: true,
+    auto_prune_on_use: true
+  },
+  limits: { marketplaces_warn_mb: 50 },
+  log: { level: "info", color: "auto" }
+};
+var BUILTIN_DENYLIST = [
+  ".credentials.json",
+  "*.credentials.json",
+  "*.key",
+  "*.pem",
+  "*.p12",
+  ".env",
+  ".env.*",
+  "*secret*",
+  "*token*"
+];
+function deepMerge(base, overlay) {
+  if (overlay === void 0 || overlay === null) return base;
+  if (!isPlainObject(base) || !isPlainObject(overlay)) return overlay;
+  const out = { ...base };
+  for (const k of Object.keys(overlay)) {
+    const ov = overlay[k];
+    const bv = base[k];
+    if (Array.isArray(ov)) {
+      out[k] = ov;
+    } else if (isPlainObject(ov) && isPlainObject(bv)) {
+      out[k] = deepMerge(bv, ov);
+    } else {
+      out[k] = ov;
+    }
+  }
+  return out;
+}
+function resolveConfig(input) {
+  let cfg = JSON.parse(JSON.stringify(DEFAULTS));
+  cfg = deepMerge(cfg, input.repo);
+  cfg = deepMerge(cfg, input.profile);
+  cfg = deepMerge(cfg, input.machine);
+  cfg = deepMerge(cfg, input.flags);
+  if (input.env?.CLAUDE_PROFILE_QUIET === "1") {
+    cfg = deepMerge(cfg, { log: { level: "warn" } });
+  }
+  const userDeny = new Set(cfg.denylist);
+  for (const d of BUILTIN_DENYLIST) userDeny.add(d);
+  cfg.denylist = [...userDeny];
+  return cfg;
+}
+
+// src/core/yaml-merge.ts
+import yaml from "yaml";
+function parseYamlConfig(text) {
+  const parsed = yaml.parse(text);
+  if (parsed === null || parsed === void 0) return {};
+  if (typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("claude-profile.yaml root must be an object");
+  }
+  return parsed;
+}
+
+// src/io/walk.ts
+import * as fs3 from "fs/promises";
+import * as path2 from "path";
+async function walk(root) {
+  const out = [];
+  let rootReal;
+  try {
+    rootReal = await fs3.realpath(root);
+  } catch {
+    return [];
+  }
+  await walkInto(rootReal, "", out, rootReal);
+  return out;
+}
+async function walkInto(absDir, rel, out, rootReal) {
+  let entries;
+  try {
+    entries = await fs3.readdir(absDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const ent of entries) {
+    const childAbs = path2.join(absDir, ent.name);
+    const childRel = rel === "" ? ent.name : `${rel}/${ent.name}`;
+    if (ent.isSymbolicLink()) {
+      try {
+        const real = await fs3.realpath(childAbs);
+        if (!real.startsWith(rootReal + path2.sep) && real !== rootReal) continue;
+        const stat9 = await fs3.stat(real);
+        if (stat9.isDirectory()) {
+          await walkInto(real, childRel, out, rootReal);
+        } else {
+          out.push(childRel);
+        }
+      } catch {
+        continue;
+      }
+    } else if (ent.isDirectory()) {
+      await walkInto(childAbs, childRel, out, rootReal);
+    } else if (ent.isFile()) {
+      out.push(childRel);
+    }
+  }
+}
+async function statMtime(absPath) {
+  try {
+    const st = await fs3.stat(absPath);
+    return Math.floor(st.mtimeMs);
+  } catch {
+    return null;
+  }
+}
+
+// src/io/copy.ts
+import * as fs5 from "fs/promises";
+import * as path3 from "path";
+
+// src/util/hash.ts
+import * as crypto2 from "crypto";
+import * as fs4 from "fs";
+async function sha256(filePath) {
+  return await new Promise((resolve, reject) => {
+    const h = crypto2.createHash("sha256");
+    const s = fs4.createReadStream(filePath);
+    s.on("data", (chunk) => h.update(chunk));
+    s.on("end", () => resolve(h.digest("hex")));
+    s.on("error", reject);
+  });
+}
+
+// src/io/copy.ts
+async function copyFile2(src, dst, opts = {}) {
+  await fs5.mkdir(path3.dirname(dst), { recursive: true });
+  await fs5.rm(dst, { force: true });
+  if (opts.hardlink) {
+    try {
+      await fs5.link(src, dst);
+      return;
+    } catch (err) {
+      const code = err.code;
+      if (code !== "EXDEV" && code !== "EPERM") throw err;
+    }
+  }
+  await fs5.copyFile(src, dst);
+}
+var sha256File = sha256;
+
+// src/core/glob.ts
+import picomatch from "picomatch";
+function normalize(p) {
+  if (p.startsWith("/")) return null;
+  if (p.split("/").includes("..")) return null;
+  return p.replace(/^\.\//, "");
+}
+function anyMatch(patterns, path18, opts = {}) {
+  for (const pat of patterns) {
+    if (picomatch.isMatch(path18, pat, { dot: true, ...opts })) return true;
+  }
+  return false;
+}
+function isPathInScope(rawPath, rules) {
+  const p = normalize(rawPath);
+  if (p === null) return false;
+  if (anyMatch(rules.denylist, p, { matchBase: true })) return false;
+  if (anyMatch(rules.exclude, p)) return false;
+  return anyMatch(rules.include, p);
+}
+
+// src/io/backup.ts
+import * as fs6 from "fs/promises";
+import * as path4 from "path";
+async function snapshotBackup(input) {
+  const dir = path4.join(input.backupRoot, input.profile, input.isoTs);
+  await fs6.mkdir(dir, { recursive: true });
+  const files = (await walk(input.home)).filter((p) => isPathInScope(p, input.rules));
+  const manifestFiles = [];
+  for (const rel of files) {
+    const src = path4.join(input.home, rel);
+    const dst = path4.join(dir, rel);
+    await copyFile2(src, dst, { hardlink: input.useHardlinks });
+    manifestFiles.push({ path: rel, sha256: await sha256File(src) });
+  }
+  const manifestPath = path4.join(dir, "MANIFEST.json");
+  const manifest = {
+    version: 1,
+    outgoing: input.profile,
+    iso_ts: input.isoTs,
+    files: manifestFiles
+  };
+  await atomicWrite(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
+  return { dir, manifestPath, fileCount: files.length };
+}
+async function listBackups(backupRoot, profile) {
+  const dir = path4.join(backupRoot, profile);
+  let entries;
+  try {
+    entries = await fs6.readdir(dir);
+  } catch {
+    return [];
+  }
+  const sorted = entries.sort().reverse();
+  return sorted.map((ts) => ({ profile, ts, dir: path4.join(dir, ts) }));
+}
+async function pruneBackups(backupRoot, profile, keep) {
+  if (keep === 0) return [];
+  const all = await listBackups(backupRoot, profile);
+  const toDelete = all.slice(keep);
+  for (const b of toDelete) {
+    await fs6.rm(b.dir, { recursive: true, force: true });
+  }
+  return toDelete.map((b) => b.ts);
+}
+
+// src/io/git.ts
+import { execa } from "execa";
+async function run(cwd, args, opts = {}) {
+  try {
+    return await execa("git", args, { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } });
+  } catch (err) {
+    if (opts.allowFail) return null;
+    throw err;
+  }
+}
+async function status(cwd) {
+  const res = await run(cwd, ["status", "--porcelain=v1", "-z"]);
+  if (!res?.stdout || typeof res.stdout !== "string") return [];
+  return res.stdout.split("\0").filter(Boolean).map((line) => ({ code: line.slice(0, 2).trim(), path: line.slice(3) }));
+}
+async function isClean(cwd) {
+  return (await status(cwd)).length === 0;
+}
+async function add(cwd, paths) {
+  if (paths.length === 0) return;
+  await run(cwd, ["add", "--", ...paths]);
+}
+async function hasStaged(cwd) {
+  const res = await run(cwd, ["diff", "--cached", "--quiet"], { allowFail: true });
+  return res === null;
+}
+async function commit(cwd, message) {
+  await run(cwd, ["commit", "-m", message]);
+}
+async function commitIfStaged(cwd, message) {
+  if (!await hasStaged(cwd)) return false;
+  await commit(cwd, message);
+  return true;
+}
+async function fetch(cwd) {
+  await run(cwd, ["fetch"]);
+}
+async function pull(cwd, strategy) {
+  const flag = strategy === "ff-only" ? "--ff-only" : strategy === "rebase" ? "--rebase" : "--no-rebase";
+  await run(cwd, ["pull", flag]);
+}
+async function push(cwd) {
+  await run(cwd, ["push"]);
+}
+async function clone(url, dest) {
+  await execa("git", ["clone", url, dest], { env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } });
+}
+async function revParse(cwd, ref) {
+  const r = await run(cwd, ["rev-parse", ref], { allowFail: true });
+  if (!r || typeof r.stdout !== "string") return null;
+  return r.stdout.trim();
+}
+async function logBetween(cwd, from, to) {
+  const r = await run(cwd, ["log", "--oneline", `${from}..${to}`]);
+  if (!r || typeof r.stdout !== "string") return "";
+  return r.stdout;
+}
+var git = {
+  status,
+  isClean,
+  add,
+  hasStaged,
+  commit,
+  commitIfStaged,
+  fetch,
+  pull,
+  push,
+  clone,
+  revParse,
+  logBetween
+};
+
+// src/core/meta.ts
+function emptyMeta() {
+  return { version: 1, files: {}, claude_json: {} };
+}
+function parseMeta(text) {
+  const obj = JSON.parse(text);
+  if (!isPlainObject(obj) || obj["version"] !== 1) {
+    const got = isPlainObject(obj) ? obj["version"] : typeof obj;
+    throw new Error(`meta.json version mismatch: expected 1, got ${String(got)}`);
+  }
+  const files = obj["files"] ?? {};
+  const claude_json = obj["claude_json"] ?? {};
+  if (!isPlainObject(files)) {
+    throw new Error(`meta.json: "files" must be an object, got ${Array.isArray(files) ? "array" : typeof files}`);
+  }
+  if (!isPlainObject(claude_json)) {
+    throw new Error(`meta.json: "claude_json" must be an object, got ${Array.isArray(claude_json) ? "array" : typeof claude_json}`);
+  }
+  return {
+    version: 1,
+    files,
+    claude_json
+  };
+}
+function serializeMeta(meta) {
+  return JSON.stringify(meta, null, 2) + "\n";
+}
+
+// src/util/time.ts
+var realTime = {
+  now: () => Date.now(),
+  iso: () => (/* @__PURE__ */ new Date()).toISOString()
+};
+
+// src/util/errors.ts
+var CliError = class extends Error {
+  code;
+  constructor(message, code = 2) {
+    super(message);
+    this.code = code;
+    this.name = "CliError";
+  }
+};
+
+// src/cli/adopt.ts
+var NAME_RE = /^[a-z0-9_-]+$/;
+var RESERVED = /* @__PURE__ */ new Set(["__preexisting__"]);
+function homeRoot() {
+  return process.env.HOME ?? os.homedir();
+}
+function machineHomeRoot() {
+  return process.env.CLAUDE_PROFILE_HOME ?? path5.join(homeRoot(), ".claude-profile");
+}
+function attachAdopt(program2) {
+  program2.command("adopt").description("Snapshot current ~/.claude/ into profiles/<name>/ (new or existing)").argument("<name>").option("--overwrite").option("--switch").option("--no-push").action(async (name, opts) => {
+    if (!NAME_RE.test(name)) throw new CliError(`invalid profile name: ${name}`);
+    if (RESERVED.has(name)) throw new CliError(`profile name "${name}" is reserved`);
+    const cfgPath = path5.join(machineHomeRoot(), "config.json");
+    const cfg = await loadMachineConfig(cfgPath);
+    if (!cfg) throw new CliError("Run `claude-profile init --git <url>` first.");
+    const checkout = cfg.path;
+    const profileDir = path5.join(checkout, "profiles", name);
+    const exists = await fs7.stat(profileDir).catch(() => null);
+    if (exists && !opts.overwrite) {
+      throw new CliError(`Profile "${name}" already exists in the repo. Pass --overwrite to replace it.`);
+    }
+    const readYaml = async (p) => {
+      try {
+        return parseYamlConfig(await fs7.readFile(p, "utf8"));
+      } catch {
+        return {};
+      }
+    };
+    const repoYaml = await readYaml(path5.join(checkout, "claude-profile.yaml"));
+    const profileYaml = exists ? await readYaml(path5.join(profileDir, "claude-profile.yaml")) : {};
+    const resolved = resolveConfig({
+      repo: repoYaml,
+      profile: profileYaml
+    });
+    const rules = { include: resolved.include, exclude: resolved.exclude, denylist: resolved.denylist };
+    const claudeHome = path5.join(homeRoot(), ".claude");
+    if (name === cfg.active) {
+      await snapshotBackup({
+        home: claudeHome,
+        backupRoot: resolved.backups.dir.replace(/^~/, homeRoot()),
+        profile: name,
+        rules,
+        isoTs: realTime.iso(),
+        useHardlinks: resolved.backups.use_hardlinks
+      });
+    }
+    const homeFiles = (await walk(claudeHome)).filter((p) => isPathInScope(p, rules));
+    if (opts.overwrite && exists) {
+      const oldFiles = await walk(profileDir);
+      for (const rel of oldFiles) {
+        if (rel === "claude-profile.yaml") continue;
+        if (rel === resolved.claude_json.partial_filename) continue;
+        if (!isPathInScope(rel, rules) || !homeFiles.includes(rel)) {
+          await fs7.rm(path5.join(profileDir, rel), { force: true });
+        }
+      }
+    }
+    await fs7.mkdir(profileDir, { recursive: true });
+    for (const rel of homeFiles) {
+      await copyFile2(path5.join(claudeHome, rel), path5.join(profileDir, rel), { hardlink: false });
+    }
+    const claudeJsonPath = resolved.claude_json.path.replace(/^~/, homeRoot());
+    const home = JSON.parse(await fs7.readFile(claudeJsonPath, "utf8").catch(() => "{}"));
+    const partial = {};
+    for (const k of resolved.claude_json.include_keys) {
+      if (k in home) partial[k] = home[k];
+    }
+    if (Object.keys(partial).length > 0) {
+      await atomicWrite(
+        path5.join(profileDir, resolved.claude_json.partial_filename),
+        JSON.stringify(partial, null, 2) + "\n"
+      );
+    }
+    const metaPath = path5.join(checkout, ".claude-profile", name, "meta.json");
+    const meta = await fs7.readFile(metaPath, "utf8").then(parseMeta).catch(() => emptyMeta());
+    const newFiles = {};
+    for (const rel of homeFiles) {
+      const mt = await statMtime(path5.join(claudeHome, rel));
+      if (mt !== null) newFiles[rel] = mt;
+    }
+    await atomicWrite(metaPath, serializeMeta({ ...meta, files: newFiles }));
+    const relP = path5.join("profiles", name);
+    const relS = path5.join(".claude-profile", name);
+    await git.add(checkout, [relP, relS]);
+    const verb = exists ? "re-adopt" : "adopt";
+    await git.commitIfStaged(checkout, `${verb} ${name} from ${cfg.host} at ${realTime.iso()}`);
+    if (opts.push !== false) {
+      await git.push(checkout).catch((err) => process.stderr.write(`warn: push failed: ${err.message}
+`));
+    }
+    let nextCfg = addProfile(cfg, name);
+    if (opts.switch && nextCfg.active !== name) {
+      nextCfg = setActive(nextCfg, name);
+    }
+    await saveMachineConfig(cfgPath, nextCfg);
+    const tag = nextCfg.active === name ? "active" : nextCfg.profiles.includes(name) ? "registered" : "unregistered";
+    process.stdout.write(`Adopted ~/.claude/ \u2192 profiles/${name}/ (${homeFiles.length} files). [${tag}]
+`);
+  });
+}
+
+// src/cli/backups.ts
+import * as fs8 from "fs/promises";
+import * as path6 from "path";
+import * as os2 from "os";
+function homeRoot2() {
+  return process.env.HOME ?? os2.homedir();
+}
+function machineHomeRoot2() {
+  return process.env.CLAUDE_PROFILE_HOME ?? path6.join(homeRoot2(), ".claude-profile");
+}
+async function loadCfg() {
+  const cfg = await loadMachineConfig(path6.join(machineHomeRoot2(), "config.json"));
+  if (!cfg) throw new CliError("Run `init` first.");
+  return cfg;
+}
+function backupRootFor() {
+  return resolveConfig({}).backups.dir.replace(/^~/, homeRoot2());
+}
+function attachBackups(program2) {
+  program2.command("backups").description("List backup snapshots for a profile").option("--profile <name>").action(async (opts) => {
+    const cfg = await loadCfg();
+    const profile = opts.profile ?? cfg.active;
+    if (!profile) throw new CliError("--profile required (no active profile)");
+    const entries = await listBackups(backupRootFor(), profile);
+    for (const e of entries) {
+      const stat9 = await fs8.stat(e.dir);
+      process.stdout.write(`  ${e.ts}  (size: ${stat9.size} bytes, dir: ${e.dir})
+`);
+    }
+  });
+  program2.command("restore").description("Restore a backup snapshot").argument("<profile>").argument("[ts]").action(async (profile, ts) => {
+    const cfg = await loadCfg();
+    const root = backupRootFor();
+    const entries = await listBackups(root, profile);
+    const target = ts ? entries.find((e) => e.ts === ts) : entries[0];
+    if (!target) throw new CliError(`no backup found for ${profile}${ts ? ` ts=${ts}` : ""}`);
+    const claudeHome = path6.join(homeRoot2(), ".claude");
+    const resolved = resolveConfig({});
+    const rules = { include: resolved.include, exclude: resolved.exclude, denylist: resolved.denylist };
+    await snapshotBackup({
+      home: claudeHome,
+      backupRoot: root,
+      profile: cfg.active ?? "__preexisting__",
+      rules,
+      isoTs: realTime.iso(),
+      useHardlinks: resolved.backups.use_hardlinks
+    });
+    const files = await walk(target.dir);
+    for (const rel of files) {
+      if (rel === "MANIFEST.json") continue;
+      await copyFile2(path6.join(target.dir, rel), path6.join(claudeHome, rel), { hardlink: false });
+    }
+    process.stdout.write(`Restored ${profile}@${target.ts} into ${claudeHome}
+`);
+  });
+  program2.command("prune").description("Delete old backups, keep N most recent per profile").option("--keep <n>", "number to keep", "10").action(async (opts) => {
+    await loadCfg();
+    const keep = parseInt(opts.keep, 10);
+    const root = backupRootFor();
+    const profiles = await fs8.readdir(root).catch(() => []);
+    let total = 0;
+    for (const p of profiles) {
+      const pruned = await pruneBackups(root, p, keep);
+      total += pruned.length;
+    }
+    process.stdout.write(`Pruned ${total} backup snapshot(s) across ${profiles.length} profile(s)
+`);
+  });
+}
+
+// src/cli/config.ts
+import * as path7 from "path";
+function configFilePath() {
+  return process.env.CLAUDE_PROFILE_HOME ? path7.join(process.env.CLAUDE_PROFILE_HOME, "config.json") : defaultMachineConfigPath();
+}
+function emptyConfig() {
+  return { git: "", path: "", active: null, profiles: [], host: "" };
+}
+function getKey(cfg, key) {
+  if (!cfg) return "(unset)";
+  const v = cfg[key];
+  if (v === null || v === void 0 || v === "") return "(unset)";
+  return Array.isArray(v) ? v.join(",") : String(v);
+}
+function setKey(cfg, key, value) {
+  const next = { ...cfg };
+  if (key === "profiles") next.profiles = value.split(",").filter(Boolean);
+  else next[key] = value;
+  return next;
+}
+function unsetKey(cfg, key) {
+  const next = { ...cfg };
+  if (key === "active") next.active = null;
+  else if (key === "profiles") next.profiles = [];
+  else next[key] = "";
+  return next;
+}
+function attachConfig(program2) {
+  const cmd = program2.command("config").description("Get/set/unset per-machine config").argument("<op>", "get|set|unset").argument("[key]", "config key").argument("[value]", "value (for set)").action(async (op, key, value) => {
+    const p = configFilePath();
+    const cfg = await loadMachineConfig(p) ?? emptyConfig();
+    if (op === "get") {
+      if (!key) {
+        process.stdout.write(JSON.stringify(cfg, null, 2) + "\n");
+        return;
+      }
+      process.stdout.write(getKey(cfg, key) + "\n");
+      return;
+    }
+    if (op === "set") {
+      if (!key || value === void 0) {
+        process.stderr.write("config set requires <key> <value>\n");
+        process.exit(2);
+      }
+      await saveMachineConfig(p, setKey(cfg, key, value));
+      return;
+    }
+    if (op === "unset") {
+      if (!key) {
+        process.stderr.write("config unset requires <key>\n");
+        process.exit(2);
+      }
+      await saveMachineConfig(p, unsetKey(cfg, key));
+      return;
+    }
+    process.stderr.write(`unknown config op: ${op}
+`);
+    process.exit(2);
+  });
+  void cmd;
+}
+
+// src/cli/describe.ts
+import * as fs11 from "fs/promises";
+import * as path10 from "path";
+import * as os4 from "os";
+import { execa as execa2 } from "execa";
+
+// src/cli/sync.ts
+import * as fs10 from "fs/promises";
+import * as path9 from "path";
+import * as os3 from "os";
+
+// src/core/decide.ts
+function decide(input) {
+  const { home, repo, lastSync } = input;
+  if (lastSync === null) {
+    if (home === null) {
+      return repo === null ? { kind: "noop" } : { kind: "copy-repo-to-home" };
+    }
+    if (repo === null) return { kind: "copy-home-to-repo" };
+    return home >= repo ? { kind: "copy-home-to-repo" } : { kind: "copy-repo-to-home" };
+  }
+  if (home === null && repo === null) return { kind: "clear-meta" };
+  if (home === null) {
+    if (repo === lastSync) return { kind: "delete-repo" };
+    return { kind: "delete-vs-change", winner: "repo" };
+  }
+  if (repo === null) {
+    if (home === lastSync) return { kind: "delete-home" };
+    return { kind: "delete-vs-change", winner: "home" };
+  }
+  const homeChanged = home > lastSync;
+  const repoChanged = repo > lastSync;
+  if (!homeChanged && !repoChanged) return { kind: "noop" };
+  if (homeChanged && !repoChanged) return { kind: "copy-home-to-repo" };
+  if (!homeChanged && repoChanged) return { kind: "copy-repo-to-home" };
+  return { kind: "conflict", winner: home >= repo ? "home" : "repo" };
+}
+
+// src/core/json-merge.ts
+function cloneValue(v) {
+  return v === void 0 ? void 0 : JSON.parse(JSON.stringify(v));
+}
+function mergeObjects(hv, rv, homeWins) {
+  const out = { ...hv };
+  for (const nk of Object.keys(rv)) {
+    if (!(nk in out)) {
+      out[nk] = rv[nk];
+    } else if (JSON.stringify(out[nk]) !== JSON.stringify(rv[nk])) {
+      out[nk] = homeWins ? out[nk] : rv[nk];
+    }
+  }
+  return out;
+}
+function mergeClaudeJson(input) {
+  const { home, repo, meta, tsHome, tsRepo, includeKeys } = input;
+  const outHome = { ...home };
+  const outRepo = {};
+  const outMeta = { ...meta };
+  for (const k of includeKeys) {
+    if (k in repo) outRepo[k] = repo[k];
+  }
+  for (const key of includeKeys) {
+    const hv = home[key];
+    const rv = repo[key];
+    const decision = decide({
+      home: hv === void 0 ? null : tsHome,
+      repo: rv === void 0 ? null : tsRepo,
+      lastSync: meta[key] ?? null
+    });
+    switch (decision.kind) {
+      case "noop":
+        break;
+      case "copy-home-to-repo":
+        outRepo[key] = cloneValue(hv);
+        outMeta[key] = tsHome;
+        break;
+      case "copy-repo-to-home":
+        outHome[key] = cloneValue(rv);
+        outRepo[key] = cloneValue(rv);
+        outMeta[key] = tsRepo;
+        break;
+      case "delete-home":
+        delete outHome[key];
+        delete outRepo[key];
+        delete outMeta[key];
+        break;
+      case "delete-repo":
+        delete outHome[key];
+        delete outRepo[key];
+        delete outMeta[key];
+        break;
+      case "clear-meta":
+        delete outMeta[key];
+        break;
+      case "conflict": {
+        const homeWins = decision.winner === "home";
+        let merged;
+        if (isPlainObject(hv) && isPlainObject(rv)) {
+          merged = mergeObjects(hv, rv, homeWins);
+        } else {
+          merged = homeWins ? hv : rv;
+        }
+        outHome[key] = cloneValue(merged);
+        outRepo[key] = cloneValue(merged);
+        outMeta[key] = Math.max(tsHome, tsRepo);
+        break;
+      }
+      case "delete-vs-change": {
+        const homeWins = decision.winner === "home";
+        const winning = homeWins ? hv : rv;
+        outHome[key] = cloneValue(winning);
+        outRepo[key] = cloneValue(winning);
+        outMeta[key] = homeWins ? tsHome : tsRepo;
+        break;
+      }
+    }
+  }
+  return { home: outHome, repo: outRepo, meta: outMeta };
+}
+
+// src/io/lock.ts
+import * as fs9 from "fs/promises";
+import * as path8 from "path";
+import lockfile from "proper-lockfile";
+var LockBusyError = class extends Error {
+  constructor(p) {
+    super(`another sync in progress (lock: ${p})`);
+    this.name = "LockBusyError";
+  }
+};
+async function withLock(lockPath, fn) {
+  await fs9.mkdir(path8.dirname(lockPath), { recursive: true });
+  try {
+    const fh = await fs9.open(lockPath, "a");
+    await fh.close();
+  } catch {
+  }
+  let release;
+  try {
+    release = await lockfile.lock(lockPath, { retries: 0, stale: 6e4 });
+  } catch (err) {
+    if (err.code === "ELOCKED") {
+      throw new LockBusyError(lockPath);
+    }
+    throw err;
+  }
+  try {
+    return await fn();
+  } finally {
+    await release();
+  }
+}
+
+// src/cli/sync.ts
+function homeRoot3() {
+  return process.env.HOME ?? os3.homedir();
+}
+function machineHomeRoot3() {
+  return process.env.CLAUDE_PROFILE_HOME ?? path9.join(homeRoot3(), ".claude-profile");
+}
+async function loadCheckoutYaml(checkout, profile) {
+  const readMaybe = async (p) => {
+    try {
+      return parseYamlConfig(await fs10.readFile(p, "utf8"));
+    } catch (err) {
+      if (err.code === "ENOENT") return {};
+      throw err;
+    }
+  };
+  return {
+    repo: await readMaybe(path9.join(checkout, "claude-profile.yaml")),
+    profile: await readMaybe(path9.join(checkout, "profiles", profile, "claude-profile.yaml"))
+  };
+}
+async function loadMeta(checkout, profile) {
+  const p = path9.join(checkout, ".claude-profile", profile, "meta.json");
+  try {
+    return parseMeta(await fs10.readFile(p, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return emptyMeta();
+    throw err;
+  }
+}
+async function saveMeta(checkout, profile, meta) {
+  const p = path9.join(checkout, ".claude-profile", profile, "meta.json");
+  await atomicWrite(p, serializeMeta(meta));
+}
+function tmpl(s, vars) {
+  return s.replace(/\{(\w+)\}/g, (_, k) => vars[k] ?? `{${k}}`);
+}
+async function planSync(cfg, resolved, profile) {
+  const checkout = cfg.path;
+  const claudeHome = path9.join(homeRoot3(), ".claude");
+  const profileDir = path9.join(checkout, "profiles", profile);
+  const meta = await loadMeta(checkout, profile);
+  const rules = { include: resolved.include, exclude: resolved.exclude, denylist: resolved.denylist };
+  const homeFiles = await walk(claudeHome);
+  const repoFiles = await walk(profileDir);
+  const union = /* @__PURE__ */ new Set();
+  for (const p of homeFiles) if (isPathInScope(p, rules)) union.add(p);
+  for (const p of repoFiles) if (isPathInScope(p, rules)) union.add(p);
+  const out = [];
+  for (const rel of union) {
+    const home = await statMtime(path9.join(claudeHome, rel));
+    const repo = await statMtime(path9.join(profileDir, rel));
+    const lastSync = meta.files[rel] ?? null;
+    out.push({ rel, decision: decide({ home, repo, lastSync }), home, repo, lastSync });
+  }
+  return out;
+}
+async function syncActive(cfg, resolved, profile) {
+  const checkout = cfg.path;
+  const claudeHome = path9.join(homeRoot3(), ".claude");
+  const profileDir = path9.join(checkout, "profiles", profile);
+  await fs10.mkdir(profileDir, { recursive: true });
+  await git.fetch(checkout);
+  try {
+    await git.pull(checkout, resolved.git.pull_strategy);
+  } catch (err) {
+    throw new CliError(`git pull (${resolved.git.pull_strategy}) failed: ${err.message}`);
+  }
+  const meta = await loadMeta(checkout, profile);
+  const plan = await planSync(cfg, resolved, profile);
+  let conflicts = 0;
+  const nextMetaFiles = { ...meta.files };
+  const allRepoFiles = await walk(profileDir);
+  const rules = { include: resolved.include, exclude: resolved.exclude, denylist: resolved.denylist };
+  for (const rel of allRepoFiles) {
+    if (rel === "claude-profile.yaml" || rel === resolved.claude_json.partial_filename || rel.startsWith(".conflicts/")) continue;
+    if (!isPathInScope(rel, rules)) {
+      await fs10.rm(path9.join(profileDir, rel), { force: true });
+      delete nextMetaFiles[rel];
+    }
+  }
+  for (const item of plan) {
+    const rel = item.rel;
+    const homeAbs = path9.join(claudeHome, rel);
+    const repoAbs = path9.join(profileDir, rel);
+    const d = item.decision;
+    switch (d.kind) {
+      case "noop":
+        break;
+      case "copy-home-to-repo": {
+        await copyFile2(homeAbs, repoAbs, { hardlink: false });
+        const t = await statMtime(repoAbs);
+        if (t !== null) nextMetaFiles[rel] = t;
+        break;
+      }
+      case "copy-repo-to-home": {
+        await copyFile2(repoAbs, homeAbs, { hardlink: false });
+        const t = await statMtime(homeAbs);
+        if (t !== null) nextMetaFiles[rel] = t;
+        break;
+      }
+      case "delete-home":
+        await fs10.rm(homeAbs, { force: true });
+        delete nextMetaFiles[rel];
+        break;
+      case "delete-repo":
+        await fs10.rm(repoAbs, { force: true });
+        delete nextMetaFiles[rel];
+        break;
+      case "clear-meta":
+        delete nextMetaFiles[rel];
+        break;
+      case "conflict": {
+        conflicts++;
+        const ts = realTime.iso();
+        const loser = d.winner === "home" ? repoAbs : homeAbs;
+        const conflictDest = path9.join(profileDir, ".conflicts", `${rel}.${cfg.host}.${ts}`);
+        await copyFile2(loser, conflictDest, { hardlink: false });
+        const winnerAbs = d.winner === "home" ? homeAbs : repoAbs;
+        const otherAbs = d.winner === "home" ? repoAbs : homeAbs;
+        await copyFile2(winnerAbs, otherAbs, { hardlink: false });
+        const t = await statMtime(otherAbs);
+        if (t !== null) nextMetaFiles[rel] = t;
+        break;
+      }
+      case "delete-vs-change": {
+        if (d.winner === "repo") {
+          await copyFile2(repoAbs, homeAbs, { hardlink: false });
+          const t = await statMtime(homeAbs);
+          if (t !== null) nextMetaFiles[rel] = t;
+        } else {
+          await copyFile2(homeAbs, repoAbs, { hardlink: false });
+          const t = await statMtime(repoAbs);
+          if (t !== null) nextMetaFiles[rel] = t;
+        }
+        process.stderr.write(`warning: delete-vs-change for ${rel}; ${d.winner} won
+`);
+        break;
+      }
+    }
+  }
+  const claudeJsonPath = resolved.claude_json.path.replace(/^~/, homeRoot3());
+  const partialPath = path9.join(profileDir, resolved.claude_json.partial_filename);
+  const homeJson = JSON.parse(
+    await fs10.readFile(claudeJsonPath, "utf8").catch(() => "{}")
+  );
+  const repoJson = JSON.parse(
+    await fs10.readFile(partialPath, "utf8").catch(() => "{}")
+  );
+  const tsHome = await statMtime(claudeJsonPath) ?? 0;
+  const tsRepo = await statMtime(partialPath) ?? 0;
+  const mergedJson = mergeClaudeJson({
+    home: homeJson,
+    repo: repoJson,
+    meta: meta.claude_json,
+    tsHome,
+    tsRepo,
+    includeKeys: resolved.claude_json.include_keys
+  });
+  if (Object.keys(mergedJson.home).length > 0) {
+    await atomicWrite(claudeJsonPath, JSON.stringify(mergedJson.home, null, 2) + "\n");
+  }
+  if (Object.keys(mergedJson.repo).length > 0) {
+    await atomicWrite(partialPath, JSON.stringify(mergedJson.repo, null, 2) + "\n");
+  }
+  await saveMeta(checkout, profile, {
+    ...meta,
+    files: nextMetaFiles,
+    claude_json: mergedJson.meta
+  });
+  const relProfile = path9.join("profiles", profile);
+  const relState = path9.join(".claude-profile", profile);
+  await git.add(checkout, [relProfile, relState]);
+  const msg = tmpl(resolved.git.commit_message_template, {
+    host: cfg.host,
+    iso_ts: realTime.iso()
+  });
+  const committed = await git.commitIfStaged(checkout, msg);
+  if (committed && resolved.git.push) {
+    await git.push(checkout).catch((err) => {
+      process.stderr.write(`warn: push failed: ${err.message}
+`);
+    });
+  }
+  await atomicWrite(
+    path9.join(machineHomeRoot3(), "last-sync.timestamp"),
+    realTime.iso() + "\n"
+  );
+  return { conflicts };
+}
+function attachSync(program2) {
+  program2.command("sync").description("Pull, merge, commit, push the active (or named) profile").option("--profile <name>").option("--dry-run", "print plan; no writes", false).option("--quiet", "suppress non-error output", false).option("--background", "re-exec detached", false).option("--pull", "internal: SessionStart hook \u2014 pull only", false).option("--push", "internal: Stop hook \u2014 push only", false).action(
+    async (opts) => {
+      if (opts.quiet) process.env.CLAUDE_PROFILE_QUIET = "1";
+      const cfgPath = path9.join(machineHomeRoot3(), "config.json");
+      const cfg = await loadMachineConfig(cfgPath);
+      if (!cfg) throw new CliError("Run `claude-profile init --git <url>` first.");
+      const profile = opts.profile ?? cfg.active;
+      if (!profile) throw new CliError("No active profile. Pass --profile or activate one.");
+      const { repo, profile: pyaml } = await loadCheckoutYaml(cfg.path, profile);
+      const resolved = resolveConfig({
+        repo,
+        profile: pyaml,
+        env: process.env
+      });
+      if (opts.pull) {
+        const checkout = cfg.path;
+        const { repo: repo2, profile: pyaml2 } = await loadCheckoutYaml(checkout, profile);
+        const resolved2 = resolveConfig({
+          repo: repo2,
+          profile: pyaml2,
+          env: process.env
+        });
+        const plan = await planSync(cfg, resolved2, profile);
+        const hasHomeChanges = plan.some((p) => p.decision.kind === "copy-home-to-repo");
+        if (hasHomeChanges) {
+          await syncActive(cfg, resolved2, profile);
+        }
+        try {
+          await git.fetch(checkout);
+        } catch {
+          return;
+        }
+        try {
+          await git.pull(checkout, resolved2.git.pull_strategy);
+        } catch {
+          return;
+        }
+        await syncActive(cfg, resolved2, profile);
+        return;
+      }
+      if (opts.push) {
+        const debounceFile = path9.join(machineHomeRoot3(), "last-push.timestamp");
+        const lastPushIso = await fs10.readFile(debounceFile, "utf8").catch(() => null);
+        const { repo: repo2, profile: pyaml2 } = await loadCheckoutYaml(cfg.path, profile);
+        const resolved2 = resolveConfig({
+          repo: repo2,
+          profile: pyaml2,
+          env: process.env
+        });
+        if (lastPushIso) {
+          const lastMs = Date.parse(lastPushIso.trim());
+          if (!isNaN(lastMs) && Date.now() - lastMs < resolved2.autosync.push_debounce_seconds * 1e3) {
+            return;
+          }
+        }
+        await syncActive(cfg, resolved2, profile);
+        await atomicWrite(debounceFile, realTime.iso() + "\n");
+        return;
+      }
+      if (profile !== cfg.active) {
+        await git.fetch(cfg.path);
+        await git.pull(cfg.path, resolved.git.pull_strategy);
+        const metaPath = path9.join(cfg.path, ".claude-profile", profile, "meta.json");
+        if (!await fs10.stat(metaPath).catch(() => null)) {
+          await atomicWrite(metaPath, serializeMeta(emptyMeta()));
+          await git.add(cfg.path, [path9.join(".claude-profile", profile)]);
+          await git.commitIfStaged(cfg.path, `init meta for ${profile} from ${cfg.host}`);
+          if (resolved.git.push) await git.push(cfg.path).catch(() => {
+          });
+        }
+        return;
+      }
+      const lockPath = path9.join(machineHomeRoot3(), "sync.lock");
+      try {
+        const { conflicts } = await withLock(
+          lockPath,
+          async () => syncActive(cfg, resolved, profile)
+        );
+        if (conflicts > 0) process.exit(1);
+      } catch (err) {
+        if (err instanceof LockBusyError) {
+          process.stderr.write(err.message + "\n");
+          process.exit(2);
+        }
+        throw err;
+      }
+    }
+  );
+}
+
+// src/cli/describe.ts
+function homeRoot4() {
+  return process.env.HOME ?? os4.homedir();
+}
+function machineHomeRoot4() {
+  return process.env.CLAUDE_PROFILE_HOME ?? path10.join(homeRoot4(), ".claude-profile");
+}
+function parseFrontmatter(text) {
+  if (!text.startsWith("---")) return {};
+  const end = text.indexOf("\n---", 3);
+  if (end < 0) return {};
+  const block = text.slice(3, end);
+  const out = {};
+  for (const raw of block.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const m = /^([A-Za-z0-9_-]+)\s*:\s*(.*)$/.exec(line);
+    if (!m) continue;
+    const key = m[1] ?? "";
+    let val = (m[2] ?? "").trim();
+    if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+      val = val.slice(1, -1);
+    }
+    if (key === "name") out.name = val;
+    if (key === "description") out.description = val;
+  }
+  return out;
+}
+async function readJson(p) {
+  try {
+    return JSON.parse(await fs11.readFile(p, "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    return null;
+  }
+}
+function isRecord(x) {
+  return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+function summarizeSettings(obj) {
+  if (!isRecord(obj)) return null;
+  const permissions = isRecord(obj.permissions) ? obj.permissions : {};
+  const count = (k) => {
+    const v = permissions[k];
+    return Array.isArray(v) ? v.length : 0;
+  };
+  const env = isRecord(obj.env) ? Object.keys(obj.env) : [];
+  return {
+    model: typeof obj.model === "string" ? obj.model : null,
+    permissionMode: typeof permissions.defaultMode === "string" ? permissions.defaultMode : null,
+    permissions: { allow: count("allow"), deny: count("deny"), ask: count("ask") },
+    envVars: env,
+    statusLine: isRecord(obj.statusLine) && typeof obj.statusLine.type === "string" ? obj.statusLine.type : typeof obj.statusLine === "string" ? obj.statusLine : null,
+    outputStyle: typeof obj.outputStyle === "string" ? obj.outputStyle : null,
+    topLevelKeys: Object.keys(obj).sort()
+  };
+}
+function extractHooks(obj) {
+  if (!isRecord(obj) || !isRecord(obj.hooks)) return [];
+  const out = [];
+  for (const [event, raw] of Object.entries(obj.hooks)) {
+    const arr = Array.isArray(raw) ? raw : [];
+    for (const item of arr) {
+      if (!isRecord(item)) continue;
+      const matcher = typeof item.matcher === "string" ? item.matcher : "*";
+      const hooks = Array.isArray(item.hooks) ? item.hooks : [];
+      for (const h of hooks) {
+        if (!isRecord(h)) continue;
+        const handler = typeof h.command === "string" ? "command" : typeof h.type === "string" ? h.type : "unknown";
+        out.push({ event, matcher, handler });
+      }
+    }
+  }
+  return out;
+}
+function extractMcp(settings, mcpJson) {
+  const out = [];
+  const addServers = (source, servers) => {
+    if (!isRecord(servers)) return;
+    for (const [name, def] of Object.entries(servers)) {
+      if (!isRecord(def)) continue;
+      const transport = typeof def.type === "string" ? def.type : typeof def.transport === "string" ? def.transport : typeof def.url === "string" ? "http" : typeof def.command === "string" ? "stdio" : "unknown";
+      out.push({ name, transport, source });
+    }
+  };
+  if (isRecord(settings)) addServers("settings.json", settings.mcpServers);
+  if (isRecord(mcpJson)) addServers(".mcp.json", mcpJson.mcpServers ?? mcpJson);
+  return out;
+}
+async function listMarkdownEntries(root) {
+  const files = await walk(root);
+  const out = [];
+  for (const rel of files) {
+    if (!rel.endsWith(".md")) continue;
+    const abs = path10.join(root, rel);
+    try {
+      const text = await fs11.readFile(abs, "utf8");
+      out.push({ rel, fm: parseFrontmatter(text) });
+    } catch {
+    }
+  }
+  return out;
+}
+async function readSkills(skillsDir) {
+  const out = [];
+  let entries;
+  try {
+    entries = await fs11.readdir(skillsDir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    const skillFile = path10.join(skillsDir, ent.name, "SKILL.md");
+    try {
+      const text = await fs11.readFile(skillFile, "utf8");
+      const fm = parseFrontmatter(text);
+      out.push({
+        dir: ent.name,
+        name: fm.name ?? ent.name,
+        description: fm.description ?? ""
+      });
+    } catch {
+      out.push({ dir: ent.name, name: ent.name, description: "(no SKILL.md)" });
+    }
+  }
+  return out;
+}
+async function readListedDirs(parent) {
+  try {
+    const entries = await fs11.readdir(parent, { withFileTypes: true });
+    return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+async function readListedFiles(parent, ext) {
+  try {
+    const entries = await fs11.readdir(parent, { withFileTypes: true });
+    return entries.filter((e) => e.isFile() && e.name.endsWith(ext)).map((e) => e.name.replace(new RegExp(`${ext.replace(/\./g, "\\.")}$`), ""));
+  } catch {
+    return [];
+  }
+}
+async function fileSize(p) {
+  try {
+    return (await fs11.stat(p)).size;
+  } catch {
+    return 0;
+  }
+}
+async function gitInfo(cwd) {
+  const opts = { cwd, reject: false, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" } };
+  const br = await execa2("git", ["rev-parse", "--abbrev-ref", "HEAD"], opts);
+  const branch = br.exitCode === 0 && typeof br.stdout === "string" ? br.stdout.trim() : null;
+  const lg = await execa2(
+    "git",
+    ["log", "-1", "--format=%H%x09%cI%x09%s"],
+    opts
+  );
+  if (lg.exitCode !== 0 || typeof lg.stdout !== "string" || lg.stdout.trim() === "") {
+    return { branch, commit: null };
+  }
+  const [hash, iso, subject] = lg.stdout.trim().split("	");
+  return {
+    branch,
+    commit: {
+      hash: (hash ?? "").slice(0, 12),
+      iso: iso ?? "",
+      subject: subject ?? ""
+    }
+  };
+}
+async function countBackups(profile) {
+  const dir = path10.join(machineHomeRoot4(), "backups", profile);
+  let entries;
+  try {
+    entries = await fs11.readdir(dir, { withFileTypes: true });
+  } catch {
+    return { count: 0, newest: null, oldest: null };
+  }
+  const names = entries.filter((e) => e.isDirectory()).map((e) => e.name).sort();
+  if (names.length === 0) return { count: 0, newest: null, oldest: null };
+  return { count: names.length, newest: names[names.length - 1] ?? null, oldest: names[0] ?? null };
+}
+async function buildReport(cfg, profile, resolved) {
+  const checkout = cfg.path;
+  const profileDir = path10.join(checkout, "profiles", profile);
+  const allFiles = await walk(profileDir);
+  let totalBytes = 0;
+  const byTopDir = {};
+  for (const rel of allFiles) {
+    totalBytes += await fileSize(path10.join(profileDir, rel));
+    const top = rel.includes("/") ? rel.slice(0, rel.indexOf("/")) : rel;
+    byTopDir[top] = (byTopDir[top] ?? 0) + 1;
+  }
+  const settings = await readJson(path10.join(profileDir, "settings.json"));
+  const settingsLocal = await readJson(path10.join(profileDir, "settings.local.json"));
+  const mcpJson = await readJson(path10.join(profileDir, ".mcp.json"));
+  const cmdEntries = await listMarkdownEntries(path10.join(profileDir, "commands"));
+  const commands = cmdEntries.map((e) => ({
+    rel: e.rel,
+    name: e.fm.name ?? e.rel.replace(/\.md$/, "").replace(/\//g, ":"),
+    description: e.fm.description ?? ""
+  }));
+  const skills = await readSkills(path10.join(profileDir, "skills"));
+  const agentEntries = await listMarkdownEntries(path10.join(profileDir, "agents"));
+  const agents = agentEntries.map((e) => ({
+    rel: e.rel,
+    name: e.fm.name ?? e.rel.replace(/\.md$/, "").replace(/\//g, ":"),
+    description: e.fm.description ?? ""
+  }));
+  const plugins = await readListedDirs(path10.join(profileDir, "plugins"));
+  const outputStyles = [
+    ...await readListedFiles(path10.join(profileDir, "output-styles"), ".md"),
+    ...await readListedFiles(path10.join(profileDir, "output-styles"), ".json")
+  ];
+  const partial = await readJson(
+    path10.join(profileDir, resolved.claude_json.partial_filename)
+  );
+  const trackedJsonKeys = partial ? Object.entries(partial).map(([k, v]) => ({ key: k, type: Array.isArray(v) ? "array" : typeof v })) : [];
+  const homeJsonPath = resolved.claude_json.path.replace(/^~/, homeRoot4());
+  const homeJson = await readJson(homeJsonPath);
+  const homeJsonAvailable = homeJson !== null;
+  const includeSet = new Set(resolved.claude_json.include_keys);
+  const excludedJsonKeys = homeJson ? Object.entries(homeJson).filter(([k]) => !includeSet.has(k)).map(([k, v]) => ({
+    key: k,
+    type: Array.isArray(v) ? "array" : typeof v,
+    bytes: JSON.stringify(v).length
+  })).sort((a, b) => b.bytes - a.bytes) : [];
+  const { branch, commit: commit2 } = await gitInfo(checkout);
+  const lastSyncFile = path10.join(machineHomeRoot4(), "last-sync.timestamp");
+  let lastSync = null;
+  if (cfg.active === profile) {
+    try {
+      lastSync = (await fs11.readFile(lastSyncFile, "utf8")).trim() || null;
+    } catch {
+      lastSync = null;
+    }
+  }
+  return {
+    profile: {
+      name: profile,
+      active: cfg.active === profile,
+      registered: cfg.profiles.includes(profile),
+      host: cfg.host,
+      repo: checkout,
+      branch,
+      lastCommit: commit2,
+      lastSync
+    },
+    rules: {
+      include: resolved.include,
+      exclude: resolved.exclude,
+      denylist: resolved.denylist
+    },
+    files: { count: allFiles.length, bytes: totalBytes, byTopDir },
+    settings: summarizeSettings(settings),
+    settingsLocal: summarizeSettings(settingsLocal),
+    hooks: [...extractHooks(settings), ...extractHooks(settingsLocal)],
+    mcp: extractMcp(settings, mcpJson),
+    commands,
+    skills,
+    agents,
+    plugins,
+    outputStyles,
+    trackedJsonKeys,
+    excludedJsonKeys,
+    homeJsonAvailable,
+    backups: await countBackups(profile)
+  };
+}
+function fmtBytes(n) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / 1024 / 1024).toFixed(2)} MB`;
+}
+function pad(s, n) {
+  return s.length >= n ? s + " " : s + " ".repeat(n - s.length);
+}
+function renderHuman(r, brief) {
+  const lines = [];
+  const tags = [];
+  if (r.profile.active) tags.push("active");
+  if (r.profile.registered && !r.profile.active) tags.push("registered");
+  if (!r.profile.registered) tags.push("repo-only");
+  lines.push(`Profile: ${r.profile.name}  (${tags.join(", ")})`);
+  lines.push("\u2500".repeat(60));
+  lines.push(`Host:        ${r.profile.host}`);
+  lines.push(`Repo:        ${r.profile.repo}`);
+  if (r.profile.branch) lines.push(`Branch:      ${r.profile.branch}`);
+  if (r.profile.lastCommit) {
+    lines.push(
+      `Last commit: ${r.profile.lastCommit.hash} \u2014 ${r.profile.lastCommit.iso} \u2014 ${r.profile.lastCommit.subject}`
+    );
+  }
+  if (r.profile.lastSync) lines.push(`Last sync:   ${r.profile.lastSync}`);
+  lines.push("");
+  lines.push("Sync rules");
+  lines.push(`  include:  ${r.rules.include.length} patterns`);
+  lines.push(`  exclude:  ${r.rules.exclude.length} patterns`);
+  lines.push(`  denylist: ${r.rules.denylist.length} patterns`);
+  lines.push(`  tracked:  ${r.files.count} files (${fmtBytes(r.files.bytes)})`);
+  const topDirs = Object.entries(r.files.byTopDir).sort((a, b) => b[1] - a[1]);
+  if (!brief && topDirs.length > 0) {
+    for (const [d, c] of topDirs) lines.push(`    ${pad(d, 24)} ${c} files`);
+  }
+  lines.push("");
+  const renderSettings = (label, s) => {
+    lines.push(label);
+    if (!s) {
+      lines.push("  (none)");
+      lines.push("");
+      return;
+    }
+    lines.push(`  model:        ${s.model ?? "(default)"}`);
+    lines.push(`  permissions:  ${s.permissionMode ?? "(default)"} (allow: ${s.permissions.allow}, deny: ${s.permissions.deny}, ask: ${s.permissions.ask})`);
+    lines.push(`  env vars:     ${s.envVars.length}${s.envVars.length > 0 && !brief ? ` (${s.envVars.join(", ")})` : ""}`);
+    lines.push(`  statusLine:   ${s.statusLine ?? "(none)"}`);
+    lines.push(`  outputStyle:  ${s.outputStyle ?? "(default)"}`);
+    if (!brief) lines.push(`  top-level:    ${s.topLevelKeys.join(", ") || "(empty)"}`);
+    lines.push("");
+  };
+  renderSettings("Settings (settings.json)", r.settings);
+  if (r.settingsLocal) renderSettings("Settings (settings.local.json)", r.settingsLocal);
+  lines.push(`Hooks (${r.hooks.length})`);
+  if (r.hooks.length === 0) lines.push("  (none)");
+  else if (!brief) {
+    const byEvent = /* @__PURE__ */ new Map();
+    for (const h of r.hooks) {
+      if (!byEvent.has(h.event)) byEvent.set(h.event, []);
+      byEvent.get(h.event).push(h);
+    }
+    for (const [event, items] of byEvent) {
+      lines.push(`  ${event} (${items.length})`);
+      for (const h of items) lines.push(`    - matcher=${h.matcher}  handler=${h.handler}`);
+    }
+  }
+  lines.push("");
+  lines.push(`MCP servers (${r.mcp.length})`);
+  if (r.mcp.length === 0) lines.push("  (none)");
+  else if (!brief) {
+    for (const m of r.mcp) lines.push(`  - ${pad(m.name, 28)} ${pad(m.transport, 10)} ${m.source}`);
+  }
+  lines.push("");
+  lines.push(`Slash commands (${r.commands.length})`);
+  if (!brief) for (const c of r.commands) lines.push(`  /${pad(c.name, 28)} ${c.description}`);
+  lines.push("");
+  lines.push(`Skills (${r.skills.length})`);
+  if (!brief) for (const s of r.skills) lines.push(`  ${pad(s.name, 28)} ${s.description}`);
+  lines.push("");
+  lines.push(`Subagents (${r.agents.length})`);
+  if (!brief) for (const a of r.agents) lines.push(`  ${pad(a.name, 28)} ${a.description}`);
+  lines.push("");
+  lines.push(`Plugins (${r.plugins.length})`);
+  if (!brief && r.plugins.length > 0) for (const p of r.plugins) lines.push(`  ${p}`);
+  lines.push("");
+  lines.push(`Output styles (${r.outputStyles.length})`);
+  if (!brief && r.outputStyles.length > 0) for (const o of r.outputStyles) lines.push(`  ${o}`);
+  lines.push("");
+  lines.push(`Tracked ~/.claude.json keys (${r.trackedJsonKeys.length})`);
+  if (!brief) for (const k of r.trackedJsonKeys) lines.push(`  - ${pad(k.key, 28)} ${k.type}`);
+  lines.push("");
+  lines.push(`Excluded ~/.claude.json keys (${r.excludedJsonKeys.length})`);
+  if (!r.homeJsonAvailable) {
+    lines.push("  (~/.claude.json not readable on this machine \u2014 only meaningful on the active profile's host)");
+  } else if (!brief) {
+    for (const k of r.excludedJsonKeys) {
+      lines.push(`  - ${pad(k.key, 28)} ${pad(k.type, 10)} ${fmtBytes(k.bytes)}`);
+    }
+  }
+  lines.push("");
+  lines.push(`Backups: ${r.backups.count}` + (r.backups.count > 0 ? ` (newest ${r.backups.newest}, oldest ${r.backups.oldest})` : ""));
+  return lines.join("\n") + "\n";
+}
+function attachDescribe(program2) {
+  program2.command("describe [name]").description("Show everything in a profile: settings, hooks, MCP, commands, skills, agents, plugins, backups").option("--json", "emit JSON", false).option("--brief", "counts only; no per-item listings", false).action(async (name, opts) => {
+    const cfg = await loadMachineConfig(path10.join(machineHomeRoot4(), "config.json"));
+    if (!cfg) throw new CliError("Run `claude-profile init --git <url>` first.");
+    const profile = name ?? cfg.active;
+    if (!profile) throw new CliError("No active profile. Pass a profile name or activate one.");
+    const profileDir = path10.join(cfg.path, "profiles", profile);
+    try {
+      await fs11.stat(profileDir);
+    } catch {
+      throw new CliError(`Profile "${profile}" not found at ${profileDir}.`);
+    }
+    const { repo, profile: pyaml } = await loadCheckoutYaml(cfg.path, profile);
+    const resolved = resolveConfig({
+      repo,
+      profile: pyaml,
+      env: process.env
+    });
+    const report = await buildReport(cfg, profile, resolved);
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+    } else {
+      process.stdout.write(renderHuman(report, opts.brief === true));
+    }
+  });
+}
+
+// src/cli/diff.ts
+import * as fs12 from "fs/promises";
+import * as path11 from "path";
+import * as os5 from "os";
+import { execa as execa3 } from "execa";
+function configPath() {
+  const root = process.env.CLAUDE_PROFILE_HOME ?? path11.join(process.env.HOME ?? os5.homedir(), ".claude-profile");
+  return path11.join(root, "config.json");
+}
+function homeRoot5() {
+  return process.env.HOME ?? os5.homedir();
+}
+function attachDiff(program2) {
+  program2.command("diff").description("Unified diff between home and repo for one path").argument("<path>").option("--profile <name>", "profile (defaults to active)").action(async (relPath, opts) => {
+    const cfg = await loadMachineConfig(configPath());
+    if (!cfg) {
+      process.stderr.write("Run `init` first.\n");
+      process.exit(2);
+    }
+    const profile = opts.profile ?? cfg.active;
+    if (!profile) {
+      process.stderr.write("No active profile.\n");
+      process.exit(2);
+    }
+    if (relPath === "claude.json") {
+      const home = JSON.parse(
+        await fs12.readFile(path11.join(homeRoot5(), ".claude.json"), "utf8").catch(() => "{}")
+      );
+      const partial = JSON.parse(
+        await fs12.readFile(
+          path11.join(cfg.path, "profiles", profile, "claude.json.partial"),
+          "utf8"
+        ).catch(() => "{}")
+      );
+      process.stdout.write(JSON.stringify({ home, repo: partial }, null, 2));
+      return;
+    }
+    const homePath = path11.join(homeRoot5(), ".claude", relPath);
+    const repoPath = path11.join(cfg.path, "profiles", profile, relPath);
+    const res = await execa3("diff", ["-u", repoPath, homePath], {
+      reject: false
+    });
+    if (res.exitCode === 2) {
+      const stderr = typeof res.stderr === "string" ? res.stderr : "";
+      process.stderr.write(stderr + "\n");
+      process.exit(2);
+    }
+    const stdout = typeof res.stdout === "string" ? res.stdout : "";
+    process.stdout.write(stdout);
+  });
+}
+
+// src/cli/init.ts
+import * as fs13 from "fs/promises";
+import * as path12 from "path";
+import * as os6 from "os";
+function machineHomeRoot5() {
+  return process.env.CLAUDE_PROFILE_HOME ?? path12.join(process.env.HOME ?? os6.homedir(), ".claude-profile");
+}
+function configPath2() {
+  return path12.join(machineHomeRoot5(), "config.json");
+}
+function defaultCheckoutPath() {
+  return path12.join(machineHomeRoot5(), "git");
+}
+function claudeHomeRoot() {
+  return path12.join(process.env.HOME ?? os6.homedir(), ".claude");
+}
+async function isGitRepo(p) {
+  return await git.revParse(p, "HEAD").catch(() => null) !== null || await fs13.stat(path12.join(p, ".git")).catch(() => null) !== null;
+}
+async function seedProfileFromHome(opts) {
+  const cfg = resolveConfig({});
+  const rules = { include: cfg.include, exclude: cfg.exclude, denylist: cfg.denylist };
+  const profileDir = path12.join(opts.checkout, "profiles", opts.profile);
+  await fs13.mkdir(profileDir, { recursive: true });
+  const all = await walk(opts.claudeHome);
+  const files = all.filter((p) => isPathInScope(p, rules));
+  const metaFiles = {};
+  for (const rel of files) {
+    await copyFile2(path12.join(opts.claudeHome, rel), path12.join(profileDir, rel), { hardlink: false });
+    const t = await statMtime(path12.join(profileDir, rel));
+    if (t !== null) metaFiles[rel] = t;
+  }
+  const metaDir = path12.join(opts.checkout, ".claude-profile", opts.profile);
+  await fs13.mkdir(metaDir, { recursive: true });
+  const meta = { version: 1, files: metaFiles, claude_json: {} };
+  await atomicWrite(path12.join(metaDir, "meta.json"), serializeMeta(meta));
+  return files.length;
+}
+function attachInit(program2) {
+  program2.command("init").description("Clone repo and register a profile on this machine").requiredOption("--git <url>", "git remote URL").option("--profile <name>", "profile name", "default").option("--path <dir>", "local clone path").option("--activate", "activate this profile after init").action(
+    async (opts) => {
+      const checkout = opts.path ?? defaultCheckoutPath();
+      const cfgPath = configPath2();
+      const existing = await loadMachineConfig(cfgPath);
+      if (existing) {
+        if (existing.git !== opts.git) {
+          throw new CliError(
+            `config already set for repo ${existing.git}; run \`claude-profile config set git ${opts.git}\` to repoint`
+          );
+        }
+        if (existing.path !== checkout) {
+          throw new CliError(
+            `config already set for path ${existing.path}; run \`claude-profile config set path ${checkout}\``
+          );
+        }
+      }
+      const exists = await fs13.stat(checkout).catch(() => null);
+      if (exists && !await isGitRepo(checkout)) {
+        const entries = await fs13.readdir(checkout);
+        if (entries.length > 0) {
+          throw new CliError(`checkout path ${checkout} exists and is not a git repo`);
+        }
+      }
+      if (await isGitRepo(checkout)) {
+        await git.fetch(checkout);
+      } else {
+        await fs13.mkdir(path12.dirname(checkout), { recursive: true });
+        await git.clone(opts.git, checkout);
+      }
+      const host = existing?.host || os6.hostname().split(".")[0] || "host";
+      let cfg = existing ?? {
+        git: opts.git,
+        path: checkout,
+        active: null,
+        profiles: [],
+        host
+      };
+      cfg = addProfile(cfg, opts.profile);
+      if (cfg.active === null) cfg.active = opts.profile;
+      if (opts.activate) cfg.active = opts.profile;
+      await saveMachineConfig(cfgPath, cfg);
+      const claudeHome = claudeHomeRoot();
+      const profileDir = path12.join(checkout, "profiles", opts.profile);
+      const profileExists = await fs13.stat(profileDir).catch(() => null);
+      if (!profileExists) {
+        const n = await seedProfileFromHome({ checkout, profile: opts.profile, claudeHome });
+        const stateDir = path12.join(".claude-profile", opts.profile);
+        await git.add(checkout, [path12.join("profiles", opts.profile), stateDir]);
+        await git.commitIfStaged(checkout, `scaffold ${opts.profile} from ${cfg.host} (${n} files)`);
+        await git.push(checkout).catch(() => {
+        });
+      } else if (opts.activate) {
+        const resolved = resolveConfig({});
+        const rules = { include: resolved.include, exclude: resolved.exclude, denylist: resolved.denylist };
+        const allRepo = await walk(profileDir);
+        const files = allRepo.filter((p) => isPathInScope(p, rules));
+        for (const rel of files) {
+          await copyFile2(path12.join(profileDir, rel), path12.join(claudeHome, rel), { hardlink: false });
+        }
+      }
+      process.stdout.write(`Initialized profile "${opts.profile}" at ${checkout}
+`);
+    }
+  );
+}
+
+// src/cli/list.ts
+import * as fs14 from "fs/promises";
+import * as path13 from "path";
+import * as os7 from "os";
+function configPath3() {
+  const root = process.env.CLAUDE_PROFILE_HOME ?? path13.join(process.env.HOME ?? os7.homedir(), ".claude-profile");
+  return path13.join(root, "config.json");
+}
+function attachList(program2) {
+  program2.command("list").description("List registered profiles, mark active and repo-only profiles").action(async () => {
+    const cfg = await loadMachineConfig(configPath3());
+    if (!cfg) {
+      process.stderr.write("Run `claude-profile init --git <url>` first.\n");
+      process.exit(2);
+    }
+    let repoProfiles = [];
+    try {
+      const dirs = await fs14.readdir(path13.join(cfg.path, "profiles"), {
+        withFileTypes: true
+      });
+      repoProfiles = dirs.filter((d) => d.isDirectory()).map((d) => d.name);
+    } catch {
+    }
+    const lines = [];
+    for (const name of cfg.profiles) {
+      const tag = name === cfg.active ? "(active)" : "(registered)";
+      lines.push(`  ${name.padEnd(20)} ${tag}`);
+    }
+    for (const name of repoProfiles) {
+      if (cfg.profiles.includes(name)) continue;
+      lines.push(
+        `  ${name.padEnd(20)} (in repo, not registered on this machine \u2014 run \`init --profile ${name}\` to add)`
+      );
+    }
+    process.stdout.write(lines.join("\n") + "\n");
+  });
+}
+
+// src/cli/install-skill.ts
+import * as fs15 from "fs/promises";
+import * as path14 from "path";
+import * as os8 from "os";
+function homeRoot6() {
+  return process.env.HOME ?? os8.homedir();
+}
+var SKILL_CONTENT = `---
+name: profile
+description: Use when the user mentions syncing/pushing/pulling Claude Code config, switching profiles, adopting current ~/.claude/ as a profile, merging profiles, inspecting profile drift, or listing profiles. Also fires when the user is about to edit files under ~/.claude/. Documents the auto-sync behavior so Claude does not double-trigger syncs.
+---
+
+# /profile \u2014 claude-profile CLI
+
+\`claude-profile\` (npm package) syncs ~/.claude/ across machines via a shared git repo
+that holds multiple named profiles. Each machine has one active profile reflected
+into ~/.claude/ and can switch between any profile it has registered.
+
+## Auto-sync is already wired up
+
+Two hooks bracket every Claude session:
+
+- **SessionStart** runs \`claude-profile sync --pull\` (synchronous, 3 s timeout) \u2014 fast-forwards from the remote and materializes any new commits into ~/.claude/ before the session starts.
+- **Stop** runs \`claude-profile sync --push\` (background) \u2014 diffs ~/.claude/ against the repo and, if anything in the tracked paths changed, commits and pushes.
+
+You do not need to manually invoke sync after editing skills, agents, hooks, settings, etc. during a session \u2014 the Stop hook will pick it up. The only time to run \`sync\` by hand is when the user edited config *outside* a Claude session, or explicitly asks for an immediate push/pull.
+
+## When to run sync manually
+
+- The user explicitly asked ("sync my profile", "push my claude config").
+- The user is about to switch machines and wants a clean push before logging off.
+- After resolving a conflict file under \`profiles/<active>/.conflicts/\`.
+
+## Commands
+
+| Command | Purpose |
+|---|---|
+| \`claude-profile sync\` | Full cycle: pull, merge, commit, push (active profile). |
+| \`claude-profile status\` | Show what sync would do; no writes. |
+| \`claude-profile diff <path>\` | Unified diff between home and repo for one path. |
+| \`claude-profile use <name>\` | Switch active profile (rewrites ~/.claude/). |
+| \`claude-profile adopt <name> [--overwrite] [--switch]\` | Snapshot current ~/.claude/ into \`profiles/<name>/\`. |
+| \`claude-profile merge <source> --into <dest> [--strategy \u2026]\` | Best-effort merge of one profile into another. |
+| \`claude-profile list\` | Show all profiles in the repo. |
+| \`claude-profile init --git <url> [--profile <name>]\` | First-time setup, or add a new profile. |
+| \`claude-profile config get/set/unset\` | Per-machine config. |
+
+## Conflicts
+
+If both machines edited the same file between syncs, the newer is kept and the
+loser is written to \`profiles/<active>/.conflicts/<path>.<host>.<ts>\`.
+
+## Scope
+
+Synced: settings.json, agents/, skills/, hooks/, statusline, CLAUDE.md, plugin
+install list, marketplaces metadata, and selective ~/.claude.json keys.
+
+Not synced: credentials, caches, sessions, daemon state, project history,
+oauthAccount, plugin code.
+`;
+function hookEntry(id, command, timeoutSec) {
+  const inner = { type: "command", command };
+  if (timeoutSec !== void 0) inner.timeout_seconds = timeoutSec;
+  return { id, hooks: [inner] };
+}
+async function mergeHooks(claudeHome, withHooks) {
+  const settingsPath = path14.join(claudeHome, "settings.json");
+  const raw = await fs15.readFile(settingsPath, "utf8").catch(() => "{}");
+  const cfg = JSON.parse(raw);
+  cfg.hooks = cfg.hooks ?? {};
+  cfg.hooks.SessionStart = cfg.hooks.SessionStart ?? [];
+  cfg.hooks.Stop = cfg.hooks.Stop ?? [];
+  if (!withHooks) {
+    cfg.hooks.SessionStart = cfg.hooks.SessionStart.filter((e) => e.id !== "claude-profile-pull");
+    cfg.hooks.Stop = cfg.hooks.Stop.filter((e) => e.id !== "claude-profile-push");
+  } else {
+    const resolved = resolveConfig({});
+    const pullCmd = `timeout ${resolved.autosync.pull_timeout_seconds} ${resolved.autosync.pull_command} || true`;
+    const pullId = resolved.autosync.hook_id_pull;
+    const pushCmd = resolved.autosync.push_command;
+    const pushId = resolved.autosync.hook_id_push;
+    cfg.hooks.SessionStart = cfg.hooks.SessionStart.filter((e) => e.id !== pullId);
+    cfg.hooks.SessionStart.push(hookEntry(pullId, pullCmd, resolved.autosync.pull_timeout_seconds));
+    cfg.hooks.Stop = cfg.hooks.Stop.filter((e) => e.id !== pushId);
+    cfg.hooks.Stop.push(hookEntry(pushId, pushCmd));
+  }
+  await atomicWrite(settingsPath, JSON.stringify(cfg, null, 2) + "\n");
+}
+function attachInstallSkill(program2) {
+  program2.command("install-skill").description("Install the /profile skill + SessionStart/Stop hooks").option("--no-hook", "skip hook installation").action(async (opts) => {
+    const claudeHome = path14.join(homeRoot6(), ".claude");
+    const skillPath = path14.join(claudeHome, "skills", "profile", "SKILL.md");
+    await atomicWrite(skillPath, SKILL_CONTENT);
+    await mergeHooks(claudeHome, opts.hook !== false);
+    process.stdout.write(`Installed skill at ${skillPath}
+`);
+  });
+}
+
+// src/cli/merge.ts
+import * as fs16 from "fs/promises";
+import * as path15 from "path";
+import * as os9 from "os";
+function homeRoot7() {
+  return process.env.HOME ?? os9.homedir();
+}
+function machineHomeRoot6() {
+  return process.env.CLAUDE_PROFILE_HOME ?? path15.join(homeRoot7(), ".claude-profile");
+}
+function attachMerge(program2) {
+  program2.command("merge").description("Best-effort merge of one profile into another").argument("<source>").requiredOption("--into <dest>").option("--strategy <s>", "prefer-dest|prefer-source|newer|mark-conflicts", "prefer-dest").option("--dry-run", "print plan; no writes", false).option("--no-apply", "skip post-merge sync into ~/.claude/ when dest is active", false).option("--no-push", "do not push after commit", false).action(async (source, opts) => {
+    const cfg = await loadMachineConfig(path15.join(machineHomeRoot6(), "config.json"));
+    if (!cfg) throw new CliError("Run `init` first.");
+    const checkout = cfg.path;
+    const srcDir = path15.join(checkout, "profiles", source);
+    const dstDir = path15.join(checkout, "profiles", opts.into);
+    const srcExists = await fs16.stat(srcDir).catch(() => null);
+    const dstExists = await fs16.stat(dstDir).catch(() => null);
+    if (!srcExists) throw new CliError(`source profile "${source}" not found in repo`);
+    if (!dstExists) throw new CliError(`dest profile "${opts.into}" not found in repo`);
+    const readYaml = async (p) => {
+      try {
+        return parseYamlConfig(await fs16.readFile(p, "utf8"));
+      } catch {
+        return {};
+      }
+    };
+    const repoYaml = await readYaml(path15.join(checkout, "claude-profile.yaml"));
+    const dstYaml = await readYaml(path15.join(dstDir, "claude-profile.yaml"));
+    const resolved = resolveConfig({
+      repo: repoYaml,
+      profile: dstYaml
+    });
+    const rules = { include: resolved.include, exclude: resolved.exclude, denylist: resolved.denylist };
+    const srcFiles = await walk(srcDir);
+    const dstFiles = await walk(dstDir);
+    const union = /* @__PURE__ */ new Set([...srcFiles, ...dstFiles]);
+    const items = [];
+    for (const rel of union) {
+      if (rel === "claude-profile.yaml") continue;
+      if (rel === resolved.claude_json.partial_filename) continue;
+      if (rel.startsWith(".conflicts/")) continue;
+      const inScope = isPathInScope(rel, rules);
+      if (!inScope) {
+        if (srcFiles.includes(rel) && !dstFiles.includes(rel)) {
+          items.push({ rel, classification: "out-of-scope", srcMtime: null, dstMtime: null });
+        }
+        continue;
+      }
+      const srcMt = srcFiles.includes(rel) ? await statMtime(path15.join(srcDir, rel)) : null;
+      const dstMt = dstFiles.includes(rel) ? await statMtime(path15.join(dstDir, rel)) : null;
+      let cls;
+      if (srcMt !== null && dstMt === null) cls = "source-only";
+      else if (srcMt === null && dstMt !== null) cls = "dest-only";
+      else {
+        const srcSha = await sha256File(path15.join(srcDir, rel));
+        const dstSha = await sha256File(path15.join(dstDir, rel));
+        cls = srcSha === dstSha ? "identical" : "conflict";
+      }
+      items.push({ rel, classification: cls, srcMtime: srcMt, dstMtime: dstMt });
+    }
+    const counts = { "source-only": 0, "dest-only": 0, "identical": 0, "conflict": 0, "out-of-scope": 0 };
+    for (const it of items) counts[it.classification]++;
+    const outOfScopePaths = items.filter((i) => i.classification === "out-of-scope").map((i) => i.rel);
+    if (opts.dryRun) {
+      process.stdout.write(`Plan: merge ${source} \u2192 ${opts.into} (strategy: ${opts.strategy})
+`);
+      for (const [k, n] of Object.entries(counts)) process.stdout.write(`  ${k}: ${n}
+`);
+      for (const p of outOfScopePaths) process.stdout.write(`  out-of-scope: ${p}
+`);
+      return;
+    }
+    let conflictCount = 0;
+    for (const it of items) {
+      if (it.classification === "out-of-scope") {
+        process.stderr.write(`skipped: ${it.rel} \u2014 not in ${opts.into}'s include rules
+`);
+        continue;
+      }
+      if (it.classification === "identical" || it.classification === "dest-only") continue;
+      if (it.classification === "source-only") {
+        await copyFile2(path15.join(srcDir, it.rel), path15.join(dstDir, it.rel), { hardlink: false });
+        continue;
+      }
+      switch (opts.strategy) {
+        case "prefer-dest":
+          break;
+        case "prefer-source":
+          await copyFile2(path15.join(srcDir, it.rel), path15.join(dstDir, it.rel), { hardlink: false });
+          break;
+        case "newer": {
+          const useSrc = (it.srcMtime ?? 0) > (it.dstMtime ?? 0);
+          if (useSrc) await copyFile2(path15.join(srcDir, it.rel), path15.join(dstDir, it.rel), { hardlink: false });
+          break;
+        }
+        case "mark-conflicts": {
+          conflictCount++;
+          const dest = path15.join(dstDir, ".conflicts", `${it.rel}.${source}.${realTime.iso()}`);
+          await copyFile2(path15.join(srcDir, it.rel), dest, { hardlink: false });
+          break;
+        }
+      }
+    }
+    const srcPartialPath = path15.join(srcDir, resolved.claude_json.partial_filename);
+    const dstPartialPath = path15.join(dstDir, resolved.claude_json.partial_filename);
+    const srcPartial = JSON.parse(await fs16.readFile(srcPartialPath, "utf8").catch(() => "{}"));
+    const dstPartial = JSON.parse(await fs16.readFile(dstPartialPath, "utf8").catch(() => "{}"));
+    const merged = { ...dstPartial };
+    for (const k of Object.keys(srcPartial)) {
+      if (!(k in merged)) merged[k] = srcPartial[k];
+      else if (opts.strategy === "prefer-source") merged[k] = srcPartial[k];
+      else if (opts.strategy === "mark-conflicts" && JSON.stringify(merged[k]) !== JSON.stringify(srcPartial[k])) {
+        const marker = path15.join(dstDir, ".conflicts", `${resolved.claude_json.partial_filename}.${k}.${source}.${realTime.iso()}.json`);
+        await atomicWrite(marker, JSON.stringify(srcPartial[k], null, 2) + "\n");
+        conflictCount++;
+      }
+    }
+    if (Object.keys(merged).length > 0) {
+      await atomicWrite(dstPartialPath, JSON.stringify(merged, null, 2) + "\n");
+    }
+    const metaPath = path15.join(checkout, ".claude-profile", opts.into, "meta.json");
+    const meta = await fs16.readFile(metaPath, "utf8").then(parseMeta).catch(() => emptyMeta());
+    const newFiles = { ...meta.files };
+    const allFiles = await walk(dstDir);
+    for (const rel of allFiles) {
+      if (rel.startsWith(".conflicts/")) continue;
+      if (rel === "claude-profile.yaml") continue;
+      if (rel === resolved.claude_json.partial_filename) continue;
+      const mt = await statMtime(path15.join(dstDir, rel));
+      if (mt !== null) newFiles[rel] = mt;
+    }
+    await atomicWrite(metaPath, serializeMeta({ ...meta, files: newFiles }));
+    const relP = path15.join("profiles", opts.into);
+    const relS = path15.join(".claude-profile", opts.into);
+    await git.add(checkout, [relP, relS]);
+    let msg = `merge ${source} into ${opts.into} (${opts.strategy}) from ${cfg.host} at ${realTime.iso()}`;
+    if (conflictCount > 0) msg += ` [${conflictCount} conflict(s)]`;
+    await git.commitIfStaged(checkout, msg);
+    if (opts.push !== false) await git.push(checkout).catch(() => {
+    });
+    if (opts.into === cfg.active && opts.apply !== false) {
+      const { execa: execa5 } = await import("execa");
+      await execa5("npx", ["tsx", "src/bin/claude-profile.ts", "sync"], { reject: false });
+    }
+    process.stdout.write(`Merged ${source} \u2192 ${opts.into} (strategy: ${opts.strategy})
+`);
+    for (const [k, n] of Object.entries(counts)) process.stdout.write(`  ${k}: ${n}
+`);
+    if (opts.strategy === "mark-conflicts" && conflictCount > 0) process.exit(1);
+  });
+}
+
+// src/cli/status.ts
+import * as path16 from "path";
+import * as os10 from "os";
+function machineHomeRoot7() {
+  return process.env.CLAUDE_PROFILE_HOME ?? path16.join(process.env.HOME ?? os10.homedir(), ".claude-profile");
+}
+function attachStatus(program2) {
+  program2.command("status").description("Show what sync would do; no writes").option("--profile <name>").action(async (opts) => {
+    const cfg = await loadMachineConfig(path16.join(machineHomeRoot7(), "config.json"));
+    if (!cfg) throw new CliError("Run `init` first.");
+    const profile = opts.profile ?? cfg.active;
+    if (!profile) throw new CliError("No active profile.");
+    const { repo, profile: pyaml } = await loadCheckoutYaml(cfg.path, profile);
+    const resolved = resolveConfig({
+      repo,
+      profile: pyaml,
+      env: process.env
+    });
+    const plan = await planSync(cfg, resolved, profile);
+    for (const item of plan) {
+      if (item.decision.kind === "noop") continue;
+      const label = item.decision.kind.replace("copy-home-to-repo", "home\u2192repo").replace("copy-repo-to-home", "repo\u2192home");
+      process.stdout.write(`${label.padEnd(14)} ${item.rel}
+`);
+    }
+  });
+}
+
+// src/cli/use.ts
+import * as fs17 from "fs/promises";
+import * as path17 from "path";
+import * as os11 from "os";
+import { execa as execa4 } from "execa";
+function homeRoot8() {
+  return process.env.HOME ?? os11.homedir();
+}
+function machineHomeRoot8() {
+  return process.env.CLAUDE_PROFILE_HOME ?? path17.join(homeRoot8(), ".claude-profile");
+}
+function attachUse(program2) {
+  program2.command("use").description("Switch active profile (always backs up first)").argument("<name>").action(async (name) => {
+    const cfgPath = path17.join(machineHomeRoot8(), "config.json");
+    const cfg = await loadMachineConfig(cfgPath);
+    if (!cfg) throw new CliError("Run `init` first.");
+    if (!cfg.profiles.includes(name)) {
+      throw new CliError(
+        `profile "${name}" is not registered on this machine; run \`claude-profile init --profile ${name} --activate\``
+      );
+    }
+    const outgoing = cfg.active;
+    const claudeHome = path17.join(homeRoot8(), ".claude");
+    if (outgoing) {
+      await execa4("npx", ["tsx", "src/bin/claude-profile.ts", "sync"], {
+        env: process.env,
+        cwd: process.cwd(),
+        reject: false
+      });
+    }
+    const readYaml = async (p) => {
+      try {
+        return parseYamlConfig(await fs17.readFile(p, "utf8"));
+      } catch {
+        return {};
+      }
+    };
+    const repoYaml = await readYaml(path17.join(cfg.path, "claude-profile.yaml"));
+    const outgoingYaml = outgoing ? await readYaml(path17.join(cfg.path, "profiles", outgoing, "claude-profile.yaml")) : {};
+    const incomingYaml = await readYaml(
+      path17.join(cfg.path, "profiles", name, "claude-profile.yaml")
+    );
+    const outgoingCfg = resolveConfig({
+      repo: repoYaml,
+      profile: outgoingYaml
+    });
+    const incomingCfg = resolveConfig({
+      repo: repoYaml,
+      profile: incomingYaml
+    });
+    const backupRoot = outgoingCfg.backups.dir.replace(/^~/, homeRoot8());
+    const backupProfile = outgoing ?? "__preexisting__";
+    const outgoingRules = {
+      include: outgoingCfg.include,
+      exclude: outgoingCfg.exclude,
+      denylist: outgoingCfg.denylist
+    };
+    await snapshotBackup({
+      home: claudeHome,
+      backupRoot,
+      profile: backupProfile,
+      rules: outgoingRules,
+      isoTs: realTime.iso(),
+      useHardlinks: outgoingCfg.backups.use_hardlinks
+    });
+    const incomingRules = {
+      include: incomingCfg.include,
+      exclude: incomingCfg.exclude,
+      denylist: incomingCfg.denylist
+    };
+    if (outgoing) {
+      const homePaths = await walk(claudeHome);
+      for (const rel of homePaths) {
+        if (isPathInScope(rel, outgoingRules) && !isPathInScope(rel, incomingRules)) {
+          await fs17.rm(path17.join(claudeHome, rel), { force: true });
+        }
+      }
+    }
+    const incomingProfileDir = path17.join(cfg.path, "profiles", name);
+    const incomingFiles = (await walk(incomingProfileDir)).filter(
+      (p) => isPathInScope(p, incomingRules)
+    );
+    for (const rel of incomingFiles) {
+      await copyFile2(
+        path17.join(incomingProfileDir, rel),
+        path17.join(claudeHome, rel),
+        { hardlink: false }
+      );
+    }
+    const partialPath = path17.join(
+      incomingProfileDir,
+      incomingCfg.claude_json.partial_filename
+    );
+    const claudeJsonPath = incomingCfg.claude_json.path.replace(/^~/, homeRoot8());
+    let partialText;
+    try {
+      partialText = await fs17.readFile(partialPath, "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        partialText = "";
+      } else {
+        throw err;
+      }
+    }
+    if (partialText !== "") {
+      const partial = JSON.parse(partialText);
+      const homeText = await fs17.readFile(claudeJsonPath, "utf8").catch((err) => {
+        if (err.code === "ENOENT") return "{}";
+        throw err;
+      });
+      const homeJson = JSON.parse(homeText);
+      for (const k of incomingCfg.claude_json.include_keys) {
+        if (k in partial) homeJson[k] = partial[k];
+      }
+      await atomicWrite(claudeJsonPath, JSON.stringify(homeJson, null, 2) + "\n");
+    }
+    const newCfg = setActive(cfg, name);
+    await saveMachineConfig(cfgPath, newCfg);
+    const metaPath = path17.join(cfg.path, ".claude-profile", name, "meta.json");
+    const meta = await fs17.readFile(metaPath, "utf8").then(parseMeta).catch(() => emptyMeta());
+    const newFiles = {};
+    for (const rel of incomingFiles) {
+      const st = await fs17.stat(path17.join(claudeHome, rel));
+      newFiles[rel] = Math.floor(st.mtimeMs);
+    }
+    await atomicWrite(metaPath, serializeMeta({ ...meta, files: newFiles }));
+    let prunedCount = 0;
+    if (incomingCfg.backups.auto_prune_on_use) {
+      const pruned = await pruneBackups(
+        backupRoot,
+        backupProfile,
+        incomingCfg.backups.keep_per_profile
+      );
+      prunedCount = pruned.length;
+    }
+    process.stdout.write(
+      `Switched to profile ${name}. Backup saved at ${backupRoot}/${backupProfile}/.${prunedCount ? ` Pruned ${prunedCount} older backups.` : ""}
+`
+    );
+  });
+}
+
+// src/cli/index.ts
+function readPackageVersion() {
+  try {
+    const url = new URL("../../package.json", import.meta.url);
+    const pkg = JSON.parse(readFileSync(fileURLToPath(url), "utf8"));
+    return pkg.version ?? "0.0.0-dev";
+  } catch {
+    return "0.0.0-dev";
+  }
+}
+function buildProgram() {
+  const program2 = new Command();
+  program2.name("claude-profile").description("Sync ~/.claude/ across machines via git-backed profiles").version(readPackageVersion());
+  attachInit(program2);
+  attachSync(program2);
+  attachStatus(program2);
+  attachDiff(program2);
+  attachUse(program2);
+  attachBackups(program2);
+  attachList(program2);
+  attachConfig(program2);
+  attachAdopt(program2);
+  attachMerge(program2);
+  attachDescribe(program2);
+  attachInstallSkill(program2);
+  program2.command("autosync").description("Internal: deprecated; hook now invokes sync --pull/--push").action(() => {
+    process.stdout.write("autosync is deprecated; the hook now calls sync --pull/--push directly\n");
+  });
+  return program2;
+}
+
+// src/bin/claude-profile.ts
+var program = buildProgram();
+program.parseAsync(process.argv).catch((err) => {
+  process.stderr.write(`${err.message}
+`);
+  process.exit(2);
+});