cchost 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,77 @@
+# Changelog
+
+All notable changes to `cchost` are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [0.3.0] - 2026-05-19
+
+### Added
+
+- **Per-profile custom API endpoints (`cc env`).** A profile can now route
+  through any Anthropic-compatible third-party provider (Moonshot/Kimi,
+  OpenRouter, Requesty, self-hosted vLLM, corporate proxies) instead of
+  Anthropic's subscription OAuth.
+  - `cc env <profile>` — interactive wizard; the token is never echoed.
+  - `cc env <profile> --base-url=URL --token=TOKEN [--model/--opus/--sonnet/--haiku/--subagent=NAME]`
+    — non-interactive create, or partial update on an existing endpoint profile.
+  - `cc env <profile> show [--reveal]` — print the config; the token is masked
+    by default, `--reveal` prints it in full.
+- `cc use` injects the corresponding `ANTHROPIC_*` / `CLAUDE_CODE_*` env vars
+  from `.cc-env.json` and prints a one-line endpoint + billing banner to stderr.
+- `cc list` gained an `Endpoint` column (the endpoint host, or `subscription`).
+- README section "Custom endpoints (Kimi, OpenRouter, etc.)" with a billing
+  note and a worked Moonshot example.
+
+### Security
+
+- `.cc-env.json` holds a third-party API key. It is treated like
+  `.credentials.json`: written with user-only file permissions, and never
+  copied or linked by `cc migrate` / `cc link`.
+- A profile is born OAuth or endpoint and stays that way — `cc env` refuses to
+  run on a profile that already has Anthropic OAuth credentials.
+
+### Notes
+
+- Endpoint profiles bill through the third-party provider, not your Anthropic
+  subscription.
+
+## [0.2.1] - 2026-05-18
+
+### Added
+
+- `cc link` / `cc unlink` now operate on `projects/`, `skills/`, `agents/`,
+  and `commands/` (previously `projects/` only), with per-directory
+  partial-failure handling.
+- `cc migrate` extended: `default → <profile>` also copies `mcp.json`,
+  `settings.json`, and `CLAUDE.md`; `--force` overwrites instead of
+  skip-on-collision.
+- `cc list` reports shared state as `N/4`.
+- README: migrate-vs-link artifact table.
+
+## [0.2.0] - 2026-05-16
+
+### Added
+
+- `cc --version` / `cc -v` — prints the installed version.
+- `cc doctor [--fix [--force]] [--json]` — environment, storage, and platform
+  diagnostics with safe and confirmation-gated fixes.
+
+### Removed
+
+- The `cc add` alias-masking feature — Claude Code re-syncs account fields from
+  the server on every launch, so masking was not worth shipping.
+
+## [0.1.2] - 2026-05-15
+
+### Changed
+
+- `sessions/` dropped from `share`, `migrate`, and `cc list` — it is transient
+  per-process state and must stay per-profile.
+- Cross-platform claim narrowed to the verified scope (Windows and Linux).
+
+[0.3.0]: https://github.com/allenhack638/cchost/releases/tag/v0.3.0
+[0.2.1]: https://github.com/allenhack638/cchost/releases/tag/v0.2.1
+[0.2.0]: https://github.com/allenhack638/cchost/releases/tag/v0.2.0
+[0.1.2]: https://github.com/allenhack638/cchost/releases/tag/v0.1.2

package/README.md

@@ -18,10 +18,12 @@ Requires Node.js 18+ and Claude Code 2.1.140+ already installed. Get Claude Code
 | --- | --- |
 | `cc add <profile>` | Create a profile directory. |
 | `cc use <profile> [...args]` | Launch Claude under that profile. Profile must already exist. Args after the name are forwarded verbatim to `claude`. |
-| `cc list [--json]` | Show every profile: login state, account email, and storage mode (`shared` / `isolated`). |
-| `cc migrate <src> <dest>` | Copy projects from `default`\|`shared` to `shared`\|`<profile>`. Skip-on-collision; credential files never copied. |
-| `cc link <profile> [<profile>...]` | Link a profile's `projects/` to `~/.claude-shared/projects`. Migrates existing content; renames on collision. |
-| `cc unlink <profile>` | Restore a profile to its own private `projects/` (copies shared content back). |
+| `cc list [--json]` | Show every profile: login state, account email, shared dirs (N/4), and endpoint. |
+| `cc env <profile> [...]` | Configure a custom API endpoint for a profile (interactive wizard or flags). See [Custom endpoints](#custom-endpoints-kimi-openrouter-etc). |
+| `cc env <profile> show [--reveal]` | Print a profile's endpoint config. Token masked by default; `--reveal` prints it in full. |
+| `cc migrate <src> <dest> [--force]` | Copy artifacts from `default`\|`shared` to `shared`\|`<profile>`. Skip-on-collision by default; `--force` overwrites. |
+| `cc link <profile> [<profile>...]` | Link a profile's artifact dirs to `~/.claude-shared/`. Migrates existing content; renames on collision. |
+| `cc unlink <profile>` | Restore a profile to its own private artifact dirs (copies shared content back). |
 | `cc remove <profile>` | Delete a profile. Requires typing the profile name to confirm. |
 | `cc doctor [--fix [--force]] [--json]` | Diagnose environment, storage, and platform issues. |
 | `cc help [command]` | Print usage (top-level, or for a single command). |
@@ -40,42 +42,99 @@ cc remove old-profile
 `cc list` output:
 
 ```
-Profile   LoggedIn  Email                 Storage
-personal  true      personal@example.com  isolated
-scratch   false     -                     isolated
-work      true      work@example.com      shared
+Profile   LoggedIn  Email                 Shared  Endpoint
+kimi      false     -                     0/4     api.moonshot.ai
+personal  true      personal@example.com  4/4     subscription
+scratch   false     -                     0/4     subscription
+work      true      work@example.com      0/4     subscription
 ```
 
-### Migrating existing projects
+### What migrate copies and what link shares
 
-If you've been using Claude Code without profiles, your history lives in `~/.claude/projects/`. Pull it into a profile or the shared pool:
+| Artifact | `cc migrate` copies it | `cc link` shares it | Notes |
+| --- | :---: | :---: | --- |
+| `projects/` | ✓ | ✓ | Resumable conversation transcripts |
+| `skills/` | ✓ | ✓ | Custom slash-command scripts |
+| `agents/` | ✓ | ✓ | Custom agent definitions |
+| `commands/` | ✓ | ✓ | Custom command configs |
+| `mcp.json` | ✓ (default→profile only) | — | Per-profile MCP server config; may carry auth tokens |
+| `settings.json` | ✓ (default→profile only) | — | Per-profile UI/feature settings |
+| `CLAUDE.md` | ✓ (default→profile only) | — | Per-profile project instructions |
+| `sessions/` | — | — | Transient per-process state; sharing would corrupt bookkeeping |
+| `plugins/` | — | — | Carries auth tokens; deferred to a future opt-in flag |
+| `.credentials.json` | — | — | Never touched — each profile keeps its own auth |
+| `.claude.json` | — | — | Never touched — re-synced from server on every launch |
+| `.cc-env.json` | — | — | Per-profile custom-endpoint config; holds an API key. Never migrated, never linked. |
+
+`mcp.json`, `settings.json`, and `CLAUDE.md` are **not** copied to `shared` and are **not** linked because they typically carry auth tokens or per-profile configuration that should not leak across accounts.
+
+### Migrating existing artifacts
+
+If you've been using Claude Code without profiles, your history lives in `~/.claude/`. Pull it into a profile or the shared pool:
 
 ```bash
-cc migrate default work        # copy ~/.claude/projects → ~/.claude-profiles/work/projects
-cc migrate default shared      # copy ~/.claude/projects → ~/.claude-shared/projects
-cc migrate shared personal     # copy ~/.claude-shared/projects → ~/.claude-profiles/personal/projects
+cc migrate default work        # copy ~/.claude/* → ~/.claude-profiles/work/
+cc migrate default shared      # copy ~/.claude/projects,skills,agents,commands → ~/.claude-shared/
+cc migrate shared personal     # copy ~/.claude-shared/* → ~/.claude-profiles/personal/
+cc migrate default work --force  # same as first, overwriting anything that already exists
 ```
 
-This is a **copy** — the source is left untouched. If an entry already exists at the destination, the source entry is skipped (no overwrite). Credential files (`.credentials.json`, `.claude.json`) are never copied: each profile keeps its own auth state.
+This is a **copy** — the source is left untouched. By default, if an entry already exists at the destination it is silently skipped. Pass `--force` to overwrite instead — existing destination content will be cleared.
 
-### Shared history across profiles
+Credential files (`.credentials.json`, `.claude.json`) are never copied: each profile keeps its own auth state.
 
-If you want each profile to keep separate credentials but share project history (e.g. rotate accounts on the same project when usage limits hit):
+### Shared artifacts across profiles
+
+If you want each profile to keep separate credentials but share project history and skills (e.g. rotate accounts on the same project when usage limits hit):
 
 ```bash
 cc link work
 cc link personal
 ```
 
-`work/projects` and `personal/projects` become links to `~/.claude-shared/projects`. On Windows this uses directory junctions (no admin/Developer Mode required); on macOS/Linux, regular symlinks.
+`work/` and `personal/` each get four linked dirs (`projects`, `skills`, `agents`, `commands`) pointing to `~/.claude-shared/`. On Windows this uses directory junctions (no admin/Developer Mode required); on macOS/Linux, regular symlinks.
 
-**Only `projects/` is shared.** That's the directory Claude Code uses for resumable conversation transcripts (`projects/<project>/<session>.jsonl`). The sibling `sessions/` folder holds transient per-process registry state — PID, working directory, status, timestamps — and is **never** linked, migrated, or copied across profiles. Sharing it would corrupt Claude's running-process bookkeeping. `sessions/` stays per-profile under `~/.claude-profiles/<name>/sessions/`.
+`sessions/` is **never** linked. It holds transient per-process registry state — PID, working directory, status, timestamps — and sharing it would corrupt Claude's running-process bookkeeping. It stays per-profile under `~/.claude-profiles/<name>/sessions/`.
 
 `cc link a b c` links several profiles at once; per-profile failures are reported but don't abort the rest of the batch.
 
 If two profiles share history and you launch them against the same project at the same time, both will write to the same session files (last write wins). Don't do that.
 
-`cc remove` is safe with shared profiles — it deletes only the link, never recursing into the shared target.
+`cc remove` is safe with shared profiles — it deletes only the links, never recursing into the shared target.
+
+## Custom endpoints (Kimi, OpenRouter, etc.)
+
+A profile can route through any Anthropic-compatible API endpoint instead of Anthropic's subscription OAuth — Moonshot/Kimi, OpenRouter, Requesty, a self-hosted vLLM, or a corporate proxy. This is configured per profile with `cc env`.
+
+> **Billing:** an endpoint profile bills through the **third-party provider**, using the API key you supply — **not** your Anthropic subscription. You are responsible for that provider's usage charges. A subscription profile is unaffected.
+
+An endpoint profile and a subscription profile are mutually exclusive: a profile is born one or the other and stays that way. `cc env` refuses to run on a profile that already has Anthropic OAuth credentials — create endpoint profiles fresh.
+
+### Worked example — Moonshot / Kimi
+
+```bash
+cc add kimi
+cc env kimi --base-url=https://api.moonshot.ai/anthropic \
+            --token=sk-your-moonshot-key \
+            --model=kimi-k2.5
+cc use kimi
+```
+
+Moonshot's endpoint URL ends in `/anthropic` — Claude Code appends `/v1/messages` itself, so do **not** add `/v1`. Most third-party providers serve a single model name; pass it as `--model` and it is applied to every tier (opus/sonnet/haiku/subagent). To override a tier, pass `--opus=`, `--sonnet=`, `--haiku=`, or `--subagent=`.
+
+Run `cc env <profile>` with no flags for an interactive wizard instead — it prompts for every field and never echoes the token. On an existing endpoint profile the wizard runs in edit mode with current values prefilled; non-interactively, only the flags you pass are changed.
+
+Inspect a config with `cc env <profile> show` (token masked). `cc env <profile> show --reveal` prints the full API key — do not paste that output anywhere.
+
+There is no `cc env clear`. To stop using an endpoint, `cc remove` the profile and recreate it.
+
+When you launch an endpoint profile, `cc use` prints a one-line reminder to stderr:
+
+```
+[cchost] Profile 'kimi' → api.moonshot.ai (custom endpoint billing applies)
+```
+
+The config lives at `~/.claude-profiles/<profile>/.cc-env.json` with user-only file permissions. It contains your API key — see [Sensitive data](#sensitive-data).
 
 ## How it works
 
@@ -92,6 +151,8 @@ The env var is set on the child process only — that's all `claude` needs.
 
 `~/.claude-profiles/<profile>/` holds real OAuth credentials. Treat it like SSH keys: don't commit it, don't share it, don't sync it to public cloud storage. The `.gitignore` shipped with this project excludes profile directories from anywhere they might land. `cc migrate` and `cc link` never copy `.credentials.json` or `.claude.json` across profiles.
 
+`.cc-env.json` (custom-endpoint config) contains a third-party **API key** — treat it exactly like `.credentials.json`. It is written with user-only file permissions, and `cc migrate`/`cc link` never copy or link it across profiles. `cc env show` masks the token; only `cc env show --reveal` prints it in full.
+
 ## Troubleshooting
 
 **`Claude Code does not appear to be installed`**

package/lib/cli.js

@@ -7,6 +7,7 @@ const readline = require('readline');
 const profiles = require('./profiles');
 const share = require('./share');
 const migrateLib = require('./migrate');
+const envLib = require('./env');
 const { spawnClaude } = require('./spawn');
 const { renderTable } = require('./format');
 const color = require('./color');
@@ -16,10 +17,11 @@ const HELP = `cc - Multi-profile launcher for Claude Code
 Usage:
   cc add <profile>                                 Create a profile directory
   cc use <profile> [...args]                       Launch Claude under a named profile
-  cc list [--json]                                 Show all profiles: login state, email, storage (shared/isolated)
-  cc migrate <src> <dest>                          Copy projects from default|shared to shared|<profile>
-  cc link <p>...                                   Replace each profile's projects/ with a link to shared
-  cc unlink <profile>                              Restore a profile's private projects/
+  cc list [--json]                                 Show all profiles: login state, email, shared-dir count (N/4), endpoint
+  cc env <profile> [show] [...]                    Configure a custom API endpoint for a profile (wizard or flags)
+  cc migrate <src> <dest> [--force]                Copy artifact dirs (and config files) between profiles
+  cc link <p>...                                   Link each profile's artifact dirs to ~/.claude-shared/
+  cc unlink <profile>                              Restore a profile's private artifact dirs
   cc remove <profile>                              Delete a profile and all its data (typed confirmation)
   cc doctor [--fix [--force]] [--json]             Diagnose environment, storage, and platform issues
   cc help [command]                                Show usage (optionally for a single command)
@@ -58,47 +60,104 @@ Columns:
   Profile   - profile name
   LoggedIn  - true if .credentials.json exists
   Email     - account email from .claude.json; - if not yet logged in
-  Storage   - 'shared' if projects/ is linked to ~/.claude-shared, 'isolated' otherwise
+  Shared    - N/4 linked to ~/.claude-shared/ (projects, skills, agents, commands)
+              4/4 = fully shared, 0/4 = fully isolated
               (sessions/ is transient per-process state and is never shared)
+  Endpoint  - custom-endpoint host from .cc-env.json, or "subscription" if the
+              profile uses Anthropic's subscription OAuth
 
-With --json, emits an array of {name, dir, loggedIn, email, storage}.
+With --json, emits an array of {name, dir, loggedIn, email, shared, endpoint}.
 `,
-  migrate: `cc migrate <src> <dest>
+  env: `cc env <profile> [show] [...]
 
-Copy projects/ from a source to a destination. sessions/ (transient per-process
-registry state) is never migrated. This is a COPY — the source is left untouched.
+Configure a custom, Anthropic-compatible API endpoint for a profile. This
+routes the profile through a third-party provider (Moonshot/Kimi, OpenRouter,
+vLLM, a corporate proxy, ...) instead of Anthropic's subscription OAuth.
+
+Billing: an endpoint profile bills through the third-party provider, NOT your
+Anthropic subscription.
+
+Forms:
+  cc env <profile>
+      Interactive wizard. Prompts for every field; the token is not echoed.
+      On an existing endpoint profile, the wizard runs in edit mode and
+      prefills current values.
+
+  cc env <profile> --base-url=URL --token=TOKEN
+                   [--model=NAME] [--opus=NAME] [--sonnet=NAME]
+                   [--haiku=NAME] [--subagent=NAME]
+      Non-interactive. --base-url and --token are required when creating;
+      when editing, only the flags you pass are changed.
+
+  cc env <profile> show [--reveal]
+      Print the endpoint configuration. The token is masked by default.
+      --reveal prints the FULL API key — do not paste that output anywhere.
+
+A profile is born either OAuth or endpoint and stays that way. cc env refuses
+to run on a profile that already has OAuth credentials. To stop using an
+endpoint, run 'cc remove <profile>' and recreate the profile.
+
+The config lives at ~/.claude-profiles/<profile>/.cc-env.json with user-only
+permissions. It is never migrated and never linked.
+
+Examples:
+  cc add kimi
+  cc env kimi --base-url=https://api.moonshot.ai/anthropic --token=sk-... --model=kimi-k2.5
+  cc env kimi show
+  cc use kimi
+`,
+  migrate: `cc migrate <src> <dest> [--force]
+
+Copy artifact directories from a source to a destination. This is a COPY — the
+source is left untouched. sessions/ is never migrated (transient per-process state).
 
   <src>:   default | shared
            default = ~/.claude/        (Claude's built-in non-profile data)
            shared  = ~/.claude-shared/ (the cc shared pool)
   <dest>:  shared | <profile-name>
 
-On collisions, existing entries at the destination are left alone (the source
-entry is skipped). Credential files (.credentials.json, .claude.json) are
-never copied — the destination keeps its own auth state.
+Directories copied in all cases:
+  projects/, skills/, agents/, commands/
+
+Extra files copied only when src=default and dest=<profile>:
+  mcp.json, settings.json, CLAUDE.md
+  (These carry per-profile config and are NOT copied to shared.)
+
+Never copied: .credentials.json, .claude.json, sessions/, plugins/
+
+Collision behavior (default): existing entries at the destination are silently
+skipped — the source entry is left alone.
+
+--force  Overwrite existing entries instead of skipping.
+         Warning: existing content at the destination will be cleared.
 
 Examples:
-  cc migrate default work     # ~/.claude/projects -> ~/.claude-profiles/work/projects
-  cc migrate default shared   # ~/.claude/projects -> ~/.claude-shared/projects
-  cc migrate shared work      # ~/.claude-shared/projects -> ~/.claude-profiles/work/projects
+  cc migrate default work            # copy ~/.claude/* to ~/.claude-profiles/work/
+  cc migrate default shared          # copy dirs to ~/.claude-shared/
+  cc migrate shared work             # copy shared dirs to ~/.claude-profiles/work/
+  cc migrate default work --force    # same, overwriting any existing items
 `,
   link: `cc link <profile> [<profile>...]
 
-Replace each profile's projects/ with a link to ~/.claude-shared/projects/.
-Existing content is migrated into shared first; collisions are renamed with a
-__<profile> suffix (never overwritten). sessions/ (transient per-process state)
-is intentionally never linked — it stays per-profile.
+Replace each profile's artifact directories with links to ~/.claude-shared/:
+  projects/, skills/, agents/, commands/
+
+Existing content in each directory is migrated into shared first; collisions
+are renamed with a __<profile> suffix (never overwritten). sessions/ (transient
+per-process state) is intentionally never linked — it stays per-profile.
 
 On Windows, link uses directory junctions (no admin/Developer Mode needed).
 On macOS/Linux, regular symlinks.
 
-Multiple profiles can be linked at once: 'cc link a b c'. Per-profile failures
-are reported but don't abort the rest of the batch.
+Multiple profiles can be linked at once: 'cc link a b c'. Failures are handled
+per directory and per profile: one directory failing does not stop the other
+three, and one profile failing does not stop the rest of the batch. A
+per-directory summary is printed; exit code is 1 if anything failed.
 `,
   unlink: `cc unlink <profile>
 
-Remove a profile's projects/ link to ~/.claude-shared/ and copy shared content
-back into the profile as a private dir.
+Remove each linked artifact directory (projects/, skills/, agents/, commands/)
+and copy the shared content back into the profile as private dirs.
 `,
   remove: `cc remove <profile>
 
@@ -234,21 +293,37 @@ async function cmdUse(rest) {
     err.exitCode = 1;
     throw err;
   }
-  return spawnClaude({ args: passthrough, profileDir: dir });
+
+  // If the profile carries a custom-endpoint config, inject the corresponding
+  // env vars so Claude Code routes through the third-party provider.
+  let extraEnv = {};
+  const envConfig = envLib.readEnvConfig(dir); // throws on a malformed file
+  if (envConfig) {
+    extraEnv = envLib.buildEnvVars(envConfig);
+    const host = envConfig.base_url ? envLib.hostOf(envConfig.base_url) : '(unknown)';
+    process.stderr.write(
+      `[cchost] Profile '${name}' → ${host} (custom endpoint billing applies)\n`,
+    );
+  }
+  return spawnClaude({ args: passthrough, profileDir: dir, extraEnv });
 }
 
 function cmdList(rest) {
   const { flags } = parseFlagsStrict(rest, ['--json']);
   const list = profiles.listProfiles();
+  const total = share.SHARED_SUBDIRS.length;
 
   const enriched = list.map((p) => {
-    const storage = isLinkLike(path.join(p.dir, 'projects')) ? 'shared' : 'isolated';
+    const sharedCount = share.SHARED_SUBDIRS.filter(sub =>
+      isLinkLike(path.join(p.dir, sub))
+    ).length;
     return {
       name: p.name,
       dir: p.dir,
       loggedIn: p.loggedIn,
       email: p.email,
-      storage,
+      shared: sharedCount,
+      endpoint: envLib.endpointSummary(p.dir),
     };
   });
 
@@ -263,13 +338,14 @@ function cmdList(rest) {
     return 0;
   }
 
-  const rows = [['Profile', 'LoggedIn', 'Email', 'Storage']];
+  const rows = [['Profile', 'LoggedIn', 'Email', 'Shared', 'Endpoint']];
   for (const p of enriched) {
     rows.push([
       p.name,
       p.loggedIn ? 'true' : 'false',
       p.email ? p.email : '-',
-      p.storage,
+      `${p.shared}/${total}`,
+      p.endpoint,
     ]);
   }
   console.log(renderTable(rows));
@@ -311,29 +387,67 @@ async function cmdRemove(rest) {
 
 async function cmdLink(rest) {
   if (rest.length === 0) throw usageError('Usage: cc link <profile> [<profile>...]');
-  const failures = [];
+  const multi = rest.length > 1;
+  const summary = [];
   for (const name of rest) {
-    if (rest.length > 1) console.log(`\n[${name}]`);
+    if (multi) console.log(`\n[${name}]`);
+    let results;
     try {
-      share.shareLink(name);
+      results = share.shareLink(name);
     } catch (err) {
+      // Profile-level failure (invalid name, profile missing) — nothing linked.
       process.stderr.write(color.stderr.red(`  error: ${err.message}`) + '\n');
-      failures.push({ name, message: err.message });
+      summary.push({ name, linked: 0, total: share.SHARED_SUBDIRS.length, error: err.message });
+      continue;
+    }
+    for (const r of results) {
+      if (r.status === 'failed') {
+        process.stderr.write(color.stderr.red(`  ${r.sub}: failed — ${r.message}`) + '\n');
+      } else if (r.status === 'already-linked') {
+        console.log(`  ${r.sub}: already linked`);
+      } else {
+        const note = r.moved ? ` (migrated ${r.moved} item(s) into shared)` : '';
+        console.log(`  ${r.sub}: linked${note}`);
+      }
     }
+    const failed = results.filter((r) => r.status === 'failed');
+    const linked = results.length - failed.length;
+    console.log(`  ${linked}/${results.length} directories linked${failed.length ? `, ${failed.length} failed` : ''}.`);
+    summary.push({ name, linked, total: results.length, failed: failed.map((f) => f.sub) });
   }
-  if (rest.length > 1) {
-    const ok = rest.length - failures.length;
-    console.log(`\nSummary: ${ok} succeeded, ${failures.length} failed.`);
-    for (const f of failures) console.log(`  ${f.name}: ${f.message}`);
+
+  const anyFailure = summary.some((s) => s.error || (s.failed && s.failed.length));
+  if (multi) {
+    console.log('\nSummary:');
+    for (const s of summary) {
+      if (s.error) {
+        console.log(`  ${s.name}: error — ${s.error}`);
+      } else if (s.failed && s.failed.length) {
+        console.log(`  ${s.name}: ${s.linked}/${s.total} linked (failed: ${s.failed.join(', ')})`);
+      } else {
+        console.log(`  ${s.name}: ${s.linked}/${s.total} linked`);
+      }
+    }
   }
-  return failures.length === 0 ? 0 : 1;
+  return anyFailure ? 1 : 0;
 }
 
 async function cmdUnlink(rest) {
   const [name] = rest;
   if (!name) throw usageError('Usage: cc unlink <profile>');
-  share.shareUnlink(name);
-  return 0;
+  const results = share.shareUnlink(name);
+  let anyFailure = false;
+  for (const r of results) {
+    if (r.status === 'failed') {
+      anyFailure = true;
+      process.stderr.write(color.stderr.red(`  ${r.sub}: failed — ${r.message}`) + '\n');
+    } else if (r.status === 'not-linked') {
+      console.log(`  ${r.sub}: not linked, skipping`);
+    } else {
+      console.log(`  ${r.sub}: unlinked, content copied back`);
+    }
+  }
+  return anyFailure ? 1 : 0;
 }
 
 async function cmdDoctor(rest) {
@@ -347,13 +461,74 @@ async function cmdDoctor(rest) {
 }
 
 async function cmdMigrate(rest) {
-  const [src, dest, ...extra] = rest;
-  if (!src || !dest) throw usageError('Usage: cc migrate <src> <dest>');
+  const { flags, positional } = parseFlagsStrict(rest, ['--force'], { allowPositional: true });
+  const [src, dest, ...extra] = positional;
+  if (!src || !dest) throw usageError('Usage: cc migrate <src> <dest> [--force]');
   if (extra.length > 0) throw usageError(`Unexpected extra arguments: ${extra.join(' ')}`);
-  migrateLib.migrate(src, dest);
+  const force = flags.has('--force');
+  if (force) {
+    process.stdout.write('Warning: --force is set. Existing items at the destination will be overwritten and their current content will be cleared.\n');
+  }
+  migrateLib.migrate(src, dest, { force });
   return 0;
 }
 
+// Flag name -> config field for `cc env`.
+const ENV_VALUE_FLAGS = {
+  '--base-url': 'base_url',
+  '--token': 'auth_token',
+  '--model': 'model',
+  '--opus': 'opus',
+  '--sonnet': 'sonnet',
+  '--haiku': 'haiku',
+  '--subagent': 'subagent',
+};
+
+async function cmdEnv(rest) {
+  const positional = [];
+  const provided = {};
+  let reveal = false;
+
+  for (const a of rest) {
+    if (a.startsWith('-')) {
+      const eq = a.indexOf('=');
+      const flagName = eq === -1 ? a : a.slice(0, eq);
+      if (flagName === '--reveal') {
+        reveal = true;
+        continue;
+      }
+      if (Object.prototype.hasOwnProperty.call(ENV_VALUE_FLAGS, flagName)) {
+        if (eq === -1) {
+          throw usageError(`Flag ${flagName} requires a value: ${flagName}=VALUE`);
+        }
+        provided[ENV_VALUE_FLAGS[flagName]] = a.slice(eq + 1);
+        continue;
+      }
+      throw usageError(`Unknown flag: ${flagName}`);
+    }
+    positional.push(a);
+  }
+
+  const [name, sub, ...extra] = positional;
+  if (!name) throw usageError('Usage: cc env <profile> [show] [--base-url=URL --token=TOKEN ...]');
+  if (extra.length > 0) throw usageError(`Unexpected argument: ${extra[0]}`);
+  profiles.validateProfileName(name);
+  const dir = profiles.profileDir(name);
+
+  if (sub === 'show') {
+    if (Object.keys(provided).length > 0) {
+      throw usageError('cc env <profile> show does not take configuration flags.');
+    }
+    return envLib.runShow(name, dir, { reveal });
+  }
+  if (sub) throw usageError(`Unknown subcommand for cc env: ${sub}`);
+  if (reveal) {
+    throw usageError('Unknown flag: --reveal (only valid with: cc env <profile> show)');
+  }
+
+  return envLib.runConfigure(name, dir, provided);
+}
+
 async function run(argv) {
   const [action, ...rest] = argv;
   if (!action || action === '--help' || action === '-h') {
@@ -376,6 +551,8 @@ async function run(argv) {
       return await cmdUse(rest);
     case 'list':
       return cmdList(rest);
+    case 'env':
+      return await cmdEnv(rest);
     case 'migrate':
       return await cmdMigrate(rest);
     case 'link':

package/lib/env.js

@@ -0,0 +1,480 @@
+'use strict';
+
+// Per-profile custom API endpoints (v0.3).
+//
+// A profile may carry a `.cc-env.json` file that routes Claude Code through an
+// Anthropic-compatible third-party provider (Moonshot/Kimi, OpenRouter, vLLM,
+// corporate proxies) instead of Anthropic's subscription OAuth. The file holds
+// an API key and is treated with the same care as `.credentials.json`: it is
+// never migrated, never linked, and written with user-only file permissions.
+
+const fs = require('fs');
+const path = require('path');
+const readline = require('readline');
+const { spawnSync } = require('child_process');
+
+const ENV_FILE = '.cc-env.json';
+
+// Persisted fields, in canonical serialization order.
+const FIELDS = ['base_url', 'auth_token', 'model', 'opus', 'sonnet', 'haiku', 'subagent'];
+const TIER_FIELDS = ['opus', 'sonnet', 'haiku', 'subagent'];
+
+// File field -> env var(s) injected into the spawned child.
+const TIER_ENV = {
+  opus: 'ANTHROPIC_DEFAULT_OPUS_MODEL',
+  sonnet: 'ANTHROPIC_DEFAULT_SONNET_MODEL',
+  haiku: 'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  subagent: 'CLAUDE_CODE_SUBAGENT_MODEL',
+};
+
+// Wizard layout: the index here is the review-screen number (1-based).
+const WIZARD_FIELDS = [
+  { key: 'base_url', label: 'Base URL', hidden: false, required: true },
+  { key: 'auth_token', label: 'Auth token', hidden: true, required: true },
+  { key: 'model', label: 'Main model', hidden: false, required: false },
+  { key: 'opus', label: 'Opus tier', hidden: false, required: false, tier: true },
+  { key: 'sonnet', label: 'Sonnet tier', hidden: false, required: false, tier: true },
+  { key: 'haiku', label: 'Haiku tier', hidden: false, required: false, tier: true },
+  { key: 'subagent', label: 'Subagent model', hidden: false, required: false, tier: true },
+];
+
+function usageError(msg) {
+  const e = new Error(msg);
+  e.exitCode = 2;
+  return e;
+}
+
+function stateError(msg) {
+  const e = new Error(msg);
+  e.exitCode = 1;
+  return e;
+}
+
+function envFilePath(profileDir) {
+  return path.join(profileDir, ENV_FILE);
+}
+
+function hasEnvConfig(profileDir) {
+  return fs.existsSync(envFilePath(profileDir));
+}
+
+// Reads and parses `.cc-env.json`. Returns the parsed object, or null if the
+// file does not exist. Throws (exitCode 1, `.malformed` set) if the file is
+// present but is not a JSON object.
+function readEnvConfig(profileDir) {
+  const p = envFilePath(profileDir);
+  if (!fs.existsSync(p)) return null;
+  let data;
+  try {
+    data = JSON.parse(fs.readFileSync(p, 'utf8'));
+  } catch (err) {
+    const e = stateError(`${ENV_FILE} is malformed JSON: ${err.message}`);
+    e.malformed = true;
+    throw e;
+  }
+  if (!data || typeof data !== 'object' || Array.isArray(data)) {
+    const e = stateError(`${ENV_FILE} is malformed: expected a JSON object.`);
+    e.malformed = true;
+    throw e;
+  }
+  return data;
+}
+
+// True if the profile shows any prior OAuth (subscription) state — either a
+// `.credentials.json` file, or a `.claude.json` with a non-null `oauthAccount`.
+// Such a profile can never be converted to an endpoint profile (Rule 1).
+function hasOAuthState(profileDir) {
+  if (fs.existsSync(path.join(profileDir, '.credentials.json'))) return true;
+  try {
+    const raw = fs.readFileSync(path.join(profileDir, '.claude.json'), 'utf8');
+    if (raw.trim()) {
+      const data = JSON.parse(raw);
+      if (data && data.oauthAccount != null) return true;
+    }
+  } catch {
+    // Missing or unreadable .claude.json is not OAuth state.
+  }
+  return false;
+}
+
+// Locks a file down to the current user only. Mirrors how Claude Code itself
+// protects `.credentials.json`.
+function secureFile(filePath) {
+  if (process.platform === 'win32') {
+    const user = process.env.USERNAME;
+    if (!user) return;
+    // Qualify the principal as DOMAIN\user. A bare username that collides with
+    // the computer name (common on workgroup machines) resolves to a broken
+    // principal, which would lock the file's own owner out — verified.
+    const domain = process.env.USERDOMAIN;
+    const principal = domain ? `${domain}\\${user}` : user;
+    spawnSync('icacls', [filePath, '/inheritance:r', '/grant:r', `${principal}:F`], {
+      stdio: 'ignore',
+    });
+  } else {
+    fs.chmodSync(filePath, 0o600);
+  }
+}
+
+// Writes `.cc-env.json` atomically (temp file + rename) so a cancel or crash
+// never leaves a partial file. Only defined, non-empty fields are persisted.
+function writeEnvConfig(profileDir, config) {
+  const out = {};
+  for (const f of FIELDS) {
+    if (config[f] != null && config[f] !== '') out[f] = config[f];
+  }
+  const target = envFilePath(profileDir);
+  const tmp = path.join(profileDir, `${ENV_FILE}.tmp-${process.pid}`);
+  // Write to a temp file then rename, so a crash never leaves a partial file.
+  // Permissions are locked down after the rename: restricting the temp file's
+  // ACL first makes the subsequent rename fail with EPERM on Windows.
+  fs.writeFileSync(tmp, JSON.stringify(out, null, 2) + '\n');
+  try {
+    fs.renameSync(tmp, target);
+  } catch (err) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+      // best effort cleanup
+    }
+    throw err;
+  }
+  secureFile(target);
+  return out;
+}
+
+// Maps a config object to the ANTHROPIC_*/CLAUDE_CODE_* env vars injected into
+// the spawned child. Per-tier model vars fall back to `model`; if `model` is
+// also missing, the var is omitted so Claude Code uses its built-in defaults.
+function buildEnvVars(config) {
+  const env = {};
+  if (config.base_url) env.ANTHROPIC_BASE_URL = config.base_url;
+  if (config.auth_token) {
+    // Different providers read different vars — set both.
+    env.ANTHROPIC_AUTH_TOKEN = config.auth_token;
+    env.ANTHROPIC_API_KEY = config.auth_token;
+  }
+  if (config.model) env.ANTHROPIC_MODEL = config.model;
+  for (const tier of TIER_FIELDS) {
+    const val = config[tier] || config.model;
+    if (val) env[TIER_ENV[tier]] = val;
+  }
+  return env;
+}
+
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+
+// Endpoint summary for `cc list`. Returns the base-url host, 'subscription'
+// (no endpoint config), or '(invalid config)' for a malformed file — never
+// throws, so a single bad profile cannot break the whole table.
+function endpointSummary(profileDir) {
+  let config;
+  try {
+    config = readEnvConfig(profileDir);
+  } catch {
+    return '(invalid config)';
+  }
+  if (!config) return 'subscription';
+  if (!config.base_url) return '(invalid config)';
+  return hostOf(config.base_url);
+}
+
+function maskToken(token) {
+  const n = token.length;
+  if (n <= 10) return `${'*'.repeat(n)} (${n} chars)`;
+  return `${token.slice(0, 6)}...${token.slice(-4)} (${n} chars)`;
+}
+
+function validateBaseUrl(url, warn) {
+  if (!/^https?:\/\/.+/.test(url)) {
+    throw usageError(`Invalid base_url "${url}": must start with http:// or https://`);
+  }
+  let u = null;
+  try {
+    u = new URL(url);
+  } catch {
+    throw usageError(`Invalid base_url "${url}": not a parseable URL.`);
+  }
+  if (u.pathname.replace(/\/+$/, '').endsWith('/v1')) {
+    warn('cchost: base_url ending in /v1 is unusual; most Anthropic-compatible endpoints end in / or /anthropic');
+  }
+  if (u.protocol === 'http:' && u.hostname !== 'localhost' && u.hostname !== '127.0.0.1') {
+    warn('cchost: base_url uses http:// to a non-local host; the auth token will be sent unencrypted');
+  }
+}
+
+function validateToken(token) {
+  if (typeof token !== 'string' || token.length === 0) {
+    throw usageError('Auth token must not be empty.');
+  }
+  if (token !== token.trim()) {
+    throw usageError('Auth token must not have leading or trailing whitespace.');
+  }
+  if (/[\r\n]/.test(token)) {
+    throw usageError('Auth token must not contain newlines.');
+  }
+}
+
+function validateModelField(label, val) {
+  if (typeof val !== 'string' || val.length === 0) {
+    throw usageError(`${label} must not be empty if provided.`);
+  }
+}
+
+// Validates one provided field by key. base_url warnings go through `warn`.
+function validateField(key, value, warn) {
+  if (key === 'base_url') validateBaseUrl(value, warn);
+  else if (key === 'auth_token') validateToken(value);
+  else validateModelField(key, value);
+}
+
+// ---------------------------------------------------------------------------
+// Wizard
+// ---------------------------------------------------------------------------
+
+// Default terminal IO for the wizard. `readHidden` writes the prompt, then
+// suppresses echo of typed characters so the token never appears on screen.
+function defaultWizardIo() {
+  return {
+    write: (s) => process.stdout.write(s),
+    readLine: (q) =>
+      new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(q, (a) => {
+          rl.close();
+          resolve(a);
+        });
+      }),
+    readHidden: (q) =>
+      new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        let muted = false;
+        rl._writeToOutput = (s) => {
+          if (!muted) rl.output.write(s);
+        };
+        rl.question(q, (a) => {
+          rl.close();
+          process.stdout.write('\n');
+          resolve(a);
+        });
+        // The prompt was written above (still unmuted); from here, suppress
+        // the echo of whatever the user types.
+        muted = true;
+      }),
+  };
+}
+
+function reviewValue(field, config) {
+  if (field.key === 'auth_token') {
+    return config.auth_token ? maskToken(config.auth_token) : '-';
+  }
+  if (field.tier) {
+    return config[field.key] || config.model || '-';
+  }
+  return config[field.key] || '-';
+}
+
+function renderReview(config, io) {
+  io.write('\nReview:\n');
+  WIZARD_FIELDS.forEach((field, i) => {
+    const label = `${field.label}:`.padEnd(16);
+    io.write(`  ${i + 1}. ${label}${reviewValue(field, config)}\n`);
+  });
+}
+
+// Prompts for one field, looping until the input is valid. An empty input
+// keeps the current value; a required field with no current value re-prompts.
+async function promptOne(field, config, io, isEdit) {
+  for (;;) {
+    let placeholder = '';
+    let promptText;
+    if (field.hidden) {
+      promptText = `${field.label}${isEdit && config[field.key] ? ' [keep current]' : ''}: `;
+    } else {
+      if (field.tier) placeholder = config[field.key] || config.model || '';
+      else placeholder = config[field.key] || '';
+      promptText = `${field.label} [${placeholder}]: `;
+    }
+
+    const raw = field.hidden
+      ? await io.readHidden(promptText)
+      : await io.readLine(promptText);
+    const value = raw.trim();
+
+    if (value === '') {
+      // Keep the current value. base_url/auth_token must end up set.
+      if (field.required && !config[field.key]) {
+        io.write(`${field.label} is required.\n`);
+        continue;
+      }
+      return;
+    }
+
+    try {
+      validateField(field.key, value, (m) => io.write(m + '\n'));
+    } catch (err) {
+      io.write(err.message + '\n');
+      continue;
+    }
+    config[field.key] = value;
+    return;
+  }
+}
+
+// Runs the interactive wizard. Returns the collected config on submit, or
+// null if the user cancelled. Never writes the file itself.
+async function runWizard(name, existing, io) {
+  const isEdit = !!existing;
+  const config = {};
+  if (existing) {
+    for (const f of FIELDS) {
+      if (existing[f] != null) config[f] = existing[f];
+    }
+  }
+
+  io.write(`\ncchost endpoint configuration for profile '${name}'\n\n`);
+  for (const field of WIZARD_FIELDS) {
+    await promptOne(field, config, io, isEdit);
+  }
+
+  for (;;) {
+    renderReview(config, io);
+    const ans = (await io.readLine('\n[s]ubmit, [e]dit N, [c]ancel: ')).trim().toLowerCase();
+    if (ans === 's') return config;
+    if (ans === 'c') return null;
+    const m = /^e\s+([1-7])$/.exec(ans);
+    if (m) {
+      await promptOne(WIZARD_FIELDS[Number(m[1]) - 1], config, io, isEdit);
+    }
+    // Anything else: silently re-display the review.
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Command orchestration (called from cli.js)
+// ---------------------------------------------------------------------------
+
+// `cc env <profile>` and `cc env <profile> --flags`.
+// `provided` is a partial config of fields supplied via flags.
+// `opts.io` injects wizard IO (tests); `opts.isTTY` overrides TTY detection.
+async function runConfigure(name, profileDir, provided, opts = {}) {
+  if (!fs.existsSync(profileDir)) {
+    throw stateError(`Profile "${name}" does not exist. Create it with: cc add ${name}`);
+  }
+  if (hasOAuthState(profileDir)) {
+    throw stateError(
+      `Profile '${name}' has OAuth credentials.\n` +
+        'Endpoint profiles must be created on a fresh profile.\n' +
+        'Run:\n' +
+        '  cc add <new-name>\n' +
+        '  cc env <new-name>',
+    );
+  }
+
+  const existing = readEnvConfig(profileDir); // throws on malformed file
+  const editing = existing != null;
+  const nonInteractive = Object.keys(provided).length > 0;
+
+  if (nonInteractive) {
+    const warn = (m) => process.stderr.write(m + '\n');
+    // Creating: base_url and auth_token are mandatory.
+    if (!editing) {
+      const merged = { ...provided };
+      if (!merged.base_url || !merged.auth_token) {
+        throw usageError(
+          'Creating an endpoint profile requires both --base-url and --token.',
+        );
+      }
+    }
+    for (const [key, value] of Object.entries(provided)) {
+      validateField(key, value, warn);
+    }
+    const merged = { ...(existing || {}), ...provided };
+    writeEnvConfig(profileDir, merged);
+    console.log(
+      `${editing ? 'Updated' : 'Created'} endpoint config for profile '${name}' → ${hostOf(merged.base_url)}.`,
+    );
+    return 0;
+  }
+
+  // Interactive wizard.
+  let io = opts.io;
+  if (!io) {
+    const isTTY = opts.isTTY != null ? opts.isTTY : process.stdin.isTTY;
+    if (!isTTY) {
+      throw usageError('cc env requires either flags or an interactive terminal.');
+    }
+    io = defaultWizardIo();
+  }
+
+  const result = await runWizard(name, existing, io);
+  if (result == null) {
+    console.log('Cancelled. No changes written.');
+    return 0;
+  }
+  writeEnvConfig(profileDir, result);
+  console.log(
+    `${editing ? 'Updated' : 'Created'} endpoint config for profile '${name}' → ${hostOf(result.base_url)}.`,
+  );
+  return 0;
+}
+
+// `cc env <profile> show [--reveal]`.
+function runShow(name, profileDir, { reveal = false, write } = {}) {
+  const w = write || ((s) => process.stdout.write(s + '\n'));
+  if (!fs.existsSync(profileDir)) {
+    throw stateError(`Profile "${name}" does not exist.`);
+  }
+  const config = readEnvConfig(profileDir); // throws on malformed file
+  if (config == null) {
+    throw stateError(`Profile '${name}' is not an endpoint profile (no ${ENV_FILE}).`);
+  }
+
+  w(`Endpoint configuration for profile '${name}':`);
+  w(`  Base URL:   ${config.base_url || '-'}`);
+  if (reveal) {
+    w(`  Token:      ${config.auth_token || '-'}`);
+  } else {
+    w(`  Token:      ${config.auth_token ? maskToken(config.auth_token) : '-'}`);
+  }
+  w(`  Main model: ${config.model || '-'}`);
+  w(`  Opus:       ${config.opus || config.model || '-'}`);
+  w(`  Sonnet:     ${config.sonnet || config.model || '-'}`);
+  w(`  Haiku:      ${config.haiku || config.model || '-'}`);
+  w(`  Subagent:   ${config.subagent || config.model || '-'}`);
+  if (reveal) {
+    w('');
+    w('WARNING: the full API key is printed above. Do not paste this output');
+    w('into chats, issues, screenshots, or logs.');
+  }
+  return 0;
+}
+
+module.exports = {
+  ENV_FILE,
+  FIELDS,
+  TIER_FIELDS,
+  envFilePath,
+  hasEnvConfig,
+  readEnvConfig,
+  hasOAuthState,
+  secureFile,
+  writeEnvConfig,
+  buildEnvVars,
+  hostOf,
+  endpointSummary,
+  maskToken,
+  validateBaseUrl,
+  validateToken,
+  validateField,
+  runWizard,
+  runConfigure,
+  runShow,
+  defaultWizardIo,
+};

package/lib/migrate.js

@@ -6,10 +6,19 @@ const os = require('os');
 
 const profiles = require('./profiles');
 
-// Only projects/ holds the resumable conversation transcripts. sessions/ is transient
-// per-process state and is intentionally not migrated.
-const SUBDIRS = ['projects'];
-const EXCLUDED_FILES = new Set(['.credentials.json', '.claude.json']);
+// sessions/ is transient per-process state — intentionally not migrated.
+// plugins/ carries auth tokens — excluded until an explicit opt-in flag is added.
+const SUBDIRS = ['projects', 'skills', 'agents', 'commands'];
+
+// Single files copied only when src=default and dest=<profile>.
+// Not copied to shared: these carry per-profile config / auth tokens.
+const SINGLE_FILES = ['mcp.json', 'settings.json', 'CLAUDE.md'];
+
+// .cc-env.json carries a third-party API key — same security category as
+// .credentials.json. It must NEVER be copied to a shared pool or another
+// profile, so it is excluded explicitly here (it also lives at the profile
+// root, outside SUBDIRS, but this guards against any future copy path).
+const EXCLUDED_FILES = new Set(['.credentials.json', '.claude.json', '.cc-env.json']);
 
 function defaultClaudeDir() {
   return path.join(os.homedir(), '.claude');
@@ -36,7 +45,7 @@ function resolveDest(dest) {
   return { kind: 'profile', name: dest, dir: profiles.profileDir(dest) };
 }
 
-function copyTreeSkipCollisions(srcRoot, dstRoot) {
+function copyTreeSkipCollisions(srcRoot, dstRoot, { force = false } = {}) {
   if (!fs.existsSync(srcRoot)) return { copied: 0, skipped: 0 };
   fs.mkdirSync(dstRoot, { recursive: true });
   let copied = 0;
@@ -46,8 +55,12 @@ function copyTreeSkipCollisions(srcRoot, dstRoot) {
     const from = path.join(srcRoot, ent.name);
     const to = path.join(dstRoot, ent.name);
     if (fs.existsSync(to)) {
-      skipped += 1;
-      continue;
+      if (force) {
+        fs.rmSync(to, { recursive: true, force: true });
+      } else {
+        skipped += 1;
+        continue;
+      }
     }
     fs.cpSync(from, to, { recursive: true, verbatimSymlinks: true });
     copied += 1;
@@ -55,7 +68,23 @@ function copyTreeSkipCollisions(srcRoot, dstRoot) {
   return { copied, skipped };
 }
 
-function migrate(srcArg, destArg) {
+// Returns 'copied', 'skipped', or 'absent'.
+function copySingleFile(srcDir, dstDir, fileName, { force = false } = {}) {
+  const from = path.join(srcDir, fileName);
+  if (!fs.existsSync(from)) return 'absent';
+  const to = path.join(dstDir, fileName);
+  if (fs.existsSync(to)) {
+    if (force) {
+      fs.rmSync(to, { recursive: true, force: true });
+    } else {
+      return 'skipped';
+    }
+  }
+  fs.copyFileSync(from, to);
+  return 'copied';
+}
+
+function migrate(srcArg, destArg, { force = false } = {}) {
   const src = resolveSource(srcArg);
   const dest = resolveDest(destArg);
 
@@ -71,7 +100,7 @@ function migrate(srcArg, destArg) {
 
   if (!fs.existsSync(src.dir)) {
     console.log(`Source ${src.dir} does not exist. Nothing to migrate.`);
-    return { copied: 0, skipped: 0 };
+    return { copied: 0, skipped: 0, files: {} };
   }
 
   let totalCopied = 0;
@@ -80,13 +109,27 @@ function migrate(srcArg, destArg) {
     const srcSub = path.join(src.dir, sub);
     const dstSub = path.join(dest.dir, sub);
     if (!fs.existsSync(srcSub)) continue;
-    const { copied, skipped } = copyTreeSkipCollisions(srcSub, dstSub);
+    const { copied, skipped } = copyTreeSkipCollisions(srcSub, dstSub, { force });
     console.log(`  ${sub}: copied ${copied}, skipped ${skipped}`);
     totalCopied += copied;
     totalSkipped += skipped;
   }
+
+  // Single config files: only when migrating from default into a profile.
+  const fileResults = {};
+  if (src.kind === 'default' && dest.kind === 'profile') {
+    for (const f of SINGLE_FILES) {
+      const result = copySingleFile(src.dir, dest.dir, f, { force });
+      fileResults[f] = result;
+      const label = result === 'absent' ? 'not present at source' : result;
+      console.log(`  ${f}: ${label}`);
+      if (result === 'copied') totalCopied += 1;
+      else if (result === 'skipped') totalSkipped += 1;
+    }
+  }
+
   console.log(`Done. Total copied: ${totalCopied}, total skipped (already present): ${totalSkipped}.`);
-  return { copied: totalCopied, skipped: totalSkipped };
+  return { copied: totalCopied, skipped: totalSkipped, files: fileResults };
 }
 
 module.exports = {
@@ -95,6 +138,8 @@ module.exports = {
   resolveSource,
   resolveDest,
   copyTreeSkipCollisions,
+  copySingleFile,
   SUBDIRS,
+  SINGLE_FILES,
   EXCLUDED_FILES,
 };

package/lib/share.js

@@ -5,10 +5,11 @@ const path = require('path');
 
 const profiles = require('./profiles');
 
-// Only projects/ holds the resumable conversation transcripts (projects/<proj>/<session>.jsonl).
+// Artifact directories that are safe to share across profiles via junctions/symlinks.
 // sessions/ is transient per-process registry state (PID, cwd, status, timestamps) and
 // must stay per-profile — sharing it would corrupt Claude's running-process bookkeeping.
-const SHARED_SUBDIRS = ['projects'];
+// plugins/ carries auth tokens and is intentionally excluded (future opt-in).
+const SHARED_SUBDIRS = ['projects', 'skills', 'agents', 'commands'];
 
 function symlinkType() {
   return process.platform === 'win32' ? 'junction' : 'dir';
@@ -70,6 +71,11 @@ function migrateIntoShared(profileName, src, sharedTarget) {
   return moved;
 }
 
+// Links each of the four artifact dirs independently. A failure on one
+// directory is recorded and the remaining directories are still attempted —
+// callers get a per-directory result and decide how to report it.
+// Returns [{ sub, status, moved?, message? }]; status is one of:
+//   'linked' | 'already-linked' | 'failed'
 function shareLink(profileName) {
   profiles.validateProfileName(profileName);
   const pdir = profiles.profileDir(profileName);
@@ -79,26 +85,31 @@ function shareLink(profileName) {
     throw err;
   }
   ensureSharedDirs();
+  const results = [];
   for (const sub of SHARED_SUBDIRS) {
     const target = path.join(profiles.sharedDir(), sub);
     const link = path.join(pdir, sub);
-    if (isLink(link)) {
-      console.log(`  ${sub}: already linked`);
-      continue;
-    }
-    if (fs.existsSync(link)) {
-      const moved = migrateIntoShared(profileName, link, target);
-      console.log(`  ${sub}: migrated ${moved} item(s) into shared`);
-    }
     try {
+      if (isLink(link)) {
+        results.push({ sub, status: 'already-linked' });
+        continue;
+      }
+      let moved = 0;
+      if (fs.existsSync(link)) {
+        moved = migrateIntoShared(profileName, link, target);
+      }
       fs.symlinkSync(target, link, symlinkType());
+      results.push({ sub, status: 'linked', moved });
     } catch (err) {
-      throw new Error(`Cannot link ${link} -> ${target}: ${err.message}`);
+      results.push({ sub, status: 'failed', message: err.message });
     }
-    console.log(`  ${sub}: linked -> ${target}`);
   }
+  return results;
 }
 
+// Mirror of shareLink: each directory is restored independently.
+// Returns [{ sub, status, message? }]; status is one of:
+//   'unlinked' | 'not-linked' | 'failed'
 function shareUnlink(profileName) {
   profiles.validateProfileName(profileName);
   const pdir = profiles.profileDir(profileName);
@@ -107,22 +118,28 @@ function shareUnlink(profileName) {
     err.exitCode = 1;
     throw err;
   }
+  const results = [];
   for (const sub of SHARED_SUBDIRS) {
     const link = path.join(pdir, sub);
     const target = path.join(profiles.sharedDir(), sub);
-    if (!isLink(link)) {
-      console.log(`  ${sub}: not linked, skipping`);
-      continue;
-    }
-    removeLink(link);
-    fs.mkdirSync(link, { recursive: true });
-    if (fs.existsSync(target)) {
-      for (const ent of fs.readdirSync(target)) {
-        copyRecursive(path.join(target, ent), path.join(link, ent));
+    try {
+      if (!isLink(link)) {
+        results.push({ sub, status: 'not-linked' });
+        continue;
       }
+      removeLink(link);
+      fs.mkdirSync(link, { recursive: true });
+      if (fs.existsSync(target)) {
+        for (const ent of fs.readdirSync(target)) {
+          copyRecursive(path.join(target, ent), path.join(link, ent));
+        }
+      }
+      results.push({ sub, status: 'unlinked' });
+    } catch (err) {
+      results.push({ sub, status: 'failed', message: err.message });
     }
-    console.log(`  ${sub}: unlinked, content copied back`);
   }
+  return results;
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cchost",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Host multiple isolated Claude Code accounts on one machine via the `cc` command.",
   "keywords": [
     "claude",
@@ -32,6 +32,7 @@
     "bin",
     "lib",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "main": "lib/cli.js",