cchost 0.3.1 → 0.4.2

package/CHANGELOG.md

@@ -5,6 +5,119 @@ All notable changes to `cchost` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.4.1] - 2026-06-04
+
+### Changed
+
+- **Shared resources expanded from 4 to 7.** Profiles now also auto-link
+  `mcp.json`, `settings.json`, and `CLAUDE.md` into `~/.claude/`, in addition
+  to the four directories (`projects/`, `skills/`, `agents/`, `commands/`).
+  MCP servers, user settings, and user-level memory are now visible to every
+  profile by default — the trust boundary becomes clean: only the three
+  credential files (`.credentials.json`, `.claude.json`, `.cc-env.json`) stay
+  per-profile.
+- **`cc copy` replaces `cc migrate`.** Same direction (`default → <profile>`),
+  same `--force` flag — the verb just matches what the command actually does.
+  `cc migrate` still works as a deprecation alias and forwards to `cc copy`
+  with a one-line warning; it will be removed in a future version.
+- **`cc link` / `cc unlink` accept `--config`** to target the three single
+  files. The three groups now: `--projects`, `--tools`, `--config`. No flag
+  still means all 7.
+- **`cc unlink` is non-destructive.** Materializes the current pool content
+  into a private directory or file as part of breaking the link, so the
+  profile's view of that resource is preserved. Same-name collisions in the
+  profile (if any) are kept untouched.
+- **`cc link` refuses to overwrite private content.** If a profile's resource
+  already has non-empty private content, `cc link` reports it as `refused`
+  and leaves it alone (other resources still link). Move or remove the
+  content manually, then re-run.
+- **`cc remove` requires `--force` when private (unlinked) content exists.**
+  Symlinked resources are still removed silently (the shared pool is
+  untouched); private content prompts the user to acknowledge that its
+  content is unique and will be lost.
+- **`cc list` uses a single `--reveal` flag.** Drops `--reveal-email`;
+  `--reveal` now shows both the API token (where applicable) and the full
+  email. Email mask format also changed for stronger redaction:
+  `allen@cyber.co.in` → `a*************.in` (first char + TLD only; the
+  domain is no longer visible).
+- **`cc list` "Shared" column is `N/7`.**
+
+### Added
+
+- `cc doctor` now backfills missing resource symlinks on existing profiles
+  (e.g. v0.4.0 profiles that pre-date `mcp.json` / `settings.json` /
+  `CLAUDE.md` sharing). Safe auto-fix when the resource is missing or empty;
+  warning-only with manual guidance when private content exists.
+- Windows file symlink fallback: when `fs.symlinkSync(..., 'file')` fails
+  with EPERM/UNKNOWN (Developer Mode not enabled), `cc link` falls back to a
+  hard link so editing-in-place still propagates between profiles. The
+  fallback is noted in the link command output.
+
+### Help
+
+- Per-command help (`cc help <cmd>`) now spells out the 7 resources, the
+  three flag groups, and what stays per-profile.
+
+## [0.4.0] - 2026-06-04
+
+### Changed (breaking)
+
+- **`~/.claude/` is now the shared pool.** Every profile's `projects/`,
+  `skills/`, `agents/`, `commands/` symlink directly into Claude Code's own
+  default config dir. There is no longer a parallel `~/.claude-shared/` pool:
+  the two locations are unified. A profile is now a credential set + a
+  symlinked view onto the shared pool.
+- **`cc add` auto-links all four artifact dirs.** New profiles ship with the
+  symlinks in place, so a skill, agent, or command installed under any profile
+  is immediately visible to every other profile. Bare `claude` (without
+  `cc use`) sees the same set too — there is no profile-vs-bare split.
+- **`cc link <profile>` and `cc unlink <profile>` accept `--tools` and
+  `--projects` flags** to target a subset:
+  - `--tools` → `skills/`, `agents/`, `commands/`
+  - `--projects` → `projects/`
+  - No flag → all four (current default behavior)
+- **`cc list` "Shared" column expects `4/4`** as the steady state for v0.4
+  profiles. `0/4`, `3/4`, etc. show profiles whose tool or project sharing has
+  been turned off via `cc unlink --tools` / `--projects`.
+
+### Removed
+
+- **`cc migrate default shared` and `cc migrate shared <profile>`.** The shared
+  pool was the destination of the first and the source of the second; with the
+  pool unified into `~/.claude/`, both directions are no-ops. Use
+  `cc link <profile>` / `cc unlink <profile>` to control sharing.
+
+### Migration from 0.3.x
+
+The v0.3 pool at `~/.claude-shared/` is folded into `~/.claude/` automatically
+on the next `cc add` or `cc doctor --fix`. The migration:
+
+- Moves every entry in `~/.claude-shared/{projects,skills,agents,commands}/`
+  into the matching `~/.claude/<sub>/`, renaming on collision (existing
+  `~/.claude/` content is never overwritten — duplicates get an `__legacy`
+  suffix).
+- Re-points any existing profile symlink that targets `~/.claude-shared/<sub>/`
+  to `~/.claude/<sub>/`.
+- Removes `~/.claude-shared/` once empty.
+
+Idempotent and non-destructive — re-running is a no-op once the legacy dir is
+gone. `cc doctor` surfaces an explicit warning while the legacy dir still
+exists, with a `--fix` action that runs the migration.
+
+## [0.3.2] - 2026-06-04
+
+### Changed
+
+- **`cc list` masks account emails by default.** Emails are shown as
+  `i***@example.com` in both the table view and the per-profile detail view,
+  including the `--json` output. Pass `--reveal-email` to print them in full.
+  The list is now safe to paste in screenshots or issue reports.
+- `--reveal-email` is rejected together with `--json` — same precedent as
+  `--reveal`. Scripts that need the real address can read `.claude.json`
+  directly.
+- Token masking is unchanged: `--reveal` still works on `cc list <profile>`
+  and `--reveal-email` does not affect it.
+
 ## [0.3.1] - 2026-05-19
 
 ### Changed

package/README.md

@@ -1,8 +1,19 @@
 # cchost
 
-Host multiple isolated Claude Code accounts on one machine via a single `cc` command. `cc` is a plain Node CLI on your PATH, so it runs the same from PowerShell, cmd, bash, zsh, or fish — there are no shell scripts or rc-file edits involved. Tested on Windows and Linux; macOS is expected to work but is not yet verified.
+[![npm version](https://img.shields.io/npm/v/cchost.svg)](https://www.npmjs.com/package/cchost)
+[![CI](https://github.com/allenhack638/cchost/actions/workflows/ci.yml/badge.svg)](https://github.com/allenhack638/cchost/actions/workflows/ci.yml)
+[![license](https://img.shields.io/npm/l/cchost.svg)](./LICENSE)
+[![node](https://img.shields.io/node/v/cchost.svg)](https://nodejs.org)
 
-Each profile is a complete, isolated `CLAUDE_CONFIG_DIR` — credentials, session history, project state, plugins, and settings. Create one with `cc add <name>`; launch under it with `cc use <name>`.
+<!-- Demo: record a ~15s clip of `cc add` → `cc use` → `cc list`, save it as
+     docs/demo.gif, and uncomment the line below. -->
+<!-- ![cchost in action](docs/demo.gif) -->
+
+Claude Code keeps one account's login, history, and settings in a single config directory. To use a second account you normally have to log out and back in, which loses your place. cchost gives each account its own directory so you can keep several side by side and pick one when you launch.
+
+Each profile is a complete, isolated `CLAUDE_CONFIG_DIR`: credentials, session history, project state, plugins, and settings. Create one with `cc add <name>`, launch under it with `cc use <name>`. Nothing is shared between profiles unless you ask for it.
+
+`cc` is a plain Node CLI on your PATH, so it works the same from PowerShell, cmd, bash, zsh, or fish. No shell scripts, no rc-file edits. Tested on Windows, Linux, and macOS in CI.
 
 ## Install
 
@@ -16,14 +27,14 @@ Requires Node.js 18+ and Claude Code 2.1.140+ already installed. Get Claude Code
 
 | Command | What it does |
 | --- | --- |
-| `cc add <profile>` | Create a subscription profile (logs in with Anthropic OAuth on first use). |
+| `cc add <profile>` | Create a subscription profile (logs in with Anthropic OAuth on first use). Auto-symlinks artifact dirs into `~/.claude/`. |
 | `cc add <profile> --custom [...]` | Create — or, if it already exists, edit — a profile routed through a custom API endpoint. Opens a wizard, or takes `--base-url=URL --token=TOKEN [--model=…]`. See [Custom endpoints](#custom-endpoints-kimi-openrouter-etc). |
 | `cc use <profile> [...args]` | Launch Claude under that profile. Profile must already exist. Args after the name are forwarded verbatim to `claude`. |
-| `cc list [<profile>] [--json] [--reveal]` | List every profile (login state, email, shared dirs N/4, endpoint), or show one profile in detail. `--reveal` unmasks a custom endpoint's API token. |
-| `cc migrate <src> <dest> [--force]` | Copy artifacts from `default`\|`shared` to `shared`\|`<profile>`. Skip-on-collision by default; `--force` overwrites. |
-| `cc link <profile> [<profile>...]` | Link a profile's artifact dirs to `~/.claude-shared/`. Migrates existing content; renames on collision. |
-| `cc unlink <profile>` | Restore a profile to its own private artifact dirs (copies shared content back). |
-| `cc remove <profile>` | Delete a profile. Requires typing the profile name to confirm. |
+| `cc list [<profile>] [--json] [--reveal]` | List every profile (login state, email, shared count N/7, endpoint), or show one profile in detail. Emails and tokens are masked by default; `--reveal` shows both in full. |
+| `cc copy default <profile> [--force]` | Copy `~/.claude/` resources into a profile. Meaningful only when one or more resources have been unlinked via `cc unlink`; otherwise every resource resolves to the same on-disk path and is skipped. Skip-on-collision by default; `--force` overwrites. `cc migrate` is a deprecated alias. |
+| `cc link <profile> [<profile>...] [--projects\|--tools\|--config]` | (Re-)link a profile's resources to `~/.claude/`. No flag = all 7. Refuses to overwrite private content. |
+| `cc unlink <profile> [--projects\|--tools\|--config]` | Break the links and copy current `~/.claude/` content into the profile as private resources. Non-destructive. |
+| `cc remove <profile> [--force]` | Delete a profile. Requires typing the profile name to confirm. `--force` is required when private (unlinked) resources exist. |
 | `cc doctor [--fix [--force]] [--json]` | Diagnose environment, storage, and platform issues. |
 | `cc help [command]` | Print usage (top-level, or for a single command). |
 
@@ -41,88 +52,87 @@ cc remove old-profile
 `cc list` output:
 
 ```
-Profile   LoggedIn  Email                 Shared  Endpoint
-kimi      false     -                     0/4     api.moonshot.ai
-personal  true      personal@example.com  4/4     subscription
-scratch   false     -                     0/4     subscription
-work      true      work@example.com      0/4     subscription
+Profile   LoggedIn  Email                  Shared  Endpoint
+kimi      false     -                      7/7     api.moonshot.ai
+personal  true      p************.com      7/7     subscription
+scratch   false     -                      7/7     subscription
+work      true      w************.com      7/7     subscription
 ```
 
-The **Shared** column is a count: how many of the 4 shareable directories
-(`projects`, `skills`, `agents`, `commands`) are linked to `~/.claude-shared/`.
+`7/7` is the steady state since v0.4.1 — every profile auto-shares 4 dirs (`projects`, `skills`, `agents`, `commands`) **and** 3 files (`mcp.json`, `settings.json`, `CLAUDE.md`) with `~/.claude/`. A lower number means one or more resources were unlinked via `cc unlink <profile> --projects|--tools|--config`.
 
-- `0/4` — fully isolated; the profile keeps its own private copies.
-- `4/4` — fully shared; all four point at the common pool.
-- `1/4`, `2/4`, `3/4` — **partial**, and not a normal state. `cc link` links
-  all four at once and `cc unlink` unlinks all four at once, so you should
-  normally see only `0/4` or `4/4`.
+Emails are masked by default so the list is safe to paste in screenshots and issue reports. Pass `--reveal` to show them in full (same flag also reveals the API token on custom-endpoint profiles).
 
-A partial count has two causes:
+The **Shared** column is a count: how many of the 7 shareable resources symlink into `~/.claude/`.
 
-1. **A link partially failed** — one directory could not be linked (a
-   permission issue, or it was locked) while the others succeeded. `cc link`
-   reports per-directory failures so this is never silent.
-2. **An upgrade from an older cchost.** Versions before `0.2.1` linked only
-   `projects/` — the other three shareable directories did not exist yet. A
-   profile linked under an older version therefore shows `1/4` after you
-   upgrade.
+- `7/7` — the default since v0.4.1. All four artifact dirs *and* the three
+  config files point at the shared pool; a tool, server, or hook configured
+  under any profile is immediately visible to every other profile.
+- `6/7`, `5/7`, … — one or more resources were `cc unlink`ed and now hold
+  private content.
+- `0/7` — fully isolated; the profile keeps its own copy of everything.
+- `4/7` — typical of a profile created on v0.4.0 before the file resources
+  were added. Run `cc doctor --fix` to backfill them.
 
-In both cases the fix is the same — re-run `cc link <profile>`. Already-linked
-directories are skipped and the missing ones are linked, bringing the profile
-to `4/4`.
+### What's shared, what's per-profile
 
-### What migrate copies and what link shares
+Since v0.4.1, **`~/.claude/` is the shared pool**, and **all 7 resources** auto-link into it on `cc add`. The trust boundary is simple: anything that authenticates this profile's identity stays per-profile; everything else is global.
 
-| Artifact | `cc migrate` copies it | `cc link` shares it | Notes |
-| --- | :---: | :---: | --- |
-| `projects/` | ✓ | ✓ | Resumable conversation transcripts |
-| `skills/` | ✓ | ✓ | Custom slash-command scripts |
-| `agents/` | ✓ | ✓ | Custom agent definitions |
-| `commands/` | ✓ | ✓ | Custom command configs |
-| `mcp.json` | ✓ (default→profile only) | — | Per-profile MCP server config; may carry auth tokens |
-| `settings.json` | ✓ (default→profile only) | — | Per-profile UI/feature settings |
-| `CLAUDE.md` | ✓ (default→profile only) | — | Per-profile project instructions |
-| `sessions/` | — | — | Transient per-process state; sharing would corrupt bookkeeping |
-| `plugins/` | — | — | Carries auth tokens; deferred to a future opt-in flag |
-| `.credentials.json` | — | — | Never touched — each profile keeps its own auth |
-| `.claude.json` | — | — | Never touched — re-synced from server on every launch |
-| `.cc-env.json` | — | — | Per-profile custom-endpoint config; holds an API key. Never migrated, never linked. |
+| Resource | Location | Shared? | Flag group |
+| --- | --- | :---: | --- |
+| `projects/` | `~/.claude/projects/` | ✓ (symlink) | `--projects` |
+| `skills/` | `~/.claude/skills/` | ✓ (symlink) | `--tools` |
+| `agents/` | `~/.claude/agents/` | ✓ (symlink) | `--tools` |
+| `commands/` | `~/.claude/commands/` | ✓ (symlink) | `--tools` |
+| `mcp.json` | `~/.claude/mcp.json` | ✓ (file symlink / hard link) | `--config` |
+| `settings.json` | `~/.claude/settings.json` | ✓ (file symlink / hard link) | `--config` |
+| `CLAUDE.md` | `~/.claude/CLAUDE.md` | ✓ (file symlink / hard link) | `--config` |
+| `sessions/` | per-profile | — | (never shared) |
+| `plugins/` | per-profile | — | (never shared) |
+| `.credentials.json` | per-profile | — | Anthropic OAuth token. Never touched. |
+| `.claude.json` | per-profile | — | Account identity (re-synced on every launch). |
+| `.cc-env.json` | per-profile | — | Custom-endpoint API key. Never copied, never linked. |
 
-`mcp.json`, `settings.json`, and `CLAUDE.md` are **not** copied to `shared` and are **not** linked because they typically carry auth tokens or per-profile configuration that should not leak across accounts.
+`mcp.json` carries MCP server tokens and `settings.json` carries hooks that can run arbitrary commands. Sharing them means every profile sees the same set — if you need per-profile separation for one of them, `cc unlink <profile> --config` breaks the link and makes that profile's copies private.
 
-### Migrating existing artifacts
+### Seeding a private profile from `~/.claude/`
 
-If you've been using Claude Code without profiles, your history lives in `~/.claude/`. Pull it into a profile or the shared pool:
+If a profile has unlinked resources (`cc unlink <p>`) and you want to seed them from the current `~/.claude/`:
 
 ```bash
-cc migrate default work        # copy ~/.claude/* → ~/.claude-profiles/work/
-cc migrate default shared      # copy ~/.claude/projects,skills,agents,commands → ~/.claude-shared/
-cc migrate shared personal     # copy ~/.claude-shared/* → ~/.claude-profiles/personal/
-cc migrate default work --force  # same as first, overwriting anything that already exists
+cc copy default work          # copies anything unlinked from ~/.claude/ → work
+cc copy default work --force  # same, overwriting if already present
 ```
 
-This is a **copy** — the source is left untouched. By default, if an entry already exists at the destination it is silently skipped. Pass `--force` to overwrite instead — existing destination content will be cleared.
-
-Credential files (`.credentials.json`, `.claude.json`) are never copied: each profile keeps its own auth state.
+For a fresh `cc add` profile this is a no-op — every resource already resolves to `~/.claude/` via its symlink, so there's nothing to copy. `cc copy` becomes meaningful only after `cc unlink`. (`cc migrate` is a deprecated alias for `cc copy` and still works.)
 
-### Shared artifacts across profiles
-
-If you want each profile to keep separate credentials but share project history and skills (e.g. rotate accounts on the same project when usage limits hit):
+### Opting out of sharing for a profile
 
 ```bash
-cc link work
-cc link personal
+cc unlink work --tools         # private skills/agents/commands for "work" only
+cc unlink work --projects      # private projects/ for "work" only
+cc unlink work --config        # private mcp.json/settings.json/CLAUDE.md
+cc unlink work                 # private everything (all 7 unlinked)
+cc link work --tools           # re-share just the tools
+cc link work --config          # re-share just the config files
 ```
 
-`work/` and `personal/` each get four linked dirs (`projects`, `skills`, `agents`, `commands`) pointing to `~/.claude-shared/`. On Windows this uses directory junctions (no admin/Developer Mode required); on macOS/Linux, regular symlinks.
+`cc unlink` is non-destructive — current pool content is copied into the profile as a private dir or file before the link is broken, so your view of the resource is preserved. `cc link` refuses to overwrite existing private content; move or remove it manually and re-run.
+
+Credential files (`.credentials.json`, `.claude.json`, `.cc-env.json`) are never touched: each profile keeps its own auth state.
+
+### How sharing works under the hood
+
+Every profile created by `cc add` ships with 7 links pointing at `~/.claude/<resource>`:
 
-`sessions/` is **never** linked. It holds transient per-process registry state — PID, working directory, status, timestamps — and sharing it would corrupt Claude's running-process bookkeeping. It stays per-profile under `~/.claude-profiles/<name>/sessions/`.
+- Directories use Windows junctions (no admin / Developer Mode required) or POSIX symlinks.
+- Files (`mcp.json`, `settings.json`, `CLAUDE.md`) use file symlinks where possible. On Windows without Developer Mode, file symlinks require elevation — `cc link` falls back to a **hard link** there, which works without admin and behaves identically for edit-in-place flows.
 
-`cc link a b c` links several profiles at once; per-profile failures are reported but don't abort the rest of the batch.
+`sessions/` and `plugins/` are **never** linked. `sessions/` holds transient per-process registry state (PID, status, timestamps) and sharing it would corrupt Claude's running-process bookkeeping. `plugins/` carries auth tokens.
 
-If two profiles share history and you launch them against the same project at the same time, both will write to the same session files (last write wins). Don't do that.
+If two profiles open the same project at the same time, both will write to the same conversation files in `~/.claude/projects/<cwd>/` (last write wins). Either avoid that or run `cc unlink <profile> --projects` on one of them.
 
-`cc remove` is safe with shared profiles — it deletes only the links, never recursing into the shared target.
+`cc remove` is safe with fully-shared profiles — it deletes only the symlinks, leaving `~/.claude/` untouched. If a profile has *private* (unlinked) resources, `cc remove` requires `--force` because that content is unique to the profile and will be lost.
 
 ## Custom endpoints (Kimi, OpenRouter, etc.)
 
@@ -161,7 +171,7 @@ Profile:   kimi
 Directory: /home/you/.claude-profiles/kimi
 LoggedIn:  false
 Email:     -
-Shared:    0/4
+Shared:    7/7
 Endpoint:  api.moonshot.ai
   Base URL:  https://api.moonshot.ai/anthropic
   Token:     sk-you...key9 (32 chars)
@@ -172,7 +182,7 @@ Endpoint:  api.moonshot.ai
   Subagent:  kimi-k2.5
 ```
 
-`cc list <profile> --reveal` prints the full API key instead — do not paste that output anywhere.
+`cc list <profile> --reveal` prints the full API key and the full email — do not paste that output anywhere.
 
 There is no way to convert a custom-endpoint profile back to a subscription profile. To stop using an endpoint, `cc remove` the profile and recreate it.
 
@@ -197,9 +207,9 @@ The env var is set on the child process only — that's all `claude` needs.
 
 ## Sensitive data
 
-`~/.claude-profiles/<profile>/` holds real OAuth credentials. Treat it like SSH keys: don't commit it, don't share it, don't sync it to public cloud storage. The `.gitignore` shipped with this project excludes profile directories from anywhere they might land. `cc migrate` and `cc link` never copy `.credentials.json` or `.claude.json` across profiles.
+`~/.claude-profiles/<profile>/` holds real OAuth credentials. Treat it like SSH keys: don't commit it, don't share it, don't sync it to public cloud storage. The `.gitignore` shipped with this project excludes profile directories from anywhere they might land. `cc copy` and `cc link` never touch `.credentials.json` or `.claude.json`.
 
-`.cc-env.json` (custom-endpoint config) contains a third-party **API key** — treat it exactly like `.credentials.json`. It is written with user-only file permissions, and `cc migrate`/`cc link` never copy or link it across profiles. `cc list <profile>` masks the token; only `cc list <profile> --reveal` prints it in full.
+`.cc-env.json` (custom-endpoint config) contains a third-party **API key** — treat it exactly like `.credentials.json`. It is written with user-only file permissions, and `cc copy`/`cc link` never copy or link it across profiles. `cc list <profile>` masks the token; only `cc list <profile> --reveal` prints it in full.
 
 ## Troubleshooting
 

package/lib/banner.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const BANNER =
+  '\n' +
+  '   ██████╗ ██████╗██╗  ██╗ ██████╗ ███████╗████████╗\n' +
+  '  ██╔════╝██╔════╝██║  ██║██╔═══██╗██╔════╝╚══██╔══╝\n' +
+  '  ██║     ██║     ███████║██║   ██║███████╗   ██║   \n' +
+  '  ██║     ██║     ██╔══██║██║   ██║╚════██║   ██║   \n' +
+  '  ╚██████╗╚██████╗██║  ██║╚██████╔╝███████║   ██║   \n' +
+  '   ╚═════╝ ╚═════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝   ╚═╝   \n';
+
+function renderBanner() {
+  let version = '';
+  try {
+    version = require('../package.json').version;
+  } catch {
+  }
+  const tagline = 'Multi-profile launcher for Claude Code';
+  return BANNER + '         ' + '\n\n';
+}
+
+module.exports = { renderBanner, BANNER };