cchost 0.4.4 → 0.6.0

package/lib/doctor.js

@@ -6,16 +6,20 @@ const os = require('os');
 
 const profiles = require('./profiles');
 const share = require('./share');
+const envLib = require('./env');
 const { findClaude, getClaudeVersion, compareVersion, MIN_VERSION } = require('./spawn');
 const color = require('./color');
 
 const GROUP_ORDER = ['Environment', 'Storage', 'Platform', 'Sanity'];
 
+// Default sink for fix progress. JSON mode passes a stderr writer instead.
+const stdoutWrite = (text) => process.stdout.write(text);
+
 // fix: { safe, description, cmd, apply }
 //   safe=true  → auto-applied by --fix
-//   safe=false → needs --fix --force, prompted y/n
+//   safe=false → needs --fix --force, prompted y/N
 //   cmd        → printed when fix cannot be auto-applied
-//   apply      → async fn to execute
+//   apply      → async fn to execute, receives the progress writer
 
 function mk(group, name, status, message, fix) {
   return { group, name, status, message, fix: fix || null };
@@ -60,23 +64,21 @@ function checkClaudeVersion() {
   });
 }
 
-const CONFLICT_VARS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN'];
-
 function checkConflictingEnv() {
-  const set = CONFLICT_VARS.filter(k => process.env[k]);
+  const set = envLib.authEnvConflicts();
   if (set.length === 0) return mk('Environment', 'conflicting env vars', 'ok', 'none set');
   const cmd = process.platform === 'win32'
     ? set.map(k => `Remove-Item Env:${k}`).join('; ')
     : set.map(k => `unset ${k}`).join('; ');
   return mk('Environment', 'conflicting env vars', 'warn', `set: ${set.join(', ')}`, {
-    safe: false, description: 'Unset to avoid auth interference with cc use', cmd, apply: null,
+    safe: false, description: 'Unset to avoid auth interference with cchost use', cmd, apply: null,
   });
 }
 
-function findAllOnPath(name) {
+function findAllOnPath(name, platform = process.platform) {
   const PATH = process.env.PATH || process.env.Path || '';
-  const sep = process.platform === 'win32' ? ';' : ':';
-  const exts = process.platform === 'win32'
+  const sep = platform === 'win32' ? ';' : ':';
+  const exts = platform === 'win32'
     ? (process.env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';').map(s => s.trim()).filter(Boolean)
     : [''];
   const found = [];
@@ -86,7 +88,7 @@ function findAllOnPath(name) {
       try {
         const full = path.join(dir, name + ext);
         if (fs.statSync(full).isFile()) {
-          const key = process.platform === 'win32' ? full.toLowerCase() : full;
+          const key = platform === 'win32' ? full.toLowerCase() : full;
           if (!seen.has(key)) { seen.add(key); found.push(full); }
           break;
         }
@@ -96,13 +98,94 @@ function findAllOnPath(name) {
   return found;
 }
 
-function checkCcShadow() {
-  const all = findAllOnPath('cc');
-  if (all.length <= 1) {
-    return mk('Environment', 'cc on PATH', 'ok', all[0] || 'not found yet (expected after npm install -g)');
+// Resolve a path to the object it points at.
+function pathIdentity(p) {
+  try {
+    return fs.realpathSync(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+// True only when `p` really is the cchost CLI. A bare `cc` may be a compiler
+// (clang, gcc, ccache, conda) and must not be mistaken for the legacy alias.
+function isCchostBinary(p) {
+  const target = pathIdentity(p);
+  if (/[\\/]cchost[\\/]bin[\\/]cc\.js$/i.test(target)) return true;
+  try {
+    const st = fs.statSync(target);
+    if (!st.isFile() || st.size > 256 * 1024) return false;
+    const text = fs.readFileSync(target, 'utf8');
+    return /cchost/i.test(text) && /(node_modules|cc\.js)/i.test(text);
+  } catch {
+    return false;
+  }
+}
+
+// Windows npm writes separate cc.cmd and cchost.cmd shims. Extract the
+// bin/cc.js they invoke so shims from the same install share an identity while
+// a stale shim pointing elsewhere still counts as a separate install.
+function shimTarget(p) {
+  if (!/\.(cmd|bat|ps1)$/i.test(p)) return null;
+  try {
+    const text = fs.readFileSync(p, 'utf8');
+    const m = text.match(
+      /(?:[A-Za-z]:[\\/]|%dp0%[\\/]|%~dp0[\\/]|(?:\.\.?[\\/]))[^"\r\n]*?node_modules[\\/]+cchost[\\/]+bin[\\/]+cc\.js/i,
+    );
+    if (!m) return null;
+    const raw = m[0];
+    if (/^[A-Za-z]:[\\/]/.test(raw)) {
+      return raw.replace(/[\\/]/g, '\\').toLowerCase();
+    }
+    const relative = raw
+      .replace(/^%dp0%|^%~dp0/i, '')
+      .replace(/^[\\/]+/, '')
+      .replace(/[\\/]/g, path.sep);
+    return path.resolve(path.dirname(p), relative).replace(/[\\/]/g, '\\').toLowerCase();
+  } catch {
+    return null;
+  }
+}
+
+function shadowIdentity(p, platform = process.platform) {
+  if (platform === 'win32') {
+    const target = shimTarget(p);
+    if (target) return `shim:${target}`;
+  }
+  return pathIdentity(p);
+}
+
+function checkCcShadow(platform = process.platform) {
+  const found = [];
+  for (const name of ['cchost', 'cc']) {
+    for (const p of findAllOnPath(name, platform)) {
+      if (name === 'cc' && !isCchostBinary(p)) continue;
+      found.push({ name, path: p });
+    }
+  }
+
+  const unique = [];
+  const seen = new Set();
+  for (const entry of found) {
+    const key = shadowIdentity(entry.path, platform);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(entry);
+  }
+
+  if (unique.length <= 1) {
+    return mk(
+      'Environment',
+      'cchost on PATH',
+      'ok',
+      unique.length ? unique[0].path : 'not found yet (expected after npm install -g cchost)',
+    );
   }
-  return mk('Environment', 'cc on PATH', 'warn', `multiple: ${all.join(', ')}`, {
-    safe: false, description: 'Remove duplicate cc entries to avoid version confusion', cmd: null, apply: null,
+  return mk('Environment', 'cchost on PATH', 'warn', `multiple: ${unique.map((e) => e.path).join(', ')}`, {
+    safe: false,
+    description: 'Remove duplicate cchost/cc entries to avoid version confusion',
+    cmd: null,
+    apply: null,
   });
 }
 
@@ -115,9 +198,9 @@ function checkProfilesDirWritable() {
       safe: true,
       description: `Create ${base}`,
       cmd: null,
-      apply: async () => {
+      apply: async (write = stdoutWrite) => {
         fs.mkdirSync(base, { recursive: true });
-        process.stdout.write(`  Created ${base}\n`);
+        write(`  Created ${base}\n`);
       },
     });
   }
@@ -146,11 +229,11 @@ function checkProfileClaudeJson(prof) {
       safe: false,
       description: `Back up ${path.basename(p)} and reset to {}`,
       cmd: null,
-      apply: async () => {
+      apply: async (write = stdoutWrite) => {
         const bak = `${p}.bak.${Date.now()}`;
         fs.renameSync(p, bak);
         fs.writeFileSync(p, '{}');
-        process.stdout.write(`  Backed up to ${path.basename(bak)}, reset to {}\n`);
+        write(`  Backed up to ${path.basename(bak)}, reset to {}\n`);
       },
     });
   }
@@ -167,6 +250,16 @@ function checkProfileLinks(prof) {
     let stat;
     try { stat = fs.lstatSync(pp); } catch { stat = null; }
 
+    // Private on purpose (add --private / unlink): never offer to re-share it.
+    if (
+      (!stat || !stat.isSymbolicLink()) &&
+      !share.isSharedResource(prof.dir, resource) &&
+      share.isMarkedPrivate(prof.dir, resource)
+    ) {
+      results.push(mk('Storage', `"${prof.name}" ${label}`, 'ok', 'private by choice'));
+      continue;
+    }
+
     if (!stat) {
       // Resource missing entirely — safe to auto-create the link.
       results.push(
@@ -174,12 +267,12 @@ function checkProfileLinks(prof) {
           safe: true,
           description: `Create link to ~/.claude/${resource}`,
           cmd: null,
-          apply: async () => {
+          apply: async (write = stdoutWrite) => {
             const r = share.shareLink(prof.name, subsetForResource(resource))[0];
             if (r && r.status === 'linked') {
-              process.stdout.write(`  Linked: ${pp} -> ${expected}\n`);
+              write(`  Linked: ${pp} -> ${expected}\n`);
             } else if (r) {
-              process.stdout.write(`  Could not link ${pp}: ${r.message || r.status}\n`);
+              write(`  Could not link ${pp}: ${r.message || r.status}\n`);
             }
           },
         }),
@@ -199,13 +292,13 @@ function checkProfileLinks(prof) {
           safe: true,
           description: `Recreate link to ${expected}`,
           cmd: null,
-          apply: async () => {
+          apply: async (write = stdoutWrite) => {
             share.removeLink(pp);
             const r = share.shareLink(prof.name, subsetForResource(resource))[0];
             if (r && (r.status === 'linked' || r.status === 'already-linked')) {
-              process.stdout.write(`  Recreated: ${pp} -> ${expected}\n`);
+              write(`  Recreated: ${pp} -> ${expected}\n`);
             } else if (r) {
-              process.stdout.write(`  Could not recreate ${pp}: ${r.message || r.status}\n`);
+              write(`  Could not recreate ${pp}: ${r.message || r.status}\n`);
             }
           },
         }),
@@ -233,16 +326,16 @@ function checkProfileLinks(prof) {
           safe: true,
           description: `Replace with link to ~/.claude/${resource}`,
           cmd: null,
-          apply: async () => {
+          apply: async (write = stdoutWrite) => {
             try {
               if (isFile) fs.unlinkSync(pp);
               else fs.rmdirSync(pp);
             } catch { /* fall through */ }
             const r = share.shareLink(prof.name, subsetForResource(resource))[0];
             if (r && r.status === 'linked') {
-              process.stdout.write(`  Linked: ${pp} -> ${expected}\n`);
+              write(`  Linked: ${pp} -> ${expected}\n`);
             } else if (r) {
-              process.stdout.write(`  Could not link ${pp}: ${r.message || r.status}\n`);
+              write(`  Could not link ${pp}: ${r.message || r.status}\n`);
             }
           },
         }),
@@ -253,9 +346,9 @@ function checkProfileLinks(prof) {
     results.push(
       mk('Storage', `"${prof.name}" ${label}`, 'warn', 'private (has content) — not linked', {
         safe: false,
-        description: 'Move or remove the private content, then re-run cc link',
-        cmd: `cc copy default ${prof.name}  # if you want to merge it the other way; ` +
-          `or manually move ${pp} aside, then: cc link ${prof.name}`,
+        description: 'Move or remove the private content, then re-run cchost link',
+        cmd: `cchost copy default ${prof.name}  # if you want to merge it the other way; ` +
+          `or manually move ${pp} aside, then: cchost link ${prof.name}`,
         apply: null,
       }),
     );
@@ -315,9 +408,9 @@ function checkLegacyPool() {
       safe: true,
       description: 'Remove the empty legacy pool',
       cmd: null,
-      apply: async () => {
-        try { fs.rmdirSync(legacy); process.stdout.write(`  Removed ${legacy}\n`); } catch (e) {
-          process.stdout.write(`  Could not remove ${legacy}: ${e.message}\n`);
+      apply: async (write = stdoutWrite) => {
+        try { fs.rmdirSync(legacy); write(`  Removed ${legacy}\n`); } catch (e) {
+          write(`  Could not remove ${legacy}: ${e.message}\n`);
         }
       },
     });
@@ -326,9 +419,9 @@ function checkLegacyPool() {
     safe: true,
     description: 'Move legacy pool contents into ~/.claude/ and re-point profile symlinks',
     cmd: null,
-    apply: async () => {
-      const result = share.migrateLegacyPool({ log: (line) => process.stdout.write(`  ${line}\n`) });
-      process.stdout.write(
+    apply: async (write = stdoutWrite) => {
+      const result = share.migrateLegacyPool({ log: (line) => write(`  ${line}\n`) });
+      write(
         `  Done: ${result.moves.length} item(s) moved, ${result.relinked.length} link(s) repointed.\n`,
       );
     },
@@ -377,16 +470,16 @@ function checkDamagedSessionFilenames() {
       safe: true,
       description: 'Restore <uuid>.jsonl filenames (reissue a fresh UUID when canonical is taken)',
       cmd: null,
-      apply: async () => {
+      apply: async (write = stdoutWrite) => {
         const result = share.repairProjectFilenames({
-          log: (line) => process.stdout.write(`${line}\n`),
+          log: (line) => write(`${line}\n`),
         });
-        process.stdout.write(
+        write(
           `  Done: ${result.repaired.length} filename${result.repaired.length === 1 ? '' : 's'} restored.\n`,
         );
         if (result.failures.length) {
           for (const f of result.failures) {
-            process.stdout.write(`  Failure (${f.kind}): ${f.folder ? f.folder + '/' : ''}${f.name || ''} ${f.message}\n`);
+            write(`  Failure (${f.kind}): ${f.folder ? f.folder + '/' : ''}${f.name || ''} ${f.message}\n`);
           }
         }
       },
@@ -419,16 +512,16 @@ function checkLegacyProjectFolders() {
       safe: true,
       description: 'Merge each legacy projects/ folder into its canonical sibling',
       cmd: null,
-      apply: async () => {
+      apply: async (write = stdoutWrite) => {
         const result = share.healProjectsLegacy({
-          log: (line) => process.stdout.write(`  ${line}\n`),
+          log: (line) => write(`  ${line}\n`),
         });
-        process.stdout.write(
+        write(
           `  Done: ${result.healed.length} folder${result.healed.length === 1 ? '' : 's'} healed.\n`,
         );
         if (result.failures.length) {
           for (const f of result.failures) {
-            process.stdout.write(`  Failure (${f.kind}): ${f.name || ''} ${f.message}\n`);
+            write(`  Failure (${f.kind}): ${f.name || ''} ${f.message}\n`);
           }
         }
       },
@@ -453,7 +546,7 @@ function checkWindowsAppsCc() {
   if (process.platform !== 'win32') return null;
   const p = path.join(process.env.LOCALAPPDATA || '', 'Microsoft', 'WindowsApps', 'cc.cmd');
   if (!fs.existsSync(p)) return mk('Platform', 'WindowsApps cc.cmd', 'ok', 'not present');
-  return mk('Platform', 'WindowsApps cc.cmd', 'warn', `${p} may shadow npm-installed cc`, {
+  return mk('Platform', 'WindowsApps cc.cmd', 'warn', `${p} may shadow npm-installed cchost`, {
     safe: false, description: 'Delete the stale stub', cmd: `del "${p}"`, apply: null,
   });
 }
@@ -462,7 +555,7 @@ function checkStaleBinCc() {
   if (process.platform !== 'win32') return null;
   const p = path.join(os.homedir(), 'bin', 'cc');
   if (!fs.existsSync(p)) return null;
-  return mk('Platform', '~/bin/cc', 'warn', `${p} may be an old version shadowing npm-installed cc`, {
+  return mk('Platform', '~/bin/cc', 'warn', `${p} may be an old version shadowing npm-installed cchost`, {
     safe: false, description: 'Remove the old script', cmd: `Remove-Item "${p}"`, apply: null,
   });
 }
@@ -476,6 +569,31 @@ function checkCygpath() {
   });
 }
 
+// macOS keeps OAuth tokens in the login Keychain rather than in the profile
+// directory. Current Claude Code versions namespace the entry by the exact
+// CLAUDE_CONFIG_DIR path, so profiles get separate logins; renaming or moving
+// a profile changes the path and requires a fresh login.
+function checkMacKeychain(platform = process.platform) {
+  if (platform !== 'darwin') return null;
+  let profilesList = [];
+  try {
+    profilesList = profiles.listProfiles(platform);
+  } catch {
+    return null;
+  }
+  const keychainProfiles = profilesList.filter(
+    (p) => !envLib.hasEnvConfig(p.dir) && p.credentialSource === 'keychain',
+  );
+  // Nothing to explain until some profile actually logs in through the Keychain.
+  if (keychainProfiles.length === 0) return null;
+  return mk(
+    'Platform',
+    'macOS credentials (Keychain)',
+    'ok',
+    `${keychainProfiles.length} profile(s) with a Keychain login; entries are namespaced by CLAUDE_CONFIG_DIR path (renaming or moving a profile requires a new login)`,
+  );
+}
+
 // --- Sanity ---
 
 function checkSpawnClaude() {
@@ -507,6 +625,7 @@ function runChecks() {
     results.push(...checkProfileLinks(prof));
   }
   results.push(
+    checkMacKeychain(),
     checkOneDrive(),
     checkWindowsAppsCc(),
     checkStaleBinCc(),
@@ -543,7 +662,7 @@ function formatText(results) {
         if (r.fix.cmd) {
           lines.push(`       → Run: ${r.fix.cmd}`);
         } else if (r.fix.apply) {
-          lines.push(`       → Run: ${r.fix.safe ? 'cc doctor --fix' : 'cc doctor --fix --force'}`);
+          lines.push(`       → Run: ${r.fix.safe ? 'cchost doctor --fix' : 'cchost doctor --fix --force'}`);
         }
       }
     }
@@ -571,42 +690,68 @@ function formatJson(results) {
 
 // --- Fix runner ---
 
-async function applyFixes(results, force, promptFn) {
+async function applyFixes(results, force, promptFn, write = stdoutWrite) {
   const toFix = results.filter(r => r.fix && r.fix.apply && (r.fix.safe || force));
   if (toFix.length === 0) {
-    process.stdout.write('Nothing auto-fixable found.\n');
-    return;
+    write('Nothing auto-fixable found.\n');
+    return 0;
   }
+  let applied = 0;
   for (const r of toFix) {
     if (r.fix.safe) {
-      process.stdout.write(`Fixing: ${r.name}\n`);
-      await r.fix.apply();
+      write(`Fixing: ${r.name}\n`);
+      await r.fix.apply(write);
+      applied += 1;
     } else {
       const ans = await promptFn(`Fix "${r.name}" — ${r.fix.description || r.name}? [y/N]: `);
       if (ans.trim().toLowerCase() === 'y') {
-        await r.fix.apply();
+        await r.fix.apply(write);
+        applied += 1;
       } else {
-        process.stdout.write('  Skipped.\n');
+        write('  Skipped.\n');
       }
     }
   }
+  return applied;
+}
+
+function doctorExitCode(results) {
+  if (results.some(r => r.status === 'error')) return 2;
+  if (results.some(r => r.status === 'warn')) return 1;
+  return 0;
 }
 
 // --- Entry point ---
 
 async function runDoctor({ fix, force, json, prompt: promptFn }) {
-  const results = runChecks();
+  let results = runChecks();
+
+  if (json && fix) {
+    // Fix progress must not corrupt the JSON document: send it (and any
+    // prompts) to stderr, then emit one report of the post-fix state.
+    const stderrWrite = (text) => process.stderr.write(text);
+    const promptOnStderr = (question) => promptFn(question, process.stderr);
+    const applied = await applyFixes(results, force, promptOnStderr, stderrWrite);
+    if (applied > 0) results = runChecks();
+    process.stdout.write(formatJson(results) + '\n');
+    return doctorExitCode(results);
+  }
 
   if (json) {
     process.stdout.write(formatJson(results) + '\n');
-  } else {
-    process.stdout.write(formatText(results));
+    return doctorExitCode(results);
   }
 
+  process.stdout.write(formatText(results));
+
   if (fix) {
-    if (!json) process.stdout.write('Applying fixes...\n');
-    await applyFixes(results, force, promptFn);
-  } else if (!json) {
+    process.stdout.write('Applying fixes...\n');
+    const applied = await applyFixes(results, force, promptFn);
+    if (applied > 0) {
+      results = runChecks();
+      process.stdout.write('\nAfter fixes:\n' + formatText(results));
+    }
+  } else {
     const errors = results.filter(r => r.status === 'error');
     const warns = results.filter(r => r.status === 'warn');
     if (errors.length === 0 && warns.length === 0) {
@@ -618,14 +763,12 @@ async function runDoctor({ fix, force, json, prompt: promptFn }) {
       process.stdout.write(`${parts.join(', ')}.\n`);
       const hasAutoFix = results.some(r => r.fix && r.fix.apply && r.fix.safe);
       const hasForce = results.some(r => r.fix && r.fix.apply && !r.fix.safe);
-      if (hasAutoFix) process.stdout.write('Run: cc doctor --fix\n');
-      else if (hasForce) process.stdout.write('Run: cc doctor --fix --force\n');
+      if (hasAutoFix) process.stdout.write('Run: cchost doctor --fix\n');
+      else if (hasForce) process.stdout.write('Run: cchost doctor --fix --force\n');
     }
   }
 
-  if (results.some(r => r.status === 'error')) return 2;
-  if (results.some(r => r.status === 'warn')) return 1;
-  return 0;
+  return doctorExitCode(results);
 }
 
-module.exports = { runChecks, runDoctor };
+module.exports = { runChecks, runDoctor, applyFixes, checkCcShadow, checkMacKeychain };

package/lib/env.js

@@ -8,7 +8,7 @@
 // an API key and is treated with the same care as `.credentials.json`: it is
 // never migrated, never linked, and written with user-only file permissions.
 //
-// Endpoint profiles are created and edited through `cc add <profile> --custom`;
+// Endpoint profiles are created and edited through `cchost add <profile> --custom`;
 // this module supplies the configuration logic that command delegates to.
 
 const fs = require('fs');
@@ -21,6 +21,26 @@ const ENV_FILE = '.cc-env.json';
 // Persisted fields, in canonical serialization order.
 const FIELDS = ['base_url', 'auth_token', 'model', 'opus', 'sonnet', 'haiku', 'subagent'];
 const TIER_FIELDS = ['opus', 'sonnet', 'haiku', 'subagent'];
+// Fields whose value must be a string if present. Optional fields are ignored
+// (treated as absent) when hand-edited to a non-string value.
+const STRICT_STRING_FIELDS = ['base_url', 'auth_token'];
+
+// Environment variables Claude Code reads for authentication. If any of these
+// are inherited by a subscription profile, they can silently override the
+// profile's own OAuth login (and billing).
+const AUTH_ENV_VARS = ['ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN'];
+
+function authEnvConflicts(env = process.env) {
+  return AUTH_ENV_VARS.filter((key) => env[key]);
+}
+
+// Endpoint profiles must not inherit the parent's Anthropic auth/endpoint
+// settings. Keep only the values buildEnvVars() set for this profile.
+const ENDPOINT_ENV_VARS = [...AUTH_ENV_VARS, 'ANTHROPIC_BASE_URL'];
+
+function endpointEnvToStrip(profileEnv, env = process.env) {
+  return ENDPOINT_ENV_VARS.filter((key) => env[key] && !profileEnv[key]);
+}
 
 // File field -> env var(s) injected into the spawned child.
 const TIER_ENV = {
@@ -80,6 +100,20 @@ function readEnvConfig(profileDir) {
     e.malformed = true;
     throw e;
   }
+  for (const key of STRICT_STRING_FIELDS) {
+    if (data[key] == null) continue;
+    if (typeof data[key] !== 'string') {
+      const e = stateError(`${ENV_FILE} is malformed: field "${key}" must be a string.`);
+      e.malformed = true;
+      throw e;
+    }
+  }
+  // Optional fields are best-effort: a hand-edited non-string value must not
+  // make the whole profile unusable. Treat it as absent instead.
+  for (const key of FIELDS) {
+    if (STRICT_STRING_FIELDS.includes(key)) continue;
+    if (data[key] != null && typeof data[key] !== 'string') delete data[key];
+  }
   return data;
 }
 
@@ -129,9 +163,27 @@ function writeEnvConfig(profileDir, config) {
   const target = envFilePath(profileDir);
   const tmp = path.join(profileDir, `${ENV_FILE}.tmp-${process.pid}`);
   // Write to a temp file then rename, so a crash never leaves a partial file.
-  // Permissions are locked down after the rename: restricting the temp file's
-  // ACL first makes the subsequent rename fail with EPERM on Windows.
-  fs.writeFileSync(tmp, JSON.stringify(out, null, 2) + '\n');
+  // The temp file is created 0600 so an orphaned temp cannot expose the token.
+  // Permissions are locked down again after the rename: restricting the temp
+  // file's ACL first makes the subsequent rename fail with EPERM on Windows.
+  // Remove any stale temp left by pid reuse, then create with O_EXCL so a race
+  // cannot make us write the token into a file with an inherited, looser mode.
+  fs.rmSync(tmp, { force: true });
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(out, null, 2) + '\n', {
+      mode: 0o600,
+      flag: 'wx',
+    });
+  } catch (err) {
+    if (err.code !== 'EEXIST') {
+      try {
+        fs.unlinkSync(tmp);
+      } catch {
+        // best effort cleanup
+      }
+    }
+    throw err;
+  }
   try {
     fs.renameSync(tmp, target);
   } catch (err) {
@@ -173,7 +225,7 @@ function hostOf(url) {
   }
 }
 
-// Endpoint summary for `cc list`. Returns the base-url host, 'subscription'
+// Endpoint summary for `cchost list`. Returns the base-url host, 'subscription'
 // (no endpoint config), or '(invalid config)' for a malformed file — never
 // throws, so a single bad profile cannot break the whole table.
 function endpointSummary(profileDir) {
@@ -382,7 +434,7 @@ async function runWizard(name, existing, io) {
 // Command orchestration (called from cli.js)
 // ---------------------------------------------------------------------------
 
-// Configures a profile's custom endpoint. Called by `cc add <profile> --custom`
+// Configures a profile's custom endpoint. Called by `cchost add <profile> --custom`
 // (both for first-time creation and for editing an existing endpoint profile).
 // `provided` is a partial config of fields supplied via flags.
 // `opts.io` injects wizard IO (tests); `opts.isTTY` overrides TTY detection.
@@ -391,14 +443,14 @@ async function runWizard(name, existing, io) {
 // wizard was cancelled, so the caller can clean up a freshly-created profile.
 async function runConfigure(name, profileDir, provided, opts = {}) {
   if (!fs.existsSync(profileDir)) {
-    throw stateError(`Profile "${name}" does not exist. Create it with: cc add ${name}`);
+    throw stateError(`Profile "${name}" does not exist. Create it with: cchost add ${name}`);
   }
   if (hasOAuthState(profileDir)) {
     throw stateError(
       `Profile '${name}' has OAuth credentials and cannot be converted to a custom endpoint.\n` +
         'A profile is born subscription or endpoint and stays that way.\n' +
         'Create a fresh endpoint profile instead:\n' +
-        '  cc add <new-name> --custom',
+        '  cchost add <new-name> --custom',
     );
   }
 
@@ -434,7 +486,7 @@ async function runConfigure(name, profileDir, provided, opts = {}) {
     const isTTY = opts.isTTY != null ? opts.isTTY : process.stdin.isTTY;
     if (!isTTY) {
       throw usageError(
-        'cc add --custom requires either endpoint flags or an interactive terminal.',
+        'cchost add --custom requires either endpoint flags or an interactive terminal.',
       );
     }
     io = defaultWizardIo();
@@ -455,6 +507,10 @@ module.exports = {
   ENV_FILE,
   FIELDS,
   TIER_FIELDS,
+  AUTH_ENV_VARS,
+  authEnvConflicts,
+  ENDPOINT_ENV_VARS,
+  endpointEnvToStrip,
   envFilePath,
   hasEnvConfig,
   readEnvConfig,