ccprofiles-core 0.1.1 → 0.2.0

package/dist/adopt.d.ts

@@ -2,3 +2,11 @@ import type { LiveProfile } from './discovery.js';
 import type { Manifest } from './manifest.js';
 import { type Platform } from './platform.js';
 export declare function buildManifest(live: LiveProfile[], platform: Platform): Manifest;
+/**
+ * Re-migrate secret refs after a snapshot/adopt rebuilds the manifest from live state.
+ * Live settings.json holds resolved plaintext values, so a freshly built manifest would
+ * re-leak a previously migrated token as plaintext. For each profile that existed before,
+ * if the old manifest had a secret:// ref whose resolved value matches the newly-discovered
+ * plaintext value, restore the ref instead of the plaintext.
+ */
+export declare function preserveSecretRefs(newM: Manifest, oldM: Manifest, getSecret: (name: string) => Promise<string | null>): Promise<void>;

package/dist/adopt.js

@@ -32,7 +32,29 @@ export function buildManifest(live, platform) {
             env: {},
             links,
             mcp: Object.keys(lp.mcpServers).sort(),
+            settingsEnv: lp.settingsEnv,
         };
     });
     return { version: 1, hub, profiles, mcpServers };
 }
+/**
+ * Re-migrate secret refs after a snapshot/adopt rebuilds the manifest from live state.
+ * Live settings.json holds resolved plaintext values, so a freshly built manifest would
+ * re-leak a previously migrated token as plaintext. For each profile that existed before,
+ * if the old manifest had a secret:// ref whose resolved value matches the newly-discovered
+ * plaintext value, restore the ref instead of the plaintext.
+ */
+export async function preserveSecretRefs(newM, oldM, getSecret) {
+    for (const pr of newM.profiles) {
+        const old = oldM.profiles.find(p => p.name === pr.name);
+        if (!old)
+            continue;
+        for (const [k, v] of Object.entries(old.settingsEnv ?? {})) {
+            if (!v.startsWith('secret://'))
+                continue;
+            const resolved = await getSecret(v.slice('secret://'.length));
+            if (resolved !== null && pr.settingsEnv[k] === resolved)
+                pr.settingsEnv[k] = v;
+        }
+    }
+}

package/dist/apply.d.ts

@@ -16,8 +16,14 @@ export type ApplyAction = {
     kind: 'rc-block';
     rcFile: string;
     block: string;
+} | {
+    kind: 'set-settings-env';
+    settingsPath: string;
+    env: Record<string, string>;
 };
-export declare function planApply(m: Manifest, live: LiveProfile[], p: Platform): ApplyAction[];
+/** Resolve secret:// refs in every profile's settingsEnv. Throws on a missing secret. */
+export declare function resolveSettingsEnv(m: Manifest, getSecret: (name: string) => Promise<string | null>): Promise<Record<string, Record<string, string>>>;
+export declare function planApply(m: Manifest, live: LiveProfile[], p: Platform, resolvedSettingsEnv?: Record<string, Record<string, string>>): ApplyAction[];
 export declare function executeApply(actions: ApplyAction[], opts: {
     backupRoot: string;
     stamp: string;

package/dist/apply.js

@@ -10,7 +10,28 @@ function configPathFor(dir, home) {
 function sortKeys(o) {
     return Object.fromEntries(Object.entries(o).sort(([a], [b]) => a.localeCompare(b)));
 }
-export function planApply(m, live, p) {
+const SECRET_PREFIX = 'secret://';
+/** Resolve secret:// refs in every profile's settingsEnv. Throws on a missing secret. */
+export async function resolveSettingsEnv(m, getSecret) {
+    const out = {};
+    for (const pr of m.profiles) {
+        const env = {};
+        for (const [k, v] of Object.entries(pr.settingsEnv ?? {})) {
+            if (v.startsWith(SECRET_PREFIX)) {
+                const ref = v.slice(SECRET_PREFIX.length);
+                const val = await getSecret(ref);
+                if (val === null)
+                    throw new Error(`profile "${pr.name}": secret not found: ${ref} (for ${k})`);
+                env[k] = val;
+            }
+            else
+                env[k] = v;
+        }
+        out[pr.name] = env;
+    }
+    return out;
+}
+export function planApply(m, live, p, resolvedSettingsEnv) {
     const actions = [];
     const hubProfile = m.profiles.find(x => x.name === m.hub) ?? null;
     for (const pr of m.profiles) {
@@ -34,6 +55,19 @@ export function planApply(m, live, p) {
                 continue;
             actions.push({ kind: 'link', from, to });
         }
+        const senv = pr.settingsEnv ?? {}; // literals in older tests may omit the field
+        if (Object.keys(senv).length > 0) {
+            let desired = resolvedSettingsEnv?.[pr.name];
+            if (!desired) {
+                if (Object.values(senv).some(v => v.startsWith(SECRET_PREFIX)))
+                    throw new Error(`profile "${pr.name}": settingsEnv has secret refs — pass resolved settings env to planApply`);
+                desired = senv;
+            }
+            const currentEnv = lp?.settingsEnv ?? null;
+            if (!currentEnv || JSON.stringify(sortKeys(currentEnv)) !== JSON.stringify(sortKeys(desired))) {
+                actions.push({ kind: 'set-settings-env', settingsPath: join(dir, 'settings.json'), env: desired });
+            }
+        }
     }
     const block = renderRcBlock(m, p);
     let rcCurrent = '';
@@ -49,7 +83,10 @@ export async function executeApply(actions, opts) {
     const performed = actions.map(describe);
     if (opts.dryRun)
         return { backupDir: null, performed };
-    const touched = actions.flatMap(a => a.kind === 'set-mcp-servers' ? [a.configPath] : a.kind === 'rc-block' ? [a.rcFile] : []);
+    const touched = actions.flatMap(a => a.kind === 'set-mcp-servers' ? [a.configPath]
+        : a.kind === 'rc-block' ? [a.rcFile]
+            : a.kind === 'set-settings-env' ? [a.settingsPath]
+                : []);
     const backupDir = touched.length ? await backupFiles(touched, opts.backupRoot, opts.stamp) : null;
     for (const a of actions) {
         if (a.kind === 'create-profile-dir') {
@@ -89,6 +126,16 @@ export async function executeApply(actions, opts) {
             await mkdir(dirname(a.rcFile), { recursive: true });
             await atomicWrite(a.rcFile, upsertManagedBlock(rc, a.block));
         }
+        else if (a.kind === 'set-settings-env') {
+            let cfg = {};
+            try {
+                cfg = JSON.parse(await readFile(a.settingsPath, 'utf8'));
+            }
+            catch { /* new file */ }
+            cfg.env = a.env;
+            await mkdir(dirname(a.settingsPath), { recursive: true });
+            await atomicWrite(a.settingsPath, JSON.stringify(cfg, null, 2));
+        }
     }
     return { backupDir, performed };
 }
@@ -98,5 +145,6 @@ function describe(a) {
         case 'create-profile-dir': return `create ${a.dir}`;
         case 'link': return `link ${a.from} -> ${a.to}`;
         case 'rc-block': return `update managed block in ${a.rcFile}`;
+        case 'set-settings-env': return `set settings env (${Object.keys(a.env).length}) in ${a.settingsPath}`;
     }
 }

package/dist/discovery.d.ts

@@ -6,5 +6,6 @@ export interface LiveProfile {
     account: string | null;
     mcpServers: Record<string, McpServerDef>;
     links: Record<string, string>;
+    settingsEnv: Record<string, string>;
 }
 export declare function discoverProfiles(home: string): Promise<LiveProfile[]>;

package/dist/discovery.js

@@ -26,6 +26,15 @@ export async function discoverProfiles(home) {
                 catch { /* skip */ }
             }
         }
+        const settingsEnv = {};
+        try {
+            const s = JSON.parse(await readFile(join(dir, 'settings.json'), 'utf8'));
+            if (s && typeof s.env === 'object' && s.env !== null)
+                for (const [k, v] of Object.entries(s.env))
+                    if (typeof v === 'string')
+                        settingsEnv[k] = v;
+        }
+        catch { /* no settings.json */ }
         out.push({
             dirName: e.name,
             dir,
@@ -33,6 +42,7 @@ export async function discoverProfiles(home) {
             account: cfg?.oauthAccount?.emailAddress ?? null,
             mcpServers: cfg?.mcpServers ?? {},
             links,
+            settingsEnv,
         });
     }
     return out.sort((a, b) => a.dirName.localeCompare(b.dirName));

package/dist/manifest.d.ts

@@ -28,6 +28,7 @@ declare const ProfileSchema: z.ZodObject<{
     env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     links: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     mcp: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    settingsEnv: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
     env: Record<string, string>;
     name: string;
@@ -36,6 +37,7 @@ declare const ProfileSchema: z.ZodObject<{
     auth: "env" | "oauth" | "api-key";
     links: Record<string, string>;
     mcp: string[];
+    settingsEnv: Record<string, string>;
 }, {
     name: string;
     dir: string;
@@ -44,6 +46,7 @@ declare const ProfileSchema: z.ZodObject<{
     env?: Record<string, string> | undefined;
     links?: Record<string, string> | undefined;
     mcp?: string[] | undefined;
+    settingsEnv?: Record<string, string> | undefined;
 }>;
 declare const ManifestSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
@@ -56,6 +59,7 @@ declare const ManifestSchema: z.ZodObject<{
         env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
         links: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
         mcp: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        settingsEnv: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, "strip", z.ZodTypeAny, {
         env: Record<string, string>;
         name: string;
@@ -64,6 +68,7 @@ declare const ManifestSchema: z.ZodObject<{
         auth: "env" | "oauth" | "api-key";
         links: Record<string, string>;
         mcp: string[];
+        settingsEnv: Record<string, string>;
     }, {
         name: string;
         dir: string;
@@ -72,6 +77,7 @@ declare const ManifestSchema: z.ZodObject<{
         env?: Record<string, string> | undefined;
         links?: Record<string, string> | undefined;
         mcp?: string[] | undefined;
+        settingsEnv?: Record<string, string> | undefined;
     }>, "many">;
     mcpServers: z.ZodRecord<z.ZodString, z.ZodObject<{
         command: z.ZodString;
@@ -103,6 +109,7 @@ declare const ManifestSchema: z.ZodObject<{
         auth: "env" | "oauth" | "api-key";
         links: Record<string, string>;
         mcp: string[];
+        settingsEnv: Record<string, string>;
     }[];
     mcpServers: Record<string, z.objectOutputType<{
         command: z.ZodString;
@@ -122,6 +129,7 @@ declare const ManifestSchema: z.ZodObject<{
         env?: Record<string, string> | undefined;
         links?: Record<string, string> | undefined;
         mcp?: string[] | undefined;
+        settingsEnv?: Record<string, string> | undefined;
     }[];
     mcpServers: Record<string, z.objectInputType<{
         command: z.ZodString;

package/dist/manifest.js

@@ -22,6 +22,7 @@ const ProfileSchema = z.object({
     env: z.record(z.string()).default({}),
     links: z.record(z.string()).default({}),
     mcp: z.array(z.string()).default([]),
+    settingsEnv: z.record(z.string()).default({}),
 });
 const ManifestSchema = z.object({
     version: z.literal(1),
@@ -56,6 +57,15 @@ export function assertSafeManifest(m) {
                     throw new ManifestError(`unsafe secret reference in profile "${p.name}": ${JSON.stringify(v)}`);
             }
         }
+        for (const [k, v] of Object.entries(p.settingsEnv)) {
+            if (!SAFE_ENV_KEY.test(k))
+                throw new ManifestError(`unsafe settings env var name in profile "${p.name}": ${JSON.stringify(k)}`);
+            if (v.startsWith(SECRET_PREFIX)) {
+                const ref = v.slice(SECRET_PREFIX.length);
+                if (!SAFE_NAME.test(ref))
+                    throw new ManifestError(`unsafe secret reference in profile "${p.name}": ${JSON.stringify(v)}`);
+            }
+        }
     }
 }
 export function parseManifest(text) {

package/package.json

@@ -1,16 +1,33 @@
 {
   "name": "ccprofiles-core",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "Core library for ccprofiles — discovery, manifest, secrets, apply, and LAN sync for Claude Code multi-account setups",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/tmfadhlul/claude-code-profile.git", "directory": "packages/core" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tmfadhlul/claude-code-profile.git",
+    "directory": "packages/core"
+  },
   "homepage": "https://github.com/tmfadhlul/claude-code-profile#readme",
   "bugs": "https://github.com/tmfadhlul/claude-code-profile/issues",
-  "keywords": ["claude-code", "claude", "profiles", "mcp", "config-management"],
-  "engines": { "node": ">=20" },
-  "dependencies": { "yaml": "^2.5.0", "zod": "^3.23.0" }
+  "keywords": [
+    "claude-code",
+    "claude",
+    "profiles",
+    "mcp",
+    "config-management"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "yaml": "^2.5.0",
+    "zod": "^3.23.0"
+  }
 }